The career plan was tidy, logical, and doomed. Yanek Korff studied computer science at William & Mary because, as he later put it, he wanted a life in technology specifically so he would not have to work with people. The bargain seemed sound. Machines accepted precise instructions. They did not schedule performance reviews. They rarely asked how you felt about the reorganization. Then, in 2005, Korff's manager at AOL quit without warning. Everyone looked at the engineer. The engineer got the job.
He had already come a long way from the musty library basement where he worked a student help desk. After graduating in 1999, he passed through Bell Atlantic and Cigital before joining AOL in 2004. His technical domain was the invisible civic architecture of a giant internet business: authentication, authorization, public key infrastructure, and systems supporting incident response, investigations, and electronic discovery. It was serious machinery. It also offered little instruction for telling a colleague that good intentions had produced bad work.
Korff has called the first two years after that promotion the hardest of his career. The bluntness matters. Management biographies often compress uncertainty into destiny, as though the future executive merely needed a larger desk. Korff's account is less flattering and more useful. He did not know how to manage. About a year in, he found Manager Tools, a program that translated airy instructions such as “communicate better” into behaviors a dense engineer, his word, could practice. One-on-ones, feedback, coaching: leadership became a system with inputs and outputs.
“I'm a computer science major from William & Mary who went into tech specifically so I wouldn't have to work with people. That plan went horribly wrong.”Yanek Korff, reflecting on his route into management
A technical manual, followed by the human one
The timing had a pleasing irony. In March 2005, Korff, Paco Hope, and Bruce Potter published Mastering FreeBSD and OpenBSD Security with O'Reilly. The 464-page book ranged across kernel protections, jails, cryptography, auditing, incident response, and the everyday maintenance of hardened systems. Korff had helped write a manual for complex technical defenses just as his working life presented him with a system that declined to be documented so neatly: other people.
He stayed at AOL until 2009, by then responsible for much of its security infrastructure. He also completed a master's degree in the management of information technology at the University of Virginia. The pairing was revealing: code and commerce, machines and organizations. In 2010, Mandiant hired him to build a managed services line for customers facing breaches linked to nation-state attackers. The assignment turned the newly deliberate manager into a business builder.
Managed security sounds calm when rendered as a category. In practice, it is vigilance sold by the hour, including all the hours when sensible people are asleep. Korff's operation became one of the early “follow-the-sun” managed detection and response services. Analysts handed work across time zones, preserving context while attackers ignored office hours. The service eventually represented more than 30 percent of Mandiant's revenue. After FireEye acquired Mandiant, Korff became CTO of FireEye as a Service.
William & Mary graduate; Bell Atlantic and Cigital systems work.
Joins AOL and soon receives the promotion that redirects his career.
Starts building Mandiant's managed services business.
Leads FireEye as a Service as vice president and CTO.
Co-founds Expel with Dave Merkel and Justin Bajko.
The taxi-driver tweet
By late 2015, Korff and former Mandiant colleagues Dave Merkel and Justin Bajko knew what managed security could do. They also knew how it could irritate the people buying it. Then they saw a tweet from a cybersecurity veteran saying customers of managed security providers had endured the customer-service equivalent of taxi drivers. This was before an app made summoning a car feel like a minor act of sorcery; the insult landed cleanly.
The three did not merely enjoy the rant. They recognized a design brief. Customers were overwhelmed by security products producing floods of alerts, short of skilled people to investigate them, and too often asked to accept a provider's conclusions without seeing the work. Korff, Merkel, and Bajko founded Expel in 2016. Their answer joined human analysts with automation and integrations, but its more subversive promise was simple: the customer could look inside.
Security companies sell trust in a market organized around distrust. This is awkward, rather like a locksmith asking you not to look too closely at the invoice. Korff's public language returns often to transparency because, for him, it is both an interface choice and an operating discipline. “Trust builds really slowly, but you can lose it really fast,” he has said. A provider that exposes its reasoning accepts the possibility of being questioned. It also gives the customer something sturdier than reassurance.
The company grew, raised successive rounds of capital, and expanded beyond the founding trio. Korff's remit as chief operating officer is unusually broad even by the expansive customs of that title: connect organizational strategy, inter-team performance, and the employee experience so the staff can focus on customers. Expel's official biography describes his role with a more vivid test. If something looks as if it may catch fire, Korff walks toward it.
Walking toward fires has sometimes meant handling jobs beyond the expected COO portfolio. In 2020, the Northern Virginia Technology Council named him Emerging Growth CFO of the Year for his work at Expel. Two years later, he and his co-founders were finalists for EY's Mid-Atlantic Entrepreneur Of The Year award. The titles vary. The pattern does not: find the unowned problem and make it operable.
Feedback must travel uphill
A revealing Korff management story concerns a candidate he interviewed for a security analyst role. The candidate had worked in a federal security operations center where analysts repeatedly flagged the same false positives. Another team controlled detection, yet policy prevented the teams from talking. Every week the alarms returned, immaculate and useless. The system had created expertise at the bottom and installed a dam above it.
Korff used the story to argue for feedback loops between the people handling alerts and those creating detection logic. It is a technical lesson with broad jurisdiction. Organizations become foolish when information cannot move. Frontline employees see failures first; executives often see them last, polished into a slide. Transparency without a return path is merely a window. Korff's writing on adaptive feedback, hiring, security culture, and operations repeatedly asks the same practical question: can the person closest to the work change the way the work is done?
“You have to be fast, and you have to be right, and you have to be consistently right and fast, which is actually shockingly hard.”Yanek Korff on the managed security problem
Speed and correctness are enemies forced into a small office in cyber defense. An attacker can move quickly; a defender cannot respond carelessly. Korff calls the industry “wicked problems, wall to wall.” His response is not swagger. It is to make judgment repeatable, let machines carry the routine load, and leave accountable humans in the decision. That position has gained urgency as artificial intelligence offers both help and fresh ways to be confidently wrong.
Korff's advice on AI is pointed: people will not necessarily lose a job to AI, but may lose it to somebody who understands AI better. His recent public jokes about machines producing impossible quantities of contracts, curricula, analysis, and code in a week reveal the skepticism sitting beside the interest. He uses the tools. He also catches them proposing security through obscurity and asks, in characteristically printable form, whether they are nuts.
The aquarium and the operator
Away from security operations, Korff has kept three dogs and a 300-gallon saltwater aquarium crowded with fish and coral. He plays video games, travels, and hosts an annual pumpkin-carving tutorial for Expel colleagues. The aquarium is tempting as metaphor, so one should proceed carefully. Coral does not attend a quarterly planning meeting. Still, a living system in a glass box rewards attention to small changes, punishes neglect, and refuses to care about the keeper's job title. There are worse hobbies for an operator.
His family has also fostered rescue animals. In a local newspaper account, Korff described involving his children in the work as a way to teach care for someone other than themselves. It is a modest observation that echoes his professional turn. The young programmer imagined independence as freedom from people. The executive learned that responsibility is largely the practice of noticing who or what depends on the system working.
A useful Korff line arrives without fanfare: “Accept the things that you don't know, and then go figure them out. It's okay not to know.” It describes the accidental manager at AOL, the operator building around the clock at Mandiant, and the founder examining AI without genuflection or panic.
The career plan failed. In its place came a better operating principle: expose the work, let feedback move, translate risk into language the business understands, and walk toward the smoke. Machines are still involved, mercifully. So are people.