Ron Gula and the question that comes after the hack

Ron Gula had a question for people who used Nessus, the vulnerability scanner at the center of Tenable’s business. It was pleasantly short: “Have you ever found malware with Nessus?” Either answer gave him somewhere to go. Yes meant investigating how an intruder had slipped past other defenses. No meant asking whether the customer was using the scanner’s capabilities fully. Here was a chief executive whose conversational icebreaker could turn into a configuration review. At least nobody had to discuss the weather.

That question, which Gula described in 2015, offers a useful way into his career. A tool could be installed, paid for, and widely respected, yet still leave its owner with something to learn. He wanted to hear what happened when it met an actual network. Over three decades, the setting has changed from government systems to security companies to startup pitches. The interest in what happens after the demonstration has remained.

A detour through the flying saucers

His route into the subject had an agreeable lack of career planning. Browsing UFO material through Gopher, an early internet information service, Gula encountered Phrack, the hacker publication. Curiosity about strange objects led him toward the rather more reproducible mystery of vulnerable software. A computer could do precisely what its designer intended and still permit something its designer had never considered.

“I was hooked,” he recalled. The appeal lay in the imbalance between the ease of bypassing software security and the difficulty of securing it. Later, as a government penetration tester, he would go and find the computers he had compromised during an authorized test, then talk to the administrators responsible for them. The result on a screen was only part of the exercise. Someone had to explain how that machine had ended up exposed.

As an Air Force officer working at the National Security Agency in the mid-1990s, he belonged to a penetration-testing group informally called The Pit. The name sounds like a venue with a strict dress code of black T-shirts. The work involved testing government networks, encountering defenses that succeeded and defenses that did not, and learning from both. Years later, he said those experiences still shaped how he thought about products and people.

Dragon meets the real internet

Commercial work gave Gula another set of practical problems. At BBN, he helped develop network honeypots, systems intended to attract and reveal hostile activity. At US Internetworking, he ran risk mitigation. Dissatisfaction with the forensic detail and speed available in an existing intrusion-detection product helped push him toward building Dragon and co-founding Network Security Wizards with Cyndi.

The archived technical conversations from that period are refreshingly specific. In February 2000, he posted Dragon signatures intended to detect the Pretty Park worm’s internet relay chat activity. He included a sample log from an internet service provider. A sales brochure might promise visibility; here were the packets, the detection rule, and the evidence. Readers could inspect the machinery.

That July, he told a security mailing list that Dragon sensors would run on the capture-the-flag network at DEF CON. His account of the previous year included simultaneous scans, experimental attacks, and people struggling to get Nessus running. It was a lively place to discover whether a detector worked. The company’s product was being exposed to people who regarded finding a weakness as a perfectly respectable way to spend a weekend.

Ten years before the first institutional check

Tenable began in 2002 with Gula, Jack Huffard, and Renaud Deraison, the creator of Nessus. Gula had already worked with Deraison on connecting Dragon events with Nessus vulnerability information. That pairing contained an enduring business question: how do you connect evidence of an attack with knowledge of what the target is vulnerable to?

The company built a business around helping organizations understand and manage those exposures. Gula led it as CEO through 2016. For its first decade, the company operated before taking institutional venture funding. On September 5, 2012, he announced a $50 million investment from Accel, just as Tenable reached its tenth anniversary.

By then, his announcement counted more than a million Nessus users across 150 countries. SecurityCenter, the enterprise management platform, served nearly 1,000 enterprise customers. Those numbers make the sequence interesting: a substantial population of people using the technology came before the institutional investment. For a future investor, it was an unusually long apprenticeship in the value of paying customers.

Gula also explained the choice of name. The founders believed network security could be achieved and sustained. “Tenable” proposed a position that could be defended. It was a modestly optimistic word for an industry whose daily correspondence can resemble a list of reasons to unplug everything.

The company grows; the questions multiply

By November 2015, growth meant people as well as software. Gula wrote that Tenable had added 200 employees that year and more than doubled its sales force and reseller network. The company reported 20,000 customers worldwide and a run rate above $100 million. Serving customers at that scale introduced another problem: the organization itself had to become capable of doing more.

The customer list in that update ranged from Adidas and BMW to Microsoft and the US Department of Defense. There is no single, tidy network hidden inside that collection of names. A tool has to survive different administrators, procurement systems, operational constraints, and definitions of urgency. Expansion adds encounters with all of them.

His period as CEO ended in 2016. Tenable went public in 2018, after his tenure. Keeping those dates in order matters to the story: he helped build the company that reached the public market, and his own working life had already taken another turn. The founding chapter and the stock-market chapter overlap in consequence, rather than in job title.

Cyndi was already in the business

Any account that treats Cyndi as someone who appeared after the entrepreneurial success misses much of the work. She was president of Network Security Wizards. At Tenable, she built and ran operations spanning licensing, human resources, legal matters, facilities, accounting, marketing, support, and sales operations. A business can admire its software all day; it still needs contracts and someone to make sure people get paid.

At Gula Tech Adventures, Ron is president and Cyndi is managing partner. Their current team brings together people with industry and government experience. The operating histories are relevant: founders seeking help with a security company may need guidance about selling, hiring, and organization alongside a judgment about whether the technology works.

The firm’s current account says it has self-funded more than $200 million into dozens of AI, cybersecurity, and national security startups since 2017, with 18 exits and two IPOs. These are portfolio figures, attached to a particular investing operation. Behind the totals sits the less photogenic business of board work, introductions, mentoring, and deciding which claims deserve another question.

A five-minute test for a founder

In a 2019 conversation about fundraising, Gula described a recurring frustration: founders who wanted an hour to demonstrate everything before establishing what problem they solved. He wanted the central idea to engage an investor within five or ten minutes. A long technical explanation could arrive later, once someone understood why it mattered.

He also challenged marginal improvements. A security product that was slightly better than an incumbent might be technically worthwhile and commercially difficult. A buyer still had to justify switching. In that gap between an engineer’s satisfaction and a customer’s decision, many plausible companies could run out of room.

His advice included a question that sounds peculiar coming from someone prepared to invest: do you need investment? He urged founders to think about their own ambitions and the organization they hoped to build. Raising money commits a company to more work and particular expectations. The check arrives with a future attached. Ten years of operating before Tenable’s first institutional round had given him grounds to take alternatives seriously.

“Have you ever found malware with Nessus?”

Ron Gula, 2015

Make room at the table

Ron and Cyndi established the Gula Tech Foundation in 2021. Between 2021 and 2023, it ran six grant rounds of $1 million each, supporting cybersecurity nonprofits. Their interests included public awareness, broader participation in the field, and organizations working on the National Cybersecurity Strategy.

The October 2023 round divided $1 million among four organizations: Shadowserver, ICS Village, Internet Fire Brigade Society, and Intelligence for Good. The range is instructive. Defending networks also depends on organizations that collect information, share expertise, and help others act. Some of that work needs philanthropic backing rather than a conventional product sale.

The Cyber Ready Clinic, founded by the Gulas, extends the workforce side of that effort. It connects nonprofits needing cybersecurity help with practitioners gaining experience and seasoned mentors. In March 2026, it received a $500,000 Maryland Cyber and AI Clinic Grant with Howard, Frederick, and Carroll Community Colleges. Its published plan calls for expansion to more than 200 practitioners by the end of 2028.

There is a recognizable echo here of the tester who went to speak with the administrators. Practitioners must learn to explain risk across a table to someone responsible for an organization. The conversation is part of the work. An assessment has limited value if its recipient cannot decide what to do next.

And now, an animated version of the investor

Gula’s public work also makes room for a less solemn approach. His video catalog includes founder advice, policy discussions, interviews, science-fiction parodies, and Cynfeld, an animated sitcom about working in cybersecurity. The subjects include phishing, VPNs, and logs. Comedy writers have built careers with less promising office equipment.

There is also vRon, an AI version of Gula used for commentary about cyber and artificial intelligence. The format suits someone whose early internet curiosity included UFOs: technical subjects, speculative futures, and entertainment can occupy the same browser. The joke offers an entry point; viewers can stay for the argument.

Across these projects, his attention keeps returning to the person expected to use the information. A customer with a scanner. A founder with a pitch. A newcomer sitting in a nonprofit’s meeting room. Gula has spent years examining how systems fail. His current work spends considerable effort on giving people a better chance to make them hold.