The sale was almost done when trust walked into the room carrying a clipboard. Justin Beals was CTO at a Seattle startup with an artificial-intelligence product that relied on sensitive employment data. A prospective customer wanted proof that the company could protect it. The request was sensible. The answer was awkward. There was no SOC 2 report waiting in a tidy folder, only a young team suddenly learning how long a security review can make six months feel.
They filled out questionnaires, reviewed policies and chased the evidence that turns good intentions into something a buyer may safely believe. The customer went elsewhere. Beals later repeated the sales maxim attached to the episode: “Time kills all deals.” Most founders would file that under painful administration. He filed it under product research.
Strike Graph, the company Beals co-founded with Brian Bero in 2020, emerged from that irritation. Its software helps organizations design a security program around their actual risks, connect controls to evidence and prepare for certifications including SOC 2 and ISO 27001. In other words, it tries to make trust less like a final exam discovered on closing day and more like a system that has been quietly doing its homework all term.
The coder enters stage left
The neat founder biography would begin with computer science. Beals’s begins with an Atari 800, grade-school experiments in BASIC and, eventually, a college degree in English and theater. The combination sounds eccentric until he explains it. A theatrical production gathers people with distinct crafts around an idea that does not yet exist. There is an opening date. There are cues, compromises and rehearsals. The audience arrives whether or not everyone feels ready.
“To me a start-up is very much like putting a play on,” he once said. The cast forms, the production gets a deadline, the work launches on a server, and then everybody “suffer[s] the financial outcomes.” It is a line with a grin in it, but also a durable management theory. Software may run on machines; companies run on coordinated people.
Four acts, one opening night
After college, Beals found the media industry too slow-moving for his taste and his programming skills rather more marketable. He joined British Telecom’s global division, working with large frame-relay networks and three Solaris desktops. He has joked that the extra screens did not triple his output. They did help move him from childhood fascination into the serious machinery of connected systems.
Startups followed. He founded Roundbox Global in 2000, just as enthusiasm for the internet was becoming scarce. Without easy access to capital, the company bootstrapped as a services business. Every engineering hour had a customer attached to it, which stripped away the comforting distance between beautiful code and useful work. During an all-hands with roughly 90 engineers in Costa Rica, Beals told the room that Roundbox was not truly in the technology-services business. It was in the relationship business.
People as infrastructure
That idea kept returning as his work moved through education technology and predictive hiring. At Koru, where he became a technology leader, the product used behavioral science and data to help employers look beyond familiar signals such as college pedigree. Beals was also named among the inventors of a training, tracking and placement system designed to score competencies and connect job seekers with training or work. Koru was acquired by Cappfinity. He later co-founded NextStep and served as its CTO.
The résumé shows a technologist. His interviews reveal a casting director. Beals argues that a startup’s first three hires establish what he calls its “deep-seated cultural architecture.” They influence the next 30 people, then the next 60 and 90. He looks beyond the obvious qualification for a role and searches for a candidate’s third, fourth and fifth useful capabilities - the unexpected experience that makes a small team more resourceful.
Before Strike Graph was even incorporated, he had begun conversations with people he hoped might join. He described the problems, collected their reactions and kept those relationships alive. When recruiting, he has favored direct notes over the passive ceremony of a job listing. His pitch is less “meet our requirements” than “these are the problems, and I think you would enjoy solving them.”
There is an ethical view beneath the tactics. Beals has worked with Ada Developers Academy, the tuition-free coding school created for women and gender-expansive adults, and joined its advisory board in 2020. He has said that overlooked candidates often bring precisely the courage and grit a startup needs. The CEO’s job, in his telling, is “to unblock the talent to deliver everything they can.” Public biographies also list board roles with VALID8 Financial and Edify Software Consulting.
The quiet machinery of trust
At Madrona Venture Labs, Beals tested the compliance idea, built an alpha and recruited Bero, who brought security and audit experience. Strike Graph launched in 2020 with a $3.9 million seed round. The product began with a risk assessment, then helped customers select controls and assemble evidence. The pitch was deliberately right-sized: companies should address the risks they actually have, rather than buying every control in the catalogue merely to look busy.
This is where Beals’s earlier careers meet. The programmer wants structure. The theater graduate wants the ensemble to understand its cues. The services founder wants the customer relationship to stay healthy. The hiring technologist wants useful evidence to beat prestige and assumption. Compliance, seen through all four lenses, becomes less about satisfying an auditor and more about making the organization legible to everyone who depends on it.
Strike Graph’s 2023 Series A-1 brought in $8.5 million, led by BAMCAP with existing investors joining. By 2024, Beals said customers had completed more than 150 audits through the company’s offering. The software had expanded from preparation into automated evidence collection, configurable mappings among risks, controls and evidence, and machine-learning assistance for testing. More recent work emphasizes AI-native compliance, third-party risk management and CMMC requirements.
Beals is careful to connect all that automation to ownership. A company should understand and operate its own security program, not hand the whole affair to an opaque machine or consultant. The useful automation is the kind that removes repetitive evidence hunting while leaving judgment visible. It makes the process less theatrical in the pejorative sense - fewer props assembled for audit day - and more like a well-run production in which the backstage machinery works every night.
The increment is the strategy
Grand visions make handsome slides. Beals prefers a smaller unit of progress. He has spoken candidly about finding distant strategy difficult without an incremental method for getting there. At Strike Graph, the answer was habit: daily stand-ups, weekly planning, transparent communication and feedback loops. A huge engineering estimate becomes more accurate when the work being estimated becomes smaller. The mountain is climbed by attending to the next foothold, not by staring harder at the summit.
His leadership philosophy is service, a phrase that can float pleasantly above actual work until he pins it down. The leader serves colleagues, customers and the mission. That means working alongside the team, resisting the urge to micromanage and still making a decision when people need a direction. Colleagues noticed that if a meeting began at eight, Beals was there five minutes early. Soon the team was, too. A calendar habit became a tiny public argument about respect.
Outside the office, older profiles add pleasing texture to the systems thinker. He once described a 90-minute morning yoga practice and sailing as ways to unplug. Another professional bio called him a boat dweller. His inspirations lean less toward celebrity executives than inventors and scientists willing to test the boundaries of what is known. The pattern is consistent: curiosity, repeated practice, a preference for the edge where something new has to be made.
He now hosts Secure Talk, a podcast that gives the former backstage problem a microphone. Episodes range across cybersecurity, AI, governance and changing regulations. Hosting is another ensemble job. The founder sets the scene, invites an expert and asks enough of the right questions for the audience to leave with a clearer map.
A proof, not a promise
The most useful idea in Beals’s story is not that compliance can be automated. It is that trust has an operational life. A buyer cannot carry a founder’s confidence into a risk meeting. A teammate cannot act on a culture that exists only in a speech. An auditor cannot verify a control that leaves no evidence. In each case, the intangible thing has to acquire a practice, a record and a rhythm.
Beals has spent a career giving those intangibles a stage. At Roundbox, the invisible product was the relationship behind the code. At Koru, it was the capability hidden behind a candidate’s pedigree. At Strike Graph, it is the security work behind a vendor’s promise. His favored tools have changed from BASIC and telecom networks to risk graphs and AI. The recurring problem has not: how to turn something people ought to believe into something they can responsibly act upon.
There is a wry symmetry here. A theater graduate built a company devoted to evidence. Yet theater itself understands evidence perfectly. The curtain rises. The cast is either ready or it is not. No mission statement can finish the rehearsal after the audience sits down. Strike Graph is Beals’s attempt to make sure security does not discover opening night at the top of an enterprise buyer’s questionnaire.