Sam Glines and the Cost of Being Early

Sam Glines had a warning for the people financing cybersecurity. The money was plentiful, valuations were stretched, and the good times had an expiry date. In late 2015, while running Norse, he put it plainly: “There is still a lot of money in the deal flows but the music will stop.” A few months later, he was out as chief executive. It is an uncomfortable opening to a founder’s story, particularly one whose business was selling early warnings.

There had been reasons for confidence. Glines and his co-founder, Tommy Stiansen, had built a company around intelligence gathered from internet traffic. Norse attracted institutional investors, struck distribution agreements, and made a difficult subject visible through its animated attack map. Glines’s job was to turn that technical proposition into an operating business. His record contains the recruiting, financing, public arguments, and eventual reckoning that came with the assignment.

Before the glowing map, thirteen years of consulting

Glines’s route into entrepreneurship began in St. Louis. He attended Saint Louis University from 1991 to 1995; he studied accounting and management information systems. That combination puts the ledger and the computer in the same room. Both would matter later, when a security company’s appetite for development ran ahead of its immediate sales.

After university, he joined the consulting business that became Accenture. He spent thirteen years there, leading technology teams and working with corporate clients. His clients included Anheuser-Busch, BMW, Caterpillar, United Technologies, and Kraft. These were established organizations with existing systems and practical demands. Glines’s early professional world involved making technology useful inside a business, with all the coordination that implies.

He left Accenture in 2008 to pursue entrepreneurial work. At a digital media protection startup, he met Stiansen, who became Norse’s technical co-founder. Glines later described his time at Nexicon as about eighteen months. In April 2010, the pair founded Norse. Their responsibilities divided along recognizable lines: Stiansen was the chief technology officer; Glines took the chief executive’s work of strategy, recruiting, operations, and raising money.

The proposition: let trouble knock here first

Norse’s early commercial question was specific. When an unfamiliar internet address arrived at a business’s digital door, what should that business know about it? The founders wanted to assemble observations quickly enough to affect a transaction or a connection while a decision could still be made. A warning that arrives after the damage has a rather limited social life.

The company’s 2013 chronology shows how that idea reached the market. Its nGate payment gateway launched in April 2011 with IPViking technology incorporated. IPViking became a standalone service in November 2012. By January 2013, Norse had opened a Silicon Valley headquarters, alongside its St. Louis presence. The product was moving from payment security toward a wider market for live threat intelligence.

Glines was also named as a co-inventor, alongside Stiansen and Sheldon H. Foss Jr., on US patent 8,726,379, granted in May 2014. It described gathering and evaluating real-time information about the risk associated with an IP address. The patent places him inside the documented technical history of the business, as well as its financing history. It does not, by itself, measure how well a commercial product performed.

In 2014, Glines described the ambition as taking the first hit for customers. He also spoke about the less glamorous work required to pursue it: hiring. Norse was competing for security and engineering staff with Facebook, Google, and other employers. He said recruiting engineers from large technology companies had helped open the door to further candidates. The early-warning network needed people willing to build it.

Glines also explained why customers might want intelligence from outside their own networks. Observations gathered elsewhere could reveal attackers and their methods before those attackers reached a customer or its partners. The intended benefit was extra time to recognize a threat and respond.

A company with a very public face

For people outside security departments, Norse became associated with its attack map. Colored lines crossed a dark world map, giving network activity the pacing of an arcade game. The display offered a visual entrance to an abstract subject. A later discussion of cybersecurity visualization recorded both the attention and the skepticism it attracted. Glines was leading a business whose most recognizable image could travel much farther than an explanation of its products.

His own public appearances carried the argument into other settings. At TIA 2014, he joined a discussion about securing big data with Guardtime’s Matt Johnson and IBM’s Adam Gersting, moderated by Abe Nejad. Norse announced its inclusion in Gartner’s 2014 security intelligence “Cool Vendors” report and recognition in Red Herring’s North American Top 100. These were useful introductions for a young company trying to reach enterprise buyers.

Then came Sony. On December 29, 2014, Glines appeared on CNN with Don Lemon to discuss Norse’s investigation of the Sony Pictures hack. He argued that insiders had been involved and that North Korea’s involvement came later. He said Norse had given initial findings to the FBI and wanted to provide its full data for further examination. The theory put him in a public disagreement over an internationally prominent breach.

That account must remain a claim made by Norse. The FBI had already attributed the attack to the North Korean government on December 19, citing malware analysis and infrastructure connections. Glines’s television appearance demonstrates his willingness to argue Norse’s interpretation in public; it does not establish the interpretation as fact. The episode brought the chief executive’s confidence, and the evidence behind it, before a much larger audience.

Two routes into the boardroom

The commercial milestones were substantial enough to explain why Glines believed the business could expand. In December 2013, Norse raised a $10 million venture round, with Oak Investment Partners identified as its institutional backer. For a founder responsible for financing, the arrival of a venture firm was a change in the company’s available resources and relationships. There was now more to deliver, and more capital with which to attempt it.

In March 2015, NEC and its security subsidiary Infosec announced a partnership with Norse. NEC planned to incorporate Norse’s intelligence into its own security offerings. Infosec signed a worldwide primary distributor agreement, with sales beginning in Japan and ASEAN countries. This gave the founder’s global ambitions a concrete route to customers through an established technology organization.

September brought another route. KPMG Capital led an $11.4 million Series A1 round, with existing investors providing the remainder. Norse said the financing brought total venture funding to $42 million. The arrangement would allow KPMG member firms to offer Norse products and services through their cybersecurity practice. The stated uses of the new capital included product development and expansion of the international sales organization.

These agreements tell us something about the scale of Glines’s assignment. He was pursuing customers through companies with international reach while Norse was still developing its own products and sales capacity. A partnership could create introductions; product delivery and customer revenue had their own schedules. The distinction would become painfully visible when he explained what had gone wrong.

When the music stopped

In January 2016, Norse laid off roughly thirty percent of its staff. By the end of that month, its board had asked Glines to step down, and Howard Bain had taken over as interim chief executive. In his February 4 response, Glines confirmed that he was no longer employed by the company. The founder remained a co-founder, a permanent historical relationship with very little power over the next payroll.

His explanation identified an aggressive spending rate, sales below expectations in the second half of 2015, and a delayed Series B financing. He acknowledged management mistakes and accepted responsibility for the layoffs. His phrase “building ahead of very near-term revenue” compressed a complicated failure into seven words. Development required money now; the sales and financing expected to support it had not arrived on time.

“Building ahead of very near-term revenue.”

Sam Glines, February 2016

He also disputed criticism of Norse and his previous business history. He defended the value customers received, praised employees’ efforts, and said adverse coverage had caused deals to pause or collapse. His response was both an acknowledgment of his own decisions and an argument about the damage done afterward. The sequence matters: the financial pressures and layoffs preceded the public response.

The earlier warning about stretched cybersecurity valuations now reads differently. Glines had understood that abundant investment would eventually tighten. Yet recognizing a market risk and keeping a company funded through it are separate tasks. His warning survives beside his explanation of the layoffs, two statements from the same executive on either side of a very short interval.

St. Louis, beyond the chief executive title

There are quieter continuities in his career. His professional profile lists an advisory role with Saint Louis University’s operations and IT management program in 2014 and 2015, and judging for the 2014 Arch Grants startup competition. It also records ScrumMaster and Scrum Product Owner certifications earned in 2020. These details connect the founder’s public security work with a longer interest in technology teams and delivery.

His present LinkedIn profile lists ArchKey Solutions and a St. Louis location. Norse belongs to his history as a co-founder and former CEO. Keeping that distinction clear allows the story to have a life beyond its loudest chapter. Glines helped bring an early-warning idea into products, patents, partnerships, and public debate. He also had to explain why the company he led could no longer sustain the pace he had set. Both belong in the same account.