The useful art of losing on purpose

At a major bank, the defenders were having a miserable week. William “Hutch” Hutchison had brought a military approach to a commercial cybersecurity exercise, and the people on the receiving end were unimpressed. They were supposed to protect a network. Someone else was being paid to make that difficult. By the end of the first week of a two-week engagement, the arrangement had produced plenty of frustration.

Hutchison’s response was to bring the attacking team out from behind the curtain. The red team sat with the blue team and explained the exploits. The mood changed. Once the defenders understood what had happened, the exercise became useful to them. He later described the change as a move from a negative experience to a positive one. The point of the ambush, it turned out, was the conversation afterward.

This is a revealing place to begin with Hutchison, a former fighter pilot who co-founded SimSpace. His business depended on making trouble convincing enough that people could learn from it. Yet convincing trouble alone was insufficient. An exercise could expose a weakness and still fail as a lesson. Someone had to help the people involved turn an uncomfortable result into something they could use.

From the cockpit to Cyber Flag

Before the simulated networks came the aircraft. Hutchison accumulated more than 3,500 flying hours in the F-15 Eagle and T-38 Talon. His experience included Red Flag exercises, the demanding military rehearsals that would inform his later work in cybersecurity. The familiar shorthand is to picture a fighter pilot and think of nerve. His subsequent career gives more space to preparation: the organized effort that happens before nerve is required.

At U.S. Cyber Command, he led the first joint, force-on-force tactical cyber exercise, Cyber Flag. He also founded Cyber Guard, an exercise intended to bring government and other participants together around attacks on critical infrastructure. That widened the cast considerably. Defending essential services involves people with different responsibilities, different chains of command and different ideas about which telephone ought to ring first.

His academic background crossed disciplines too: a bachelor’s degree from Duke University, a master’s in aerospace engineering from the University of Texas at Austin, and a master’s from MIT Sloan. The combination fits the work that followed. Cyber exercises require technical environments, but also organizations capable of acting inside them. A network diagram can be tidy. A room full of people responding to an attack is allowed fewer such comforts.

A rehearsal needs a world

Hutchison’s collaboration with Lee Rossey developed through military cyber testing, including the assessment series called Project C. Rossey and his colleagues at MIT Lincoln Laboratory brought research in simulated cyber environments. In 2015, Hutchison and Rossey co-founded SimSpace. The company joined operational experience to technology with a research history extending well before the business itself.

The proposition was practical: recreate enough of an organization’s digital environment to let defenders practice without putting everyday operations in the line of fire. By 2019, MIT’s Industrial Liaison Program described SimSpace in terms of realistic network clones, advanced threat scenarios and military-style exercises. The rehearsal could be tailored to the organization whose people would have to perform it.

That last detail matters. A generic exercise asks whether someone can solve the problem in front of them. A tailored environment can ask whether a team can solve a problem with its own arrangements, tools and working habits. It moves the question closer to the job people will actually face. The difference resembles practicing a speech alone and then discovering that the microphone, audience and running order have opinions of their own.

The campus gets a practice ground

In May 2020, the University of Texas at San Antonio announced a SimSpace software donation valued at $133,000. It included 700 licensed accounts, along with help tailoring and configuring the network. The university had already spent a year working with the company on a pilot. Here was the same rehearsal idea moving into a classroom, with students getting access to a cloud-based cyber range.

The university described an environment where students could practice defenses and test their processes against aggressive adversaries. Hutchison framed the partnership around advancing cyber defense research and training. The intended audience now included people who were still learning the profession, alongside the experienced operators associated with SimSpace’s military origins.

A donation like this gives the career a useful point of reference. Seven hundred accounts are seven hundred opportunities to encounter a problem before a real employer depends on the answer. The practical attraction of a simulated environment is permission: to explore, make a choice, see the consequence and have another attempt. Universities have good reason to want that kind of room.

Difficult customers, expensive lessons

Hutchison has said SimSpace’s first commercial customers included two of the five largest U.S. banks. They demanded strong product performance and professional services. His advice from that experience was wonderfully unromantic: “Pick Challenging Customers.” Anyone hoping that founding a company might mean escaping demanding supervisors should consider the possibility of acquiring several institutions’ worth.

By December 2023, SimSpace announced a $45 million equity investment led by L2 Point Management. SecurityWeek reported that the company planned to bring its cyber range technology into more markets around the world. The funding story had an ordinary business tension beneath the military vocabulary: a growing customer opportunity still required money, decisions and the ability to keep serving customers while expanding.

Hutchison acknowledged the difficult financing environment and the hard choices the company had faced. He discussed growing profitably and increasing headcount modestly. Those are restrained ambitions beside the language of cyber warfare, and more revealing for it. A business that sells preparation has its own exposure to uncertainty. The founder still has to decide what it can afford to do next.

“Pick Challenging Customers.”

William “Hutch” Hutchison, 2022

The tools have to work together

In 2022, SimSpace received recognition as Hot Security Technology of the Year in the Globee Cyber Security Global Excellence Awards. Hutchison’s response emphasized a problem familiar to anyone who has assembled a collection of expensive equipment: each piece may look convincing on its own, while the collection remains an unanswered question. He wanted defenders to know whether their products worked together and whether their teams had practiced using them.

That emphasis places people and coordination beside technology. It also helps explain why his public interviews return to exercises rather than treating training as something completed once. His January 2024 appearance on Business Security Weekly carried the title “Cyber Readiness: Train As You Fight.” The discussion centered on preparation and the dangers of running tests in the operational environment.

In February 2024, SimSpace appointed Clint Sand as chief product officer, with responsibilities spanning product management, content, design and platform engineering. Hutchison linked the appointment to customers’ investment decisions and the growing attention boards were paying to cybersecurity. The company’s work was reaching beyond the training floor into another room where people are routinely asked to justify their choices: the boardroom.

Getting back to work is part of the exercise

An April 2025 partnership with Commvault extended the rehearsal into recovery. The companies introduced Commvault Recovery Range, powered by SimSpace, to connect attack simulations with exercises in restoring operations. Detection and containment would sit alongside the difficult work of recovering clean data and returning services to use.

The announced exercises included simulated everyday users, realistic attacks and recovery tasks involving backups and restoration. They were designed to bring security and IT operations together. This was a natural development of Hutchison’s training argument: the useful exercise follows the work far enough to show what happens after the first response. Recognizing an attack is one milestone. Getting colleagues back to their applications is another.

There is a pleasing lack of glamour in recovery. Restoring systems rarely gets the cinematic treatment given to an attack. Yet people who need those systems have a fairly concrete definition of success: they would like to use them again. Extending the practice session to that point keeps the company’s original infrastructure concern close to the everyday services it was meant to protect.

Ten years, then a different seat

On June 6, 2025, SimSpace announced Peter Lee as its new CEO. Hutchison would remain on the board. The succession gave the co-founder a different relationship to the company he had led for a decade. In welcoming Lee, he pointed to his successor’s understanding of AI and its business implications, along with his experience helping companies grow.

SimSpace now describes itself as an AI proving ground, where human operators and AI agents can train and test together. Hutchison’s place in the company’s history remains specific: he helped carry an approach to preparation from military exercises into a business used by organizations beyond the military. The title changed. The question behind the work remains easy to recognize.

There is a more personal clue in his enthusiasm for Tom Wolfe’s The Right Stuff, and for figures such as John Glenn and Chuck Yeager. He has described a taste for managed risk and the importance of staying flexible while pursuing a long-term vision. The interesting balance in his career is between that appetite and the painstaking construction of somewhere to practice.

The bank exercise supplies the clearest ending. A week of frustration became useful when the two teams sat together and made sense of it. For all the aircraft, simulations and technical machinery in Hutchison’s career, the lesson is pleasantly human. People needed a demanding problem, a safe place to encounter it and someone willing to explain how it had gone wrong. Then they could try again.