In February 2009, Will Ackerly was driving through a snowstorm when an idea arrived with enough force to pull him off the road. He stopped in a supermarket parking lot and began sorting it out. Encryption could lock information. Metadata could describe who was allowed to use it. What if those two things were joined, so the rules stayed attached to the secret wherever the secret went? The question would become the Trusted Data Format, an open standard, and then the technical foundation of Virtru. It was a portable answer to a stubborn problem: information never respects the walls built around it.
Ackerly had already spent years looking for misplaced trust. His first professional encounter came in 2003, while designing Peripheral Component Interconnect subsystems at AMD. A graphics card or sound card could effectively read or write anywhere in a computer's memory. The industry treated that broad permission as speed, not vulnerability. Ackerly saw the bargain and followed it down what he later called the cybersecurity rabbit hole, from hardware roots of trust to the policies wrapped around data itself.
The first systems
A childhood spent opening the box
The habit began before the vocabulary. Growing up in Washington, D.C., Ackerly built train sets with his father, learned basic electronics and took toys apart to see what manufacturers had hidden inside. A chemistry set produced several household fires. An Apple IIGS produced something more durable. He wrote a simple racing game at seven and learned BASIC from an older student. By eighth grade, he was caught inside his school's computer system. His explanation was short enough to fit in a command prompt: “I got bored.”
At Rose-Hulman Institute of Technology, he pursued electrical and computer engineering together. In the fall of 2003, near the end of those studies, a letter arrived with instructions that sounded borrowed from a modest spy film: fly to Baltimore-Washington International Airport, go to a particular hotel and give the receptionist a code word. A van carried him to Fort Meade. Inside the National Security Agency, he saw photonic communications equipment, virtual networks nested within virtual networks and engineers trying to make strong encryption faster. A few months later, the agency offered him a job.
He stayed for eight years, specializing in cross-agency cloud analytics and security architecture. The contradiction at the heart of intelligence work was impossible to ignore. Agencies had information they needed to share, yet the systems guarding it encouraged silos. Loosen control and the same information could travel too far. Tighten it and useful collaboration could stop. A wall could be strong and still solve the wrong problem.
The Trusted Data Format changed the unit of defense. Instead of trusting every server, network or application that might hold a file, TDF wrapped the file with encryption and access policy. A recipient could be allowed to read but not forward it. Access could be revoked later. The protection could persist after the file left its original system. The Office of the Director of National Intelligence published TDF as an open standard, and Ackerly recruited agency colleagues to help develop it.
“Let me show you something.”Will Ackerly, after a 72-hour coding sprint
The missing sales meeting
A company divided neatly between calendar and code
In 2012, Ackerly left the NSA and founded Virtru with his brother John, who had worked on technology policy at the White House and later in investing. Their roles were complementary. John ran the business. Will concentrated on the machinery. Even in a Washington startup, however, machinery occasionally collided with the calendar.
During one early stretch, Will vanished for 72 hours and missed an important sales meeting. Calls went to voicemail. John found him in his nearby apartment, worn down by several nights of work, and arrived prepared to object. Will turned his laptop around. “Let me show you something,” he said. He had found a way to make encrypted email searchable on a widely used consumer platform. It was both an explanation and a demonstration of the brothers' bargain: one kept the organization moving; the other sometimes stopped everything to solve the thing in front of him.
Email was the first obvious market because it exposed the human problem with cryptography. Powerful encryption had existed for years, but many implementations asked ordinary users to manage keys, install special software or change their habits. A protection that creates enough friction soon becomes a protection people evade. Virtru's wager was that control could live inside Gmail and other familiar tools, close to the send button and far from a cryptography manual.
That concern for usability did not come merely from product strategy. Ackerly has said he wishes his early cybersecurity career had included more hands-on information assurance. Practical deployment gave him greater empathy for the person at the end of the system. His management philosophy follows a similar line. He describes his role as supplying people with what they need, doing the blocking and tackling, then getting out of their way. For an engineer fascinated by control, he makes a point of not overusing it on colleagues.
Open by design
Giving away the grammar of the lock
Virtru is a private company built around an open format, which sounds paradoxical only if a standard is confused with a product. Shared rules make it possible for many systems to understand the same protected object. The commercial work lies in making those rules deployable, manageable and pleasant enough to use. OpenTDF, the open-source implementation around the specification, extends the premise: data protection becomes more useful when it can cross institutional boundaries without surrendering its instructions.
Ackerly took that argument to Congress in 2019, testifying about Virtru's passage through the Federal Risk and Authorization Management Program, better known as FedRAMP. The process had taken 20 months and cost the young company roughly $1.6 million. He did not ask lawmakers to weaken the controls. He asked for clearer timelines, reusable assessments and a process small technology companies could enter without treating uncertainty as a budget category. The detail mattered: demanding security and designing a workable route to it are different jobs.
His testimony also returned to the architecture beneath the paperwork. A system storing encrypted material, he argued, did not always need the same controls as one processing exposed data, because some of the security traveled with the encrypted object. Here was TDF translated from engineering into procurement. Bind protection closer to the information and institutions can make finer decisions about the systems around it. The policy case followed the technical one: precision could improve security without forcing every component into the same expensive box.
The approach has moved well beyond its original email case. By 2024, Virtru reported a million active users across 7,000 clients, with integrations spanning Google, Microsoft and Salesforce workflows. The same architecture serves regional banks, businesses and public agencies. Its reach is less a story of one perfect vault than a network of imperfect workplaces agreeing on what a protected object means.
“Our vision is to cement TDF as the global standard in data-centric security.”Will Ackerly, July 2025
In July 2025, Virtru announced $50 million in new funding led by ICONIQ, with participation from Bessemer Venture Partners, Foundry and The Chertoff Group. The company said the round doubled its valuation to $500 million. Ackerly described the next chapter with a smaller-sounding word: microsecurity. The idea is granular control bound to each piece of data, including information moving through AI and analytics systems. Large models create new appetites for information; his answer is to make each object carry firmer instructions.
There are 25 patents attached to Ackerly's name, according to Virtru, but the more revealing evidence of his temperament is tactile. Away from a screen, he likes projects that require soldering or drilling. He goes outdoors to clear his attention. The methods are consistent: put the hands on a stubborn object, understand its behavior and improve one skill while repairing another thing.
The snowstorm insight survives because it treats movement as normal. Files are copied. Messages are forwarded. Teams change software. Organizations collaborate, governments exchange intelligence and people make mistakes. A security plan that depends on perfect stillness is an expensive wish. Ackerly's career has been an argument for a more realistic object: a secret with its lock still attached, carrying its small set of rules into a world that will not stop moving.