25 Years of NCX Group: It Started With Getting Fired

NCX Group just completed its 24th year. As we head into our 25th, I’ve received a lot of congratulations and a question that keeps coming up: “How did you build this?”

I’ve hesitated to tell the story because I didn’t want an anniversary to become an excuse to talk about myself. But the honest answer includes a few disappointments, some questions I couldn’t shake, and a family that lived through it all with me.

You can’t tell the story of NCX Group without starting with getting fired.

The day my son was born

About two years before NCX Group opened, I was VP of Sales for a company that made telco-grade VPN concentrators. I had just closed roughly $40 million in business with a telecommunications company, and my commission was 10%. Rather than pay it, they eliminated my position.

The email arrived while my wife was in labor with our son. There’s never a good time to lose your job. That was a particularly bad one.

I spent the next six months looking for work. Once you’ve held a VP title, people tend to assume you’ll expect too much. Meanwhile, I had a new son, a family to support, and a legal fight ahead of me over the commission.

Eventually, I took a sales director position with Open Systems.

A territory from Michigan to Hawaii

My responsibility was the Western United States. In this case, “Western” meant everything from Michigan to Hawaii. I’d leave on Monday, cover four states during the week, and come home on Friday. My wife was home raising our son while I was out building business.

Open Systems had an interesting beginning. Its product started as a free giveaway with a configured PIX firewall. Network Translation originally developed PIX before Cisco acquired the company. Believe it or not, Open Systems was giving its product away before realizing it had something valuable enough to build a business around. The company became Network Intelligence and eventually became part of RSA and then EMC.

During my time there, I met with probably 80 to 85 percent of the Fortune 500 companies in my territory. I kept seeing the same thing: they were struggling with information security. These businesses had the budgets to buy the technology, hire the experts, and bring in outside help. They had access to almost every resource you could imagine, yet they still struggled.

That raised a question I couldn’t shake. If it was this hard for companies with all those resources, how bad was it for everyone else? What chance did a business have if it couldn’t afford those people, those tools, or that outside help?

I didn’t have the answer yet, but the question stayed with me.

Then came 9/11

I was supposed to be on a flight on September 11. Instead, I watched the attacks unfold along with the rest of the country. The weeks that followed were traumatic, and the impact reached into the business.

Open Systems had been counting on venture capital funding. After 9/11, that funding strategy fell apart. I was fired again, not because of my results, but because the company’s financial plans had collapsed. As I remember it, they let go of everyone outside Boston who wasn’t related to the owner.

I found myself out of work for another six months, with a family to support and an ongoing legal fight over the commission from my earlier employer.

I also kept thinking about what I had seen inside those companies. Buying more technology wasn’t solving the problems they were struggling with. I wanted to build a better way for businesses to understand their information security risk and decide what to do about it.

Proving the concept

I took that idea to a firm called Creative Business Concepts and built an information security assessment practice there. We didn’t call it cybersecurity back then.

Over the six months I was there, I built an assessment methodology that, in many ways, we still use at NCX Group today. I built it around networking domains, incorporated COSO and COBIT principles, and included policy and physical security to get a 360-degree view of the business. If you’re not assessing everything, you’re leaving most of the possible threats out of the picture.

We took thousands of pages of detail and notes and distilled them into a 120-page, actionable report. Anyone who picked it up, whether an executive or a technical professional, needed to understand what we found, what the risks were, and, more importantly, why they mattered. The point wasn’t to prove how much information we could collect. It was to give people something they could use to make decisions.

When I look at NIST 800-171 and 800-53 today, I see much of the same thinking behind what I built then: look across the business, understand the risks, and explain what needs to be addressed. We were taking that approach in 2001.

Getting business leaders into the room

During that period, in 2001 and early 2002, I also developed a different approach to information security seminars. I put together a thought leadership conference specifically for business leaders and executives, with an FBI Cyber Crime Special Agent as the keynote speaker.

This wasn’t a conference for technical people. No offense to technical people. I wanted CEOs and executives in the room because I had always seen information security as a business process issue, not another nail for a technology hammer to drive.

We held the conference in SOKA University’s largest auditorium. At a time when information security was barely on the radar for many business leaders, nearly 200 executives and CEOs showed up.

That mattered to me. It was one thing to believe business leaders needed to have this conversation. It was another to see nearly 200 of them make time for it.

Another parting of the ways

I also landed Creative Business Concepts a deal to perform Cisco’s information security assessments, worth about $20 million a year. As soon as the ink was dry, the owner called me into his office. He told me I was the best business development person he had ever met. Then he told me we had come to the parting of the ways.

That’s quite a performance review.

Starting NCX Group

NCX Group was born the next day. We had about $3,000 to our name. My wife was home raising our 18-month-old son, I was still fighting to recover my commission, and the country was coming out of 9/11. I was starting a business offering something I believed companies needed, but most didn’t yet understand or know they needed.

When I searched for NCX back then, there was only one other listing. It was a virus. I thought that was an interesting bit of company for someone starting an information security business. There are several NCXs now, but the search results weren’t crowded back then.

There was no carefully planned transition and no comfortable financial cushion. It took six months of trying every day to land our first client. Six months is easy to write in a sentence. It feels a lot longer when you have a family to support, and you’re wondering when someone will finally say yes.

Our first big project came from Ingram Micro: about $80,000 to teach their top value-added resellers about information security across 12 cities. After so much time trying to get someone to listen, we had work to do.

Not long after, Computer Associates invited me to speak at CA World. I thought I was giving a small breakout session. Instead, I found myself in the keynote room, with 3,000 seats. It filled twice in two days. After struggling to convince people this subject deserved their attention, it was something to see.

Taking the conversation to the radio

Around 2006, I also took the conversation to radio with a show called The Watchdog Report on AM 590 in San Bernardino. This was long before podcasts became the go-to format for these conversations. My guests included FBI Cyber Crime Special Agents, a deputy U.S. attorney, Congresswoman Mary Bono Mack, and Larry Ponemon, whose work included the first Cost of a Data Breach research.

I wanted listeners to hear from people investigating the crimes, working on legislation, and studying what these incidents actually cost businesses. It was another way to bring information security out of the technical department and into a business conversation. The technology mattered, but so did the decisions people made, the way a business operated, and what happened when something went wrong.

In 2008, I had the honor of becoming a Ponemon Institute Distinguished Fellow.

My wife saw it before I did

I can tell you about the methodology, the conferences, the contracts, and the radio show. But none of this would have happened without my wife. After three terminations, she told me, “I think God’s telling you it’s time to go do your own thing, because you don’t work and play well with others.”

She knows me pretty well.

My wife and I are about to celebrate our 30th wedding anniversary. She was there for the disappointment, the uncertainty, and the months when nothing seemed to be working. Starting NCX Group wasn’t a risk I took alone.

My wife chose to be a stay-at-home mom. Her taking care of our son and our family made it possible for me to focus on building NCX Group. Without her doing that, the outcome could have been very different.

To say she’s the MVP of this story is an understatement. There aren’t words that adequately express my gratitude and love for this woman. Without her, this story never happens.

Heading into year 25

I couldn’t have planned the path that led to NCX Group. I certainly wouldn’t have chosen some of it. At the time, getting fired wasn’t an inspiring turning point. It was losing a job when my family needed the income. I didn’t know how things would turn out. I just knew I had to keep going.

The question that started this stayed with me: if businesses with access to every resource were struggling, what was happening to everyone else? Helping businesses understand that risk and do something about it was work I believed needed to be done.

Now we’ve completed 24 years. I’m grateful to the clients who gave us a chance, the people who helped us do the work, and everyone who has been part of NCX Group along the way.

If there’s a lesson in all of this, it’s the one I’ve kept coming back to: if you’re going through hell, keep going. Don’t linger. Always forward.

Here’s to year 25, and to nearly 30 years with the woman who helped make it possible.

You never know where the road will take you, as long as you NEVER give up.