In 2017, Mike Armistead went for a walk with Paul Holland. The setting was Portola Valley, the format a filmed conversation between a founder and an investor. Their subject included a business relationship stretching back about 25 years, to Pure Software in the 1990s. There was a new company to discuss, too: Respond Software, which proposed handing some of a security analyst’s work to a machine.
A walk was a fitting way to explain this particular career. Armistead’s companies have changed, his employers have changed, and the fashionable vocabulary has certainly changed. The recurring concern is easier to follow: people have information in front of them, work to do and too little capacity to connect the two. Somewhere in that gap, he keeps finding another product to build.
Today he is co-founder and CEO of Pulse Security AI. Respond, the company that still accompanies his name in many older biographies, was acquired in 2020. His newest work takes him further up the organizational chart, toward the executive who must explain whether the whole security operation is accomplishing anything.
Before the alert queue, the code
Armistead’s background combines the disciplines of making software and making a business around it. He earned bachelor’s and master’s degrees at Stanford. His early career included Pure Software, where he worked for Reed Hastings, and positions at Pure Atria and Lycos. At Lycos, his responsibilities included development and data center teams supporting financial services, directories and web-based email.
These are useful details because cybersecurity can make a career sound narrower than it was. Armistead had already worked on products people used to find things, communicate and manage software before he became associated with securing them. His experience crossed product development and operating responsibility. A promising feature still had to become something a customer could use, and a team could deliver.
He co-founded Fortify Software in 2003. The company worked in application security, helping organizations examine software for vulnerabilities. HP acquired it in 2010. Armistead continued inside the larger organization, eventually holding vice president and general manager responsibilities for both Fortify and ArcSight. He had crossed from a startup into the machinery that surrounds a large enterprise product.
The queue that kept filling up
ArcSight brought him close to security operations centers: the teams watching for signs that something has gone wrong. Their problem involved a particularly awkward abundance. Security products could generate plenty of events. Investigating the events required people, and those people were already in short supply. Adding another stream of information could add another obligation to an overloaded day.
Respond Software, founded in 2016 with Robert Hipps and Chris Calvert, addressed the investigation itself. When it emerged from stealth in August 2017, it announced the Respond Analyst alongside a $12 million Series A led by CRV and Foundation Capital. The product was designed to reproduce parts of an experienced analyst’s reasoning, examining evidence and deciding which potential incidents deserved escalation.
Armistead described its approach as an expert system. Expertise was built into a mathematical model; incoming evidence then changed the probabilities attached to a situation. The product’s intended territory included large volumes of weak signals, such as network intrusion data. It gave a specific, repetitive piece of investigative work to software, leaving people more room for the work that followed.
That specificity matters. A suspicious event is the start of a question. Someone must consider its circumstances, decide how seriously to take it and determine what deserves attention next. Respond tried to make that intermediate work repeatable. The promise was useful precisely because the job had boundaries.
A price on the handoff
By December 2018, Armistead was discussing Respond’s technology on the Risky Business podcast. Even the episode title captured the appeal of reducing an enormous stream of activity to something people could investigate: “From 2 billion events to 350 alerts.” It was a vendor-sponsored conversation, a place to hear the company explain its approach rather than a universal benchmark for every customer.
On November 18, 2020, FireEye acquired Respond. The transaction was valued at approximately $186 million in cash and stock, excluding assumed unvested stock options. The buyer planned to integrate the technology into Mandiant Advantage and use it in Managed Defense. Respond’s automated investigation would sit beside Mandiant’s intelligence and frontline experience.
Approximate value of FireEye’s acquisition of Respond Software, in cash and stock. Excludes assumed unvested stock options.
An acquisition announcement provides a clean stopping place for a startup story. Armistead’s working life continued through it. He remained at Mandiant and subsequently Google after Google acquired Mandiant. People and accumulated experience carried on inside a larger organization, as they had after Fortify. His career includes the less photogenic work that comes after the celebratory announcement.
The sequence also gave him several views of the same customer. There was the developer dealing with insecure software, the analyst investigating suspicious activity and the executive deciding where to spend time and money. Improving one person’s tools could still leave the next person with a difficult explanation to assemble.
When the explanation lives in someone’s head
Consider the predicament Armistead described in an August 2026 essay about incoming chief information security officers. A new leader arrives to find useful knowledge distributed among old presentations, shared drives, spreadsheets and colleagues. Decisions have been made, exceptions approved and priorities changed. The documents may preserve a result while losing the reasoning that produced it.
The difficulty becomes apparent when the new person asks why a program operates as it does. Reconstructing that answer takes interviews and document searches. Meanwhile, the organization still expects a clear account of its risks. The first weeks become an investigation of the program itself, conducted by someone already expected to lead it.
Armistead’s interest here reaches beyond a report being late. He is concerned with organizational memory: what was decided, who was responsible and how the decision connected to the business. The outgoing employee’s memory is a remarkably portable storage device. Unfortunately, it leaves with the employee.
In his account, software should help preserve enough context for the next person to reason from it. That is a different assignment from counting alerts. It asks for continuity across projects, people and changes in leadership.
The executive becomes the user
Pulse Security AI launched publicly in July 2026 with $8 million in seed funding led by Foundation Capital, with participation from Zetta Venture Partners. Armistead co-founded it with Hipps and Nick Gilligan, an early Respond engineer. The company’s target is security program management: the operational work surrounding strategy, initiatives, risk and communication.
Its proposed foundation is a context graph, a way of connecting information that otherwise sits in separate places. Technical systems provide part of the picture. Policies, assessment documents, responsibilities and business priorities provide other parts. AI agents are intended to help assemble that picture and carry out program-level procedures.
Armistead’s launch essay makes the intended user clear. Finance, sales and human resources have management systems that support the executive running each function. Security leaders have often had to assemble their account of the organization from tools designed for narrower technical jobs. In his view, a management system should retain decisions and trade-offs as well as the latest measurements.
That ambition is easy to recognize outside security. Every organization has a meeting where someone presents a great many measurements and someone else asks a deceptively short question. Are we doing the right things? Answering requires a connection between the measurements and the choices. The existence of a dashboard does not supply the connection by itself.
The next company, familiar faces
There is continuity in the cast. Hipps helped found Respond; Gilligan helped build it. Pulse’s go-to-market leadership includes Dan Lamorena, whose career also passed through Respond, Mandiant and Google. They bring experience of working together into a new company, rather than beginning with introductions and a shared pitch deck.
Armistead’s relationship with Foundation Capital stretches across earlier chapters as well. The Pulse planning conversations began in September 2024, and the company started in January 2025. The $8 million announcement came later. Behind the public appearance was a period of defining the problem and deciding what to build.
The working arrangements have their own modest detail. Armistead has described Pulse as physically distributed, with occasional in-person meetings in his basement. That gives the next chapter a rather more domestic setting than the names of his previous corporate employers might suggest. A founder can return from Google and still have to find somewhere for everyone to sit.
Who answers for the answer?
The human responsibility remains central to his account of automation. In discussing AI, Armistead has argued for boundaries: identify the decisions software can make, those requiring review and those that should remain with people. A security executive needs a way to oversee that arrangement without personally examining every action.
“Govern the guardrails, not the keystrokes.”
Mike Armistead
His public conversations continue along that line. In September 2026, he hosted a webinar with board director Caroline Tsay about what directors need to hear from security leaders. In October, he appeared with Pulse advisor Joanna Burkey on The Cybersecurity Bridge. The discussion returned to helping security leaders move beyond constant firefighting toward ongoing strategic work.
Fortify, Respond and Pulse occupy different parts of the organization. Read together, they suggest a career increasingly concerned with the journey from evidence to judgment. A flaw needs attention. An alert needs investigation. A program needs someone who can explain the choices being made.
Armistead has kept moving toward that person. The question waiting there is shorter than any product specification: what should we do next?