Jacob Hansen and the art of handing over the keys

Jacob Hansen ended his announcement with a small joke. In April 2022, after leading Cobalt since its founding in 2013, he was handing the chief executive’s responsibilities to Chris Manton-Jones and moving to the board. “I got promoted.” Three words, placed where a founder might usually put a solemn farewell. They leave the reader with a pleasant administrative puzzle: how does giving away the largest job in your company count as moving up?

Hansen’s career offers an answer. He had already been a developer, fundraiser, salesman, recruiter and executive inside the same business. Each job belonged to a different version of Cobalt. The company kept growing; the person who helped start it kept having to learn another occupation. His departure from the CEO chair followed that same sequence.

It is an unusually useful way to read a founder’s story. The title stays put for years, while the work underneath it changes almost beyond recognition. In Hansen’s case, the changes ran from an early experiment in crowdsourced security to a business connecting software companies with specialist penetration testers. Eventually, even the signature on the chief executive’s door had to change.

Before Cobalt, there was Buenos Aires

Before the boardroom came an economics education, enterprise IT and a move to Argentina. Hansen studied Applied Economics and Finance at Copenhagen Business School and also studied at UCLA. At Accenture, he worked on enterprise technology for large clients. His conference biography places that consulting work in Copenhagen and London. The starting point was corporate computing, rather than a long apprenticeship inside the security industry.

There was another interest, too: Bitcoinfilm.org, the nonprofit documentary project he co-founded to tell stories of bitcoin adoption. In 2013, he was involved in a short film about Argentina. The attraction was the use of technology in ordinary transactions, beyond the abstractions of a currency debate. An economist with a camera project is a more interesting starting character than another founder arriving with a pitch deck.

That year, his Accenture colleague Esben Friis-Jensen joined him, Christian Hansen and Jakob Storm in Buenos Aires. Hansen had moved there the year before. The four worked from the coworking space La Maquinita to build their initial product over three months. Their early customers came through their network. The first security program tested their own creation. Before asking anyone else to trust the platform, they invited people to look for its weaknesses.

A crowd, a cheque and a shorter name

The company’s original name was Crowdcurity. It was descriptive in the manner of a suitcase packed past its recommended capacity: crowd and security, squeezed into a single word. The business began with bug bounties, allowing organizations to reward researchers for finding vulnerabilities. Google and Facebook had shown that outside researchers could contribute to security; the founders wanted smaller businesses to have access to the same kind of help.

In a 2014 interview, Hansen traced an inspiration to the earlier hack at bitcoin exchange Mt. Gox. A technology that could move money across borders also needed protection across borders. He explained how the team initially contacted researchers acknowledged in major technology companies’ security halls of fame. They were looking for people whose useful work was already visible.

The permissions were explicit. Businesses agreed to testing before it began. The platform was intended to connect willing customers and researchers, with feedback in both directions. That arrangement matters in a field where the same technical skill can be welcomed or treated as an intrusion, depending on who authorized it.

In July 2014, Hansen announced a $1 million funding round involving Tim Draper and Kima Ventures. The company had already hosted more than 90 application security programs. In June 2015, Crowdcurity became Cobalt. The new name was considerably easier to fit on a business card.

The cost hiding behind the bounty

Hansen soon started examining the economics of the model he had helped bring to market. A public bounty program has an attractive offer: pay for useful discoveries. But somebody still has to read the submissions, reject duplicates, check whether a reported flaw is real and communicate with the people who found it. The reward is only one part of the bill.

In his 2016 essay on bug bounty programs, he argued that a smaller, selected group of researchers could be a sensible starting point. An organization could cover the basics with a focused assessment, then broaden its program as its needs developed. Throwing the doors open immediately could create more work than the customer was prepared to manage. The queue of incoming reports had its own economics.

He took those questions to AppSec USA in October 2016, in a talk about the hidden difficulties of public bug bounties. Its subject was return on investment, including the management burden and the relationship between useful findings and noise.

That is an economist’s contribution to a security conversation: follow the scarce resource. A developer’s attention has a cost even when the inbox is free. Finding another report has little practical value if it prevents the team from acting on the important report already waiting there.

Getting the people into the software

Cobalt evolved toward Pentest as a Service, combining a software platform with a community of vetted testers. A penetration test is an authorized attempt to uncover exploitable weaknesses. The platform adds a way to arrange the engagement, communicate findings and connect the security work to the team responsible for repairs.

In his 2017 account of application security’s development, Hansen described a progression from early security practitioners to scanning tools and then crowdsourced platforms. His argument gave people a continuing place in the picture. Software could organize their work and make it easier to find the right expertise. Human judgment still mattered, particularly when understanding how an application’s business logic could be abused.

Two years later, he became interested in a smaller gap: the space in “pen test.” An essay about terminology used Lewis Carroll and portmanteau words to make a business argument. Hansen proposed “pentest” as language better suited to frequent testing, rather than an occasional event ending in a static report.

There is something amusing about a security founder stopping to edit the spacing. But the grammatical fuss served a practical purpose. Applications kept changing. He wanted the testing process, and the words people used for it, to acknowledge that movement. Even a missing space could become a product discussion.

The colleague who liked the stage

Building a company around people does not require its founder to enjoy being the most visible person in the room. Hansen publicly described himself as more introverted than extroverted, inclined to spend time with his laptop or a book. He had felt pressure to be outgoing, appear onstage and attend conferences because he thought that was what a CEO should do.

Caroline Wong, then Cobalt’s chief strategy officer, offered a different set of strengths. Hansen described her as comfortable onstage, with a long security career and roots in the Bay Area; he described himself as coming from Copenhagen without that security background. He was pleased that people often encountered Wong before they encountered the company.

The pairing gives Cobalt’s talk of collaboration a human scale. A founder need not reproduce every skill the organization needs. Someone else can enjoy the work he would rather avoid, and do it well. Recognizing that arrangement makes room for an actual colleague, with an actual career, instead of an imaginary executive who excels at everything.

For a business built to match outside specialists with customers, the same principle applied close to home. The founder could concentrate on his strengths while a colleague supplied experience and communication he valued. The stage did not need two identical people.

“Letting go is the path to growth.”

Jacob Hansen / CEO handover, 2022

The company grew; the job changed

Growth made that distribution of responsibilities more consequential. Cobalt expanded beyond San Francisco, opening in Berlin in 2018 and later in Boston. Its founders were building a company across locations, with the accompanying demands of asynchronous work and team structure. Hansen remembered the management-building phase in 2018 as difficult. Recruiting became a central part of his work.

By 2020, Cobalt had passed 100 full-time employees. That was when he felt he had become an executive, dealing with longer-range strategy and objectives. The difference between writing software and building the organization that writes software had become part of his daily job.

In August that year, the company announced a $29 million Series B led by Highland Europe, bringing disclosed total funding to $37 million. At the time, it had more than 500 customers and around 300 testers on the platform. These were company figures at a particular moment, rather than a description of Hansen’s personal fortune.

Discussing the round, he emphasized the opportunity to improve the people and processes of testing. The founders had entered security as outsiders. That distance, he believed, helped them question its routines. His stated ambition included an interface through which customers could initiate a pentest with a click, reducing the work required to get useful testing underway.

A successor, rather than another hat

The April 2022 handover brought in an executive with a different history. Chris Manton-Jones had held senior roles at LogMeIn, including work on the expansion of LastPass. Cobalt announced him as CEO while Hansen remained a board member. The company would keep its co-founder’s involvement and gain another person responsible for its operations.

Hansen said he had considered the decision for a long time and expected to learn from his successor. His account gave the move a purpose beyond the usual farewell thanks: relinquishing the role could help the company grow.

The line sits neatly beside his earlier work on matching skills to needs. By then, Cobalt’s needs had changed repeatedly. Treating the chief executive position as another responsibility to allocate made sense within that history. A founder’s name can remain attached to a company without his calendar remaining responsible for every part of it.

A bug has a life after discovery

His interest in the work itself continued. In March 2023, a Hansen essay set out a Find-to-Fix framework for security bugs: discover a problem, validate it, decide its priority and repair it. The sequence gave names to the handoffs between a finding and a useful result.

A fresh report and a confirmed vulnerability are different things. A confirmed vulnerability and a repair are different things, too. Each stage needs attention, and handing developers a collection of unverified reports can erode the relationship between security and engineering. The process has to account for the people receiving the work.

The essay thanked Jeff Forristal, Richard Seiersen and Caleb Sima for reading drafts and offering feedback. Hansen was still developing an argument in conversation with security practitioners, rather than treating a founder’s title as sufficient authority. His economics training, interest in distributed work and concern for practical coordination meet in that deceptively small sequence.

Today, Cobalt lists Hansen as a co-founder and board member; his public professional profile places him in Berlin. The company now has Sonali Shah as CEO. His place in the story is clear: he helped build the organization, changed his own work as it grew and eventually arranged for someone else to lead it. The joke about promotion works because the company carried on. The keys changed hands, and he remained involved.