Before Mike Malone asked companies to rethink identity, he had to negotiate with a small kingdom of aging computers in his parents' basement. In high school, he assembled what he calls a “motley little datacenter” from decommissioned hardware bought second-hand on eBay: a Compaq ProLiant running AIX, an SGI Challenge on Irix, a Sun Ultra on Solaris, plus old IBM boxes carrying Linux and FreeBSD. It was less a tidy lab than a census of operating systems.
He switched the machines from telnet to OpenSSH. The upgrade was worthwhile and, in his telling, a chore. Years passed before the cryptography underneath SSH felt comfortable. That detail is the germ of his later company: the secure option existed, but using it asked too much of the person at the keyboard.
Malone's fascination started earlier. In sixth grade, he bought a Borland C book and taught himself to code. During the Napster years, he hosted an OpenNap server in that basement and ran services on IRC. He describes himself as “a nerd from way back,” a phrase delivered with the ease of someone who has stopped pretending the origin story needs polishing. He is married, has two children and a dog, and says he collects hobbies - which is simply curiosity with storage requirements.
A career following the cloud
At Virginia Tech, Malone studied Business Information Systems rather than computer science. After graduating in 2006, he spent a brief spell at Accenture, then chose the less upholstered life of a three-person startup. His early work moved through the social web: Pownce, the microblogging service, and Six Apart, where he worked on online conversation and interactive communities. He contributed to Django and participated in open-web standards efforts around OAuth and Activity Streams.
Then his career bent toward infrastructure. As lead architect at SimpleGeo, he helped build distributed database technology for geospatial services. He moved to Urban Airship, another company operating at cloud scale. Former colleagues remembered a combination that rarely fits neatly on a résumé: the engineer who could quote literature, gather metrics, make a practical call and use humor to lower the temperature in a room.
Betable made the security problem impossible to treat as an academic exercise. The online gambling platform held customer funds while working under heavy regulation. Malone joked that it was regulated like a bank that sells liquor. The engineering questions were blunt: how do you preserve a quick development cadence, satisfy compliance and prevent a malicious insider from walking away with money?
The answer could not be another policy document or a security review delivered after launch. Systems needed strong identity built into their daily operation. Malone had encountered variations of the same friction across startups, microservices and cloud infrastructure. At Betable, the pain acquired a balance sheet.
“My happy place is distributed systems architecture.”Mike Malone, in conversation with TFiR
The credential has to introduce itself
Malone founded Smallstep in San Francisco in 2016 around a deceptively plain question. When thousands of services, workloads and devices talk to one another without a human present, how does each side know what is on the other end? Network location is a poor biography. A password or API token can be copied. A long-lived SSH key can outlast the employee, machine or project it was meant to serve.
His preferred building blocks are certificates, the same broad machinery used to establish trust on the public web. Smallstep issues and renews them automatically, favors short lifetimes and uses mutual TLS so both ends of a connection authenticate. The company released open-source tools, including its command-line utility and certificate authority, then built a managed platform for organizations that do not want to operate the underlying machinery.
The scale changes the character of the task. A company no longer keeps a dozen certificates in a drawer and adds reminders to a calendar. Kubernetes clusters, databases, service meshes, virtual machines and message queues can create hundreds of thousands of identities. Manual care does not become heroic at that volume. It becomes a source of outages. Malone's product argument is that renewal should happen as routinely as any other background process, leaving people to investigate exceptions instead of nursing every credential.
How a device earns trust
This is practical zero trust with the slogan removed. Instead of assuming that anything inside a perimeter is friendly, each connection carries cryptographic proof. Instead of distributing the same secret to many places, each actor receives its own credential. Instead of hoping a revocation list catches every departure, certificates can expire quickly and renew automatically.
Malone's writing is useful because it keeps the intimidating nouns while lowering their social cost. In his guide to public key infrastructure, he admits he once avoided the subject and felt ashamed for not knowing more. The result was a loop familiar to capable engineers: too embarrassed to ask, therefore never learning. Once forced to understand PKI, he wrote the guide he had needed. His conclusion is brisk: certificates bind names to public keys; the rest is detail.
Open source, without the fairy tale
Smallstep took its time. When Malone finally announced $26 million in seed and Series A funding in 2022, the company had been alive for six years. He opened the announcement by confessing that he found funding news “prematurely self-congratulatory and slightly gauche.” The disclosure covered a $7 million seed round and a $19 million Series A led by StepStone Group.
Those years had gone into building core infrastructure in public. Malone believes certificate technology should be available to everyone, which is the philosophical case for open source. He is also unusually direct about the business tradeoff. Open source can be a marketing asset and an enterprise feature, but maintaining it is thankless, and it lacks the feedback loops of ordinary freemium software. People can download a tool, solve their problem and disappear happily into the night.
His response has not been to close the door. It has been to let Smallstep's technical people write about what they genuinely care about and allow expertise to do the recruiting. One such invitation began when Malone contacted engineer and writer Carl Tashian after a post about job hunting. Their scheduled 30-minute coffee stretched into hours as Malone traced the history of X.509 and ASN.1. Tashian joined and later described learning to “cheat” by turning existing curiosity, notes and conversations into useful creative work.
“I'm a nerd, so I'm here to have fun.”Mike Malone, The Infra Pod
Trust moves into the machine
Smallstep's more recent work moves identity closer to physical hardware. A private key held by a trusted platform module or secure enclave can be used without being exported. That difference matters: an attacker may steal a password or token and replay it elsewhere, but a non-exportable key remains bound to the device. Attestation lets the device prove what it is before a certificate is issued.
Malone presented that case in three minutes at the 2025 RSAC Innovation Sandbox, where Smallstep was one of ten finalists selected from hundreds of submissions. The company now applies device identity across Wi-Fi, VPNs, SSH and applications, with support spanning major desktop operating systems and device-management environments. Smallstep has also contributed implementation experience to the emerging IETF work around ACME device attestation.
In 2026, Malone tied the architecture to a faster security climate. AI-assisted vulnerability discovery, he argued, compresses the interval between finding a flaw and exploiting it. If software cannot be assumed trustworthy for long, credentials should be harder to extract and useful for less time. Hardware-bound keys, short-lived certificates and continuous verification move the burden toward things an attacker has a harder time carrying away.
There is a pleasing continuity here. The teenager in the basement learned that secure access was possible but laborious. The CTO learned that secrets and manual process become dangerous at organizational scale. The founder is still working on the same annoyance: powerful security that asks operators to become amateur cryptographers will be applied unevenly. His ambition is to make the right thing the easy thing, then automate it before anyone can turn it back into a spreadsheet.
Malone's career is often described through technical layers - social software, distributed databases, cloud systems, certificate authorities, hardware attestation. The more personal pattern is simpler. He keeps walking toward subjects smart people avoid, remembers what the doorway felt like and leaves it wider than he found it. For someone trying to eliminate passwords, he has built a life around making difficult things easier to enter.