Mike Malone had built something people liked. Smallstep’s early work included a programming language and a policy engine for controlling how software services interacted. It was a considered answer to an intricate question. Then the prospective customers supplied an awkward detail: they had not yet solved the question that came before it.
Before deciding what a service may do, you need to establish which service it is. Authorization depends on authentication. A beautifully written guest list does little good if everyone arriving at the door can choose their own name. Malone’s customers wanted help with the introductions.
That exchange explains a surprising amount about the San Francisco founder and CEO. He enjoys the elaborate machinery of software systems. He is also willing to follow a practical objection down through the machinery until he finds the part that needs fixing. Smallstep, founded in 2016, took shape in that descent.
A Borland book, then a basement server
The interest began well before the company. In sixth grade, Malone bought a book about Borland C and taught himself to program. By high school, he was spending time on IRC and operating an OpenNap server on an old SGI Challenge S. His early internet experience included running the equipment, rather than simply using whatever appeared on its screen.
He later graduated from Virginia Tech with a degree in Business Information Systems. A short stretch at Accenture gave way to a three-person startup. His subsequent jobs included Pownce, Six Apart, SimpleGeo and Urban Airship. The titles changed from web developer to software engineer to lead architect, but the work kept bringing him into systems with multiple moving parts.
There is a pleasing mismatch in that education: the founder explaining cryptographic infrastructure has a business degree. It gives his biography a little less of the inevitability that startup biographies tend to acquire in hindsight. The sixth-grade book was a beginning. The route from that book to a security company required several employers and some unwelcome practical lessons.
Malone credits his father as an early entrepreneurial influence. A civil and mechanical engineer, his father investigated accidents and helped found FTI Consulting. In Malone’s account, he encouraged his son’s interest in computing and saw the opportunity in the internet. It is a family connection with a practical emphasis: engineering could explain a failure, and it could also become the basis of a business.
The internet should know how to introduce things
One piece of Malone’s earlier work still sits in the plumbing of the web. The oEmbed specification lists him among its four authors, alongside Cal Henderson, Leah Culver and Richard Crowley. oEmbed lets a site obtain an embeddable representation of a resource from a URL. A link can become a video or another rich piece of content without the receiving site having to scrape the original page.
The problem is ordinary enough to disappear when solved. Paste something into a publishing tool; expect the tool to understand what to show. Behind that convenience is an agreement about what one system asks and what another returns. The authors supplied a shared vocabulary for a recurring exchange.
It makes an illuminating companion to his later work. Embedding a video and authenticating a machine involve very different stakes. Both reward a person who notices the messy handoff between independently operated systems. An elegant application still needs its neighboring applications to understand it. Malone’s career keeps returning to those boundaries.
“I’m a nerd, so I’m here to have fun.”
Mike Malone, The Infra Pod
When the money belongs to someone else
At Betable, where Malone served as CTO, the consequences became harder to shrug off. The company built an online gambling platform. He has described the difficulty of handling customer funds while preserving the development practices he knew: small services, frequent changes and the pace of startup engineering.
His joke about the regulatory environment was economical: a bank that sold liquor. It captures the awkward combination of financial responsibility and restrictions surrounding gambling. For the engineer, this meant thinking about the person on call who needed access to fix a problem, as well as the malicious insider who might abuse that access.
A system needs people to operate it. Giving them useful access creates risk; making access impossible creates a different operational problem. Malone had encountered security friction elsewhere, but Betable put customer money behind the question. The eventual company grew out of engineering work in which the rules and the software had to coexist every day.
The missing introduction
Smallstep’s early authorization demonstrations drew a response that redirected the business. Teams needed a dependable way for their services to establish identity before a policy engine could govern their conversations. Malone’s research led toward TLS, the protocol familiar from encrypted web connections, and toward the certificates needed to use it.
A certificate associates an identity with a public key, backed by an issuer the parties trust. Used with the corresponding private key, it helps a service prove who it is. The operational challenge arrives when certificates must be issued, renewed and distributed across a changing collection of machines. The security primitive may be familiar; the administration can still be a nuisance of considerable ambition.
An explanatory sequence, rather than a product architecture diagram.
Malone’s writing went straight at the surrounding habits. In 2018 he argued for TLS across internal service traffic, including inside production network perimeters. An internal address could describe where something was running. The connection still deserved encryption and authentication. His argument asked engineers to make a familiar internet mechanism part of their everyday infrastructure.
In December 2018, he introduced Smallstep’s open source certificate-management tools. The emphasis was on making secure access workable across services, cloud environments and people. For a founder fascinated by system architecture, the choice was revealing: spend time on the infrastructure other developers would need before their own larger designs could work.
A security talk with a tropical shirt
Malone’s explanations have a sharper edge than the typical enterprise brochure. His 2019 SSH essay argued for certificates in place of the familiar practice of distributing and tracking individual public keys. With certificates, servers can trust an issuing authority and accept identities under defined conditions, including an expiration time. The bookkeeping moves into a system designed to perform it.
He brought that argument to BSidesSF in 2020. In the recording, he wears a patterned shirt and a cap while a slide introduces a cartoon “spooky monster.” The monster is the operational burden of ordinary public-key authentication: re-keying, distribution and files that bind names to keys. It is an unusually cheerful visual treatment for a subject that can otherwise resemble tax preparation for computers.
Another essay considered passive revocation: give a certificate a short life, then let it expire. That shifts attention toward reliable issuance and renewal. Short lifetimes limit how long a credential remains valid; they also make automation essential. A security improvement that depends on somebody remembering a deadline has inherited a rather fragile scheduler.
The coffee that overran its reservation
Carl Tashian supplies a small, useful portrait of Malone as a colleague. When Tashian posted about looking for opportunities, Malone contacted him after reading his history of random numbers. He thought public key infrastructure needed similarly accessible technical writing. Their planned half-hour coffee became a conversation lasting a couple of hours, including the history of X.509 and ASN.1.
One can admire the recruiting efficiency: bring a writer to coffee, send him home curious about certificate formats. Tashian joined Smallstep and described a working culture that made room for exploration and play. The anecdote gives the technical enthusiasm a social dimension. Malone wanted someone who could make other people interested in the details, too.
His former colleagues describe a related combination. Joe Stump points to the distributed database work at SimpleGeo and an outgoing style. Grey Lathrop remembers an engineer who could consult the literature, collect measurements and still deliver a project, with humor that helped defuse tension. These are colleagues’ assessments, but they suggest why an architectural argument could become a recruiting conversation.
Six years, then a public number
In April 2022, Smallstep disclosed $26 million raised across seed and Series A financing. Malone had spent six years building the company. His announcement treated funding with a certain embarrassment, while thanking the investors who had helped it happen.
Company financing, not Malone’s personal wealth.
Kent Goldman, the early Upside Partnership investor, recalls a founder arriving with a large computer-science idea and joking about revisiting von Neumann architecture. Goldman’s account concerns the patience required when the underlying work takes time. Bain Capital Ventures, another investor, emphasized Malone’s experience with identity and consistency at Betable and SimpleGeo. The investment case rested partly on problems he had already met at work.
The customer conversations continued to matter. Smallstep’s account of its early SSH product describes more than 100 discussions with prospective users, a prototype built in a day, and feedback that exposed an onboarding process that delayed the useful moment. Even a company devoted to removing technical friction could manufacture some of its own. The willingness to document that mistake belongs alongside the original pivot.
Three minutes, with seven seconds left
By April 2025, Malone was presenting Smallstep as one of ten RSAC Innovation Sandbox finalists. The presentation format allowed three minutes. He later said the team finished with seven seconds remaining. After the long apprenticeship in infrastructure, the story had to fit inside an interval shorter than many software updates.
The next chapter gives that story another audience. A March 2026 integration with Keycard brought Smallstep’s verified infrastructure identity together with runtime controls for AI agents. Keycard governs tool use and permissions; Smallstep establishes the trusted environment from which a session begins. The old dependency between identity and policy has returned with new actors.
In his May 2026 writing, Malone focused on credentials that can be copied from one machine and replayed somewhere else. His proposed direction combines hardware-bound private keys, short-lived certificates and repeated verification. He also acknowledges the limit: an attacker controlling a device may still use its key while operating on that device. Hardware changes the attack’s possibilities without making the endpoint invulnerable.
That qualification suits the career. Malone keeps bringing ambitious designs back to the smaller engineering questions that determine whether they hold. Before a service gets permission, it needs an identity. Before an agent acts, its environment needs verification. A decade into Smallstep, he is still working on the introductions.