Ted Ross and the Short Life of a Stolen Password

Ted Ross has a rule about email attachments. He does not open them. The sender can be someone he knows. The sender can be his wife. The attachment stays closed.

He volunteered this domestic detail in a 2021 essay about security culture, confirming a rumor about his own caution. It is a small glimpse of the person behind SpyCloud, the Austin company he co-founded in 2016. Plenty of executives recommend vigilance. Ross has apparently made it a household policy. One imagines the family photograph having to find another route.

His explanation was personal responsibility. A title does not excuse someone from the habits expected of everyone else. If a company wants its employees to take security seriously, the person running it ought to take the same precautions. The corner office gets no special exemption from the attachment rule.

That instinct helps explain the business he has spent the past decade building. Ross pays attention to what people actually do with information: share it, reuse it, trust it, steal it. SpyCloud works in the awkward interval after information has escaped and before someone turns it into money. His opportunity lies in making that interval useful to the defender.

First, learn how the wires connect

Ross began his career in the U.S. Air Force. Afterward, he ran a small networking business in San Antonio before becoming director of network engineering at West Corp. At Walmart, as a strategy architect, he worked on network design, security, performance, and management. These were jobs in which a network had to function for the people depending on it.

In 2000 he joined Extreme Networks, working with service providers on metro Ethernet and MPLS technologies. He moved to TippingPoint in 2004 and ran its global sales engineering team. Security became the focus of a career that had started with the infrastructure underneath it.

At HP, Ross held the role of vice president in the security division’s Office of Advanced Technology and built a threat intelligence practice. His team developed a platform for connecting threats with context; it launched five months after the team formed. He later became chief executive of Exodus Intelligence, whose work concerned previously unknown software vulnerabilities.

The sequence gives his later company an interesting pedigree. Ross had worked with the machinery that connects businesses, the tools that protect it, and intelligence about the people trying to defeat those tools. SpyCloud would bring those concerns together around something much more ordinary than an exotic software flaw: access that somebody else already possessed.

A thief’s inventory, a defender’s to-do list

In 2016, Ross co-founded SpyCloud. David Endler and Alen Puzic were fellow co-founders. When the company emerged from stealth in June 2017, it announced $2.5 million in seed funding from Silverton Partners and March Capital Partners. Its early proposition was to tell organizations when valuable online information had been exposed, delivering notifications through email or an API.

An account could become vulnerable because a different business had suffered a breach. The risk traveled with the credential. Ross described wanting to compare exposed credentials with those still in use, giving a defender something specific to act on. The idea favored a direct match over another ambiguous warning that required interpretation.

At FinovateFall in 2017, Ross and business development head Chris LaConte demonstrated the service. SpyCloud won Best of Show. The stage photograph captures a young company explaining itself with a screen full of exposure data. Ross stands beside the display, microphone in hand. The point of the demonstration was personal: how certain was the audience that its own credentials were safe?

The work behind that screen involved human intelligence. Researchers maintained connections within criminal circles to recover stolen information before it reached more visible marketplaces. Ross kept the operational details private. The business depended on getting there early, then making the recovered material intelligible and useful.

By June 2019, he was demonstrating the product at the Digital Banking conference, where SpyCloud won the innovation contest. Alongside account protection, he showed investigation tools intended to help identify the people behind fraud. A stolen identity could become a clue pointing back toward its thief.

The clock is part of the product

Ross has a succinct description of this contest: “It’s an arms race.” In an interview first published in 2019, he explained that recovering exposed data quickly allowed a customer to change a password before someone could exploit it. The theft had already happened. The hoped-for payoff could still be interrupted.

His emphasis falls on the criminal’s ability to profit. A password that no longer works is a disappointing acquisition, however much effort went into stealing it. That is an unusually practical ambition for a company operating in a world fond of elaborate threat diagrams. Somewhere at the end of the process, an attempted login should fail.

The less theatrical work matters here. Recovered data arrives in different formats. It needs cleaning, interpretation, and a connection to the customer who can act. An exposure warning earns its keep when it reaches the right system in time. Otherwise, the company has delivered a detailed explanation of a problem that remains open.

In August 2023, SpyCloud announced a $110 million growth round commitment led by Riverwood Capital. The commitment combined primary and secondary capital. Its plans included global expansion, more integrations, and defenses against ways of bypassing authentication. Ross was leading a business whose original password problem had already widened.

The financing announcement said revenue had tripled following the company’s 2020 Series C. It also described more than 500 customers across industries. For Ross, scale meant carrying a fairly simple proposition into a much larger range of systems: notice the exposure, connect it to an identity, and get a useful response underway.

The boss has to follow the rules

There is another kind of execution in Ross’s public writing: getting leaders to accept that cybersecurity belongs among their own responsibilities. His 2021 argument placed it alongside finance, strategy, priorities, and the allocation of resources. A security team could handle daily operations. Executives still had to understand the risk and support the work.

The attachment anecdote gives that argument some bite. Rules lose authority when the person announcing them treats compliance as a task for subordinates. Ross’s account of his own habits brings the discussion down from a board presentation to an inbox. It is easier to appreciate a policy when the boss has to live with its inconveniences.

In April 2024, he was named an EY Entrepreneur Of The Year Gulf South finalist. His response acknowledged the challenge of expanding SpyCloud’s product range and navigating a growth funding round amid economic pressure. He also placed the reward in the people doing the work. “Working with the amazing team at SpyCloud makes all the hard work worthwhile.”

“Working with the amazing team at SpyCloud makes all the hard work worthwhile.”

Ted Ross · April 2024

That is a modest but useful window into his priorities. His public career contains repeated episodes of assembling technical teams: the research practice at HP, the company built around recovered credentials, the expanding group needed to interpret new forms of stolen access. The work depends on people who can make sense of a problem before a product can deal with it.

The password was only the beginning

By July 2026, SpyCloud reported more than one trillion recaptured identity assets. That number counts pieces of identity data, rather than distinct people. Passwords were part of the collection; stolen session cookies and authentication tokens accounted for nearly half of its assets. The contents of the thief’s inventory had changed.

A session cookie can preserve the fact that a user has already authenticated. Stealing one can let an attacker take over that existing session. The person may have chosen a long password and completed an additional authentication step. The attacker is interested in what comes afterward: the evidence that the checks have already been passed.

For Ross, that development extends the original problem into a different kind of access. A defender needs to know which session or token has escaped and how to invalidate it. A password reset and a session revocation solve different immediate problems. The shared aim is to shorten the useful life of something stolen.

SpyCloud’s September 2026 Identity Threat Report examined another expansion of the problem: non-human identities, including service accounts, API keys, and AI agents. In its survey of 750 security leaders and practitioners, 95 percent believed their organizations had adequate visibility into AI and non-human identity exposures. Only 36 percent monitored them.

The gap makes a useful graphic because the two bars tell such different stories. Confidence occupies almost the whole line. Observation occupies little more than a third. These are survey findings, rather than a census of every organization, but they make the practical difficulty plain. A business can depend on access it has not learned to watch.

In August 2026, as SpyCloud marked its tenth anniversary, Ross described the next decade as extending protection across human and non-human identities. The company reported more than 250 employees and protection for over four billion accounts. His remit had grown from exposed credentials to the broader collection of things that can persuade a system to let someone in.

The career has a certain circularity. Ross started by helping networks connect. He now leads a company concerned with deciding when a connection should cease to be trusted. Between those two tasks sit the researchers, engineers, customers, and investigators who have to turn discovery into a changed outcome.

The attachment rule is the small, slightly comic version of that discipline. Familiarity does not settle the question. A message arrives; somebody still has to decide what to do with it. At SpyCloud’s scale, the same practical demand applies to billions of fragments of stolen access. The satisfying ending is quite undramatic: something a criminal expected to work no longer does.