John Watters and the danger of a successful idea

John Watters had reached a perfectly respectable place to stop. He had bought one cybersecurity company, founded another, and become president and chief operating officer of Mandiant. Google completed its acquisition of Mandiant in September 2022. An executive with that sequence behind him could reasonably spend the next chapter helping other people run companies. Watters did some of that. Then he returned to running one himself.

The reason is more interesting than the return. At iSIGHT Partners, he had helped build a business around understanding attackers: their objectives, their methods, and the traces they left behind. Security teams could use that knowledge to recognize trouble and decide where to spend their attention. Now, leading iCOUNTER, he argues that artificial intelligence is changing the economics of an attack enough to demand a different approach.

There is an awkwardness here that gives the story its shape. The familiar methods are partly his own inheritance. He is asking customers to reconsider an approach he helped establish, while asking them to trust his judgment about what follows it. Experience supplies both the credentials and the uncomfortable comparison.

A founder can become a curator of his best idea. Watters has chosen another assignment: finding out how much of that idea survives the next change in the market. The answer now has a company attached to it.

An investor buys himself an operating job

His route into cybersecurity began with capital rather than code. Watters bought iDEFENSE in 2002 as an investor and subsequently became its chief executive. “I bought the company in 2002 as an investor rather than an operator,” he has recalled. The distinction matters. Buying a business permits a certain distance from its difficulties. Becoming its operator puts those difficulties on the calendar.

iDEFENSE gathered information about threats and software vulnerabilities for organizations that needed warning before the damage arrived. Its vulnerability contributor program paid researchers for discoveries. A software flaw could therefore become information a defender could use, rather than an unwelcome surprise. The business sat at the intersection of technical discovery, customer trust, and the question of who should learn about a weakness first.

VeriSign acquired iDEFENSE in July 2005 for approximately $40 million in cash. The announcement described a network of more than 200 research contributors in over 30 countries. Watters would continue leading the research team. Those details make the operation tangible: a distributed collection effort, sold to customers who needed its findings to travel faster than the threat.

The early chapter also introduces a recurring feature of his career. Intelligence needed a route into a customer's decisions. Knowing something useful was the beginning of the commercial problem. Delivering it in time, in a form someone could act on, was the rest.

A map of the adversary becomes a business

iSIGHT Partners expanded that ambition. Watters founded and led the company before its acquisition by FireEye in January 2016. It built research operations across countries and organized intelligence around the people behind attacks, the techniques they used, and the evidence those techniques produced. That gave security teams context around alerts that might otherwise look like isolated bits of technical debris.

The map had a practical purpose. A company cannot treat every possible attacker as equally urgent. Intelligence can help it distinguish a campaign aimed at its sector from background noise, and connect an observed signal with a method worth investigating. A list grows longer with every addition. A useful map helps the reader choose a direction.

In 2013, Blackstone made a strategic investment in iSIGHT. Jay Leek, then Blackstone's chief information security officer, described using its products to prioritize resources against relevant threats. The planned iCRMS product would map intelligence to security devices. Research and distribution were being joined to the machinery of defense.

FireEye's acquisition closed on January 14, 2016, with approximately $200 million in cash consideration and the possibility of an additional $75 million tied to a bookings target. The combination brought iSIGHT's view of attackers together with Mandiant's experience investigating victims. For Watters, it also meant a different working scale: his company became part of a larger organization, and his responsibilities broadened beyond the business he had founded.

“CTOS treats intelligence as an operational product, not a report that waits until the threat has already moved.”

John Watters · on iCOUNTER's approach

The second return, before the next one

Watters held several senior roles after the deal, spanning intelligence, global services, and strategy. In April 2021, FireEye appointed him president and chief operating officer. He had stepped down as chief strategy officer the previous year, remaining involved through consulting and its advisory board. His return to the executive team came with an assignment to help accelerate the company's transition toward services and solutions.

Kevin Mandia described him as combining a founder's agility with operating experience and security knowledge. It was a useful description of the job: bring the habits of someone who starts things to an organization with existing products, customers, and obligations. The word “return” was already doing considerable work in Watters's career before iCOUNTER appeared.

Google's completion of the Mandiant acquisition in 2022 closed another corporate chapter. Watters continued investing and serving on boards. His affiliations have included SYN Ventures, Apollo Information Systems, Oleria, Batuta, and Mitiga. The move away from daily operations kept him close to the market in which his next operating role would emerge.

That proximity is part of the explanation. Retirement from an executive job can leave an experienced operator surrounded by the next set of problems. Board meetings are an imperfect hiding place from a business idea. In Watters's case, Apollo provided the connection to the intelligence capability that would become iCOUNTER.

When the old clues stop repeating

iCOUNTER emerged publicly on July 16, 2025, with a $30 million Series A led by SYN Ventures. Apollo announced the launch after five years of development behind the capability. A new company was introducing work that had already been taking shape, with Watters back in a chief executive's seat.

His argument begins with repetition. Defenders benefit when an attacker reuses a technique or infrastructure that someone has already identified. An earlier encounter supplies clues for the next one. Watters believes AI will let adversaries construct more attacks around the particular weaknesses of individual targets, reducing the value of waiting for a familiar pattern.

That is his thesis about the direction of attacks, and the basis of the business he is building. It raises a demanding question for his own industry: how much warning can a catalog of previous activity provide when the next operation is assembled for a particular company? A very good memory still needs something useful to remember.

His proposed starting point is the customer and its surrounding relationships. Which suppliers connect to it? What information do those suppliers hold? Where does evidence of adversary activity intersect with that particular network? In his account, understanding a threat becomes more useful when it can be attached to a specific exposure and a practical countermeasure.

The supplier has passed. The question remains.

The idea took a concrete product form on March 24, 2026, when iCOUNTER announced general availability of its Counter Threat Operating System, or CTOS. Its initial release included a module for third-party risk: the vendors, suppliers, and technology partners whose relationships extend a company's exposure beyond its own systems.

A supplier can have security controls and still attract an attacker's attention. A periodic assessment describes one kind of risk. Evidence that an adversary is preparing or conducting an operation adds another. Watters wants security teams to be able to act on that second kind of information while the first still looks reassuring.

CTOS is designed to map verified connections, detect signs of reconnaissance and targeting, and send evidence with recommended remediation. Its announced workflow also tracks action through vendor resolution. The ambition is to carry intelligence far enough that someone can close an exposure, rather than leave the customer admiring the accuracy of an alert.

On April 9, iCOUNTER announced the acquisition of ParseIntel's team and technologies to expand collection and speed the platform's development. This is familiar terrain for Watters: the value of the product depends on the quality and reach of the people and systems collecting its evidence. The new vocabulary sits on an old operating requirement. Somebody still has to find the thing that matters.

A microphone, and a question that keeps returning

By October 2026, Watters was also hosting Watters Edge, an iCOUNTER-sponsored podcast. Its first episode paired him with longtime friend Kevin Mandia. Later conversations included intelligence leader Maggie McDaniel, chief operating officer Joel Molinoff, and chief information security officer Ali Waezzadah. The guest list connects his earlier career to the team around his current company.

The discussions move between career choices and the work of running security operations. That makes the microphone a useful extension of his present role. The product needs to explain a change in how defenders work, and the people discussing it have spent years inside the organizations expected to make that change.

There is another commitment alongside the companies. Watters founded the STAIRS Program, a nonprofit supporting inner-city education, and has served as its director and president since 2000. His connection to education also includes a finance degree from Santa Clara University, whose alumni record identifies him with the class of 1986. His operating life reaches beyond the succession of security businesses.

The latest company nevertheless returns him to a problem visible in the first: useful knowledge has a deadline. At iDEFENSE it involved discovering vulnerabilities and warning customers. At iSIGHT it meant organizing a global view of adversaries. At iCOUNTER he wants evidence of targeting to reach the affected organization early enough to change its next move. Watters has changed companies, titles, and methods. The clock has kept its job.