Corey Thomas is the CEO and Chairman of Rapid7, a leading public cybersecurity software company valued around $3.5B. He is also an angel investor in several tech companies, a member of the Council on Foreign Relations, a director and deputy chair of the Federal Reserve Bank of Boston, and a member of the Blue Cross Blue Shield of Massachusetts board of directors, among other honors. Before Rapid7, Corey worked extensively at companies such as Microsoft, Deloitte, and AT&T.
Corey joined host Robert Glazer on the Elevate Podcast to talk about his leadership approach, how he rose through the ranks at Fortune 500 companies, and much more.
—
Listen to the podcast here
Corey Thomas On Climbing The Leadership Ladder At World-Class Companies
Welcome to the show. Our quote for this episode is from Marcus Aurelius, “A man’s worth is no greater than his ambitions.” My guest in this episode, Corey Thomas, has followed his ambition to the top of the corporate world. He is the CEO and Chairman of Rapid7, a leading public cybersecurity software company valued at around $3.5 billion.
He’s also an active Angel investor in several tech companies, a member of the Council on Foreign Relations, a Director and Deputy Chair of the Federal Reserve Bank of Boston, and a member of the Blue Cross Blue Shield of Massachusetts board of directors, among other honors. Before Rapid7, Corey worked extensively at companies such as Microsoft, Deloitte, and AT&T. Corey, welcome. It’s great to have you join us on the show.
Bob, it’s great to be here with you in this episode. Thank you so much for having me.
We worked together for years on the billboard. However, digging your background, you’re quite the definition of a Renaissance man with varied degrees of interest and activities.
You could say I’m an over-scheduled man more than anything else. I don’t know how much Renaissance goes into being over-scheduled.
Looking Back
There’s a lot in your bio to dig into, but I am always curious, like, what was childhood like for you? Where did you grow up? Were you interested in tons of different things? Did you start in one direction and go another way?
My childhood was relatively simplistic. Look, I grew up in a very good working-class family. My father was a security guard, a self-taught electrician, and a janitor. He did whatever it took to make the bills paid. My mom started as a secretary, and then she became a human resource professional. She went to school much later in life.
Things were pretty simplistic. If you grow up working class, you need to study hard, go to school, and do better. My aspirations throughout the ninth grade were to just get some professional job or be a contractor. It was a bunch of different things, but if I could just have a job, that was the ambition, and if I could make $50,000 a year, that would have been amazing at that time frame.
What happened was I ended up getting bused to school and switching schools for a number of different reasons in the ninth grade. When I went to a new school in the tenth grade, their attitude was foundationally different. They’re just like, “What are you going to do with your life? No, all of our students do great things with their life. You need to pick something compelling.”
That started this shift. I showed them this cool state school that I wanted to go to. That was not even a state school. It was a small school. They said, “Nope, all of our students only go to top 30 schools. Come back to us when you’re going to do it.” It was just a different mentality then. I evolved over time. That’s been my mindset. I’m always trying to figure out what I want to do when I grow up.
Was that a private school? Or was it a charter school?
No, it was a public magnet school. It was a test in school. You have to test into the school.
There’s a lot of data. I’ve seen studies on just the value of raising expectations for kids. It sounds like that’s what the environment was.
No, that’s what it was. I was a first-hand example of pushing and saying like, “No, you’re going to do something different.” I had that school, and I got bused to a wealthy part of town. I pushed the expectations when I got to Vanderbilt. My first couple of managers, when I was at AT&T, he pushed me. I just say, “Look, I was a kid who needed a little bit of push to be challenged in a way that made my mental cycles get going.” It’s also true. I would just say it’s not just a push. It’s what you see. The more I got exposure to successful people, the more I understood what was possible.
Again, you’ve covered everyone. I looked through. You went to Vanderbilt to study engineering. You immediately went to HBS. You went from engineering to business.
It’s an important one. I would just say one of the things that you see that why I may be considered all over the place now. AT&T was something I wanted to work at for most of my childhood because this was the old AT&T that had Bell Labs in there. I thought Bell Labs was the coolest thing in the world. When I went there to start interning in the ’90s, this was the period where they broke it up. They spit off Lucent. When I went there, I saw a company that was nothing like what I had read about. It did not have this vibrancy, this innovation.
Don’t meet your heroes. Is this a version of that?
No, it’s a hero. I thought it was a lifelong thing because it made no sense to me. I still met brilliant people there. It started like almost how brilliant people fail and how wildly successful companies decay. That’s more than anything, figuring out what makes a company and individual vibrant, what makes something successful, and what makes it stick. That started the quest.
Figuring out what makes a company vibrant and successful helps every individual to start their own career quest.
After HBS, you went to Deloitte. I think that’s one of those coveted jobs after business school. I’m curious, what did you like there?
I went to Deloitte prior to business school. It was great. Part of the reason I went there was I asked a bunch of people why companies worked or didn’t work. They’re just like, we’re just going to be a consultant to figure it out.
I don’t know what a consultant is, but that sounds good.
That sounds amazing. I went to Deloitte. It was a great experience. I learned a ton. I got to build some interesting technology for some fascinating customers. I got to live around the corner. I lived in Switzerland. I lived in London. I got to be essentially the glorified executive assistant to one of the top executives there. It was a massive learning time. I learned a lot there. I went back to business school, which was my own experience. That was the reason I went there. I was trying to figure out what made things tick.
I read that you’re focused on your early career and maybe even on the recipe for success.
I started trying to figure it out. I believed that was the recipe for success.
That’s what it is.
Unfortunately, I don’t think I kept hunting. I think I was in my 40s. I’m like, “Darn it. There’s no recipe for success.” You just have to keep doing the fundamentals.
That’s an engineering process approach.
It’s a growth process. You can argue that I grew too slowly. I could have realized that ten years earlier, and it grew a little bit more.
What was your first role after HBS?
I went to Microsoft because, look, you have to remember, I was a technologist and a computer engineer. I grew up in the Unix world. I was a little bit arrogant and saying like, “Microsoft is wildly successful, and they have a bunch of crappy technology.” I can learn how business works, and it turns out I went to Microsoft as a product manager, which is an overlap of marketing and a bunch of different things. I learned a whole bunch about how to build a customer base, how to think about a customer base, how to think about what makes products live and thrive, and what makes customers love them. It was another fantastic learning experience.
I know you went to a firm called Parallels before jumping to Rapid7 around 2008, and the founders hired you for SVP of marketing and sales. Again, this is another discipline you’re taking on.
Exactly. My last couple of roles at Microsoft were marketing, then at Parallels, I did marketing, and I did a little bit of consumer sales because it was learning. The one thing I would just say is people are shocked. Just two important things. I took a pay cut when I went to Parallels, and it was a lateral move. The interesting thing was I thought it was interesting. Likewise, when I went to Rapid7, I took another pay cut. I got to give my wife credit because she goes from owning a house to living in a 900-square-foot apartment. I was driven in some ways.
Usually, you don’t come home with an “I’m getting a pay cut” speech.
I got to learn interesting things because I knew how to build products. I had started to learn how to market them well, but it’s how do you sell, how do you distribute, how do you get them in customer’s hands. How do you support them? That was part of what I wanted to learn. The leadership team, Mike Tuchen, Ben, and I, it was adventurous. They all wanted to take a bet on me. They said, “We’ll give you opportunities, and you can learn it.” There was a great sales team. I didn’t start taking over sales immediately, but it was just a great team at Rapid7 that I could learn from.
Going Backwards
Let’s take it to a quick segue here. I’ve seen you talk about this. I think you have a similar passion around kids the same age and college and this perfectionism in society and all these and not getting anything. It just seems antithetical to learning. I was having a talk with my daughter the other day, and she’s talking about this class that’s hard. The teacher is difficult, but I think the learning quotient is high. It’s very hard for this achievement-oriented generation to separate the grade and the path from the learning. As you said, you went backward because the learning was higher in a couple of these things.
I agree. Look, I can never tell what’s good and what’s bad. I think some of the stuff that I experienced as a child was hard, and I would never want my kid to experience it. My parents were great, but it was just some things that were hard and mentality a different environment. The thing that was valuable were through football, basketball, through my parents’ mentality.
There was an idea that struggle was valuable. That was true in the church that we went to at the time. That was true in the sports that I played. For whatever reason, that was the cultural mentality that growth came through struggle. If you struggled through it and you grew, then you learned it. What I would say is that if you get through that, then it has a lot of personal value.
Not everyone gets through that. The thing that I work with my kids on nowadays is centering themselves not based on what other people think about them but based on how they’re growing. That’s a natural tendency. I’m going to do that phase of life, too, where you focus on what other people think. I would just say that in order to grow inevitably, there’s just no growth without struggle. That ability to grow is what probably makes life sweet.
It seems backward because I know there’s this natural thing to try to remove that. Those who struggle earlier when the stakes are lower, and sometimes they’re higher earlier, but ostensibly lower in certain areas, then when they run into these things later in life, they’ve seen it before. It’s not a big deal. If they haven’t, then it becomes catastrophic, something that’s not even that difficult.
My daughter talked about this. I also look at it like it is incredibly important for young people to experience gut-wrenching failure at an early age and be supported around that. I remember one time, and I wouldn’t use names, I was meeting an employee who got mediocre feedback and review. They were crushed, and I didn’t understand it. What happened is they had never gotten any feedback before.
You were the first person in their life to pull out a red pen and say, “This isn’t perfect.”
I’m just like, “That’s a very privileged thing to get validation all the time.” On the other hand, I think the highest form of love is for people to be committed to seeing you as your best self without judgment. There’s a fine thing to see, people who are committed to seeing you as your best self without judgment. Meaning that when they are either given feedback or sharing perspectives, they believe that you’re amazing, and they want to see your best self. First is, just to be clear, there are people that are giving you feedback to see you humble. Those are just fundamentally different things.
They’re doing it for themselves, not to help you make it better.
Not for your uplifting.
Parenting And Leadership
People would be surprised to know that there’s pretty definitive research on the best model of parenting. It’s not debatable that it is a high challenge and high support. If you have the challenge without the support, that’s narcissistic.
What’s traumatic is the challenge without support turns to trauma because it doesn’t get processed. You want the challenge to be resolved in some constructive way, and that builds the resiliency that we all need over time.
If you look at the outcomes, high support without challenge is probably equally as bad. It’s just permissive.
It builds fragility, and so you build very fragile. That’s the hard thing. Look, I wish that I had a magic playbook around this, but I’m still learning about parenting. I’m still figuring myself out. I do think that constructive growth and struggle is a positive thing.
What’s interesting is that the leaders that I’ve found who are thoughtful about leadership, I think, tend to think of the crossover between parenting and leadership. It should be similar. Micro-managing and no one likes that in the workplace. Why do we think people would like it outside the workplace?
The other one that I have is that I had one very smart executive one time who was good most of the time, and they just had outbursts. I said, “Listen, we’ve got to part ways.” They were shocked, and the team was shocked. For me, I didn’t understand why they were shocked. When I said it, I realized it sounded condescending and horrible.
I said, “Listen, I, as a person, can’t functionally tolerate behavior from an adult who makes lots of money that I would not tolerate for my child.” That’s just not foundationally something I can do. I’m just like, “Your outburst, your lack of self-control, is something that I don’t tolerate for my 10-year-old. Why would I find that acceptable in the workforce?” That mentality is more normalized nowadays because the idea of a toxic workforce is frowned upon. It wasn’t always the case. This was a shock to some people at that time.
Becoming CEO
That was completely appropriate a certain amount of years ago to scream and yell and do all that stuff. In 2012, you became COO. You had another role you had not done before. Ultimately, you took the company public in 2015. I became the CEO, no pun intended, but pretty rapid ascent there. All these things first time. First-time SVP of marketing.
First time everything along the way there. Exactly.
I saw you say when you took the company public, you thought that was going to be maybe your swan song, and you were going to go do your own thing.
It wasn’t when I took it public. When you take a company public, you’re making a long-term commitment. When I joined Rapid7, the partners at Bain at the time, I had a good relationship with them. What we talked about was me helping the company for a few years and then going to start my own thing. I said, “Let’s not put my own money in. I’d like you to put your own money in.” I was looking to start my own company. I was asked to take increased responsibility, which is to become CEO. Even when I became CEO, I was just like, “I don’t know if I’m going to do a good job. Let’s figure this thing out.” The truth be told.
You keep trying to fire yourself.
It was about nine months in. I probably deserved to be fired. I was making changes too fast. My team will tell you I have not seen something that needed to be addressed and was not like, “Let’s go do that.” The thing I’ve had to learn as I get older is everything in this season. Not everything that should be done should be done now. I did not have that muscle in my body then. We settled into it.
Company Culture And Organizational Behavior
I know you’ve thought a lot about you have this engineering brain. Even though you’ve played every other role, it seems like you’ve thought a lot about company culture and organizational behavior. I think you have served your own definition of company culture. Can you share how you think about that?
Look, we can give all these things that’s worth. At the end of the day, I think about a culture as what do the people in the organization believe makes them successful. What do we all believe creates success? It’s not what you say. It’s what do you believe that makes you successful and what behaviors does that generate when things are going well, and what behaviors does that generate when things are going poorly.
I think you see a culture mostly when things are going poorly, for what it’s worth. It is belief attached to behavior. If a company’s culture, is we are highly analytical and we believe that the best ideas can come from anyone in the right person, then what you’ll see is they value ideas, not hierarchy. The behaviors that you’ll see in every meeting you sit in, you’ll see people hunting for the people with the best ideas, or they’ll defer to the people, not based on where they sit in the pecking order but based on their domain expertise and knowledge.
In crisis, they become a bit theoretical, but they’re digging into the thought process. What I would just say is that, just like with people, there’s no right culture. I think culture is tightly tied to context. One of my beliefs about culture and leadership is that culture is right, depending on the context of what’s happening and what mission you’re on, and what’s trying to happen. There are cultures I can’t be successful in. There are some that I dislike. People always ask me, like, “Do you ever think there’s a perfect place for an authoritarian culture where it’s deferring to hierarchy?” I’m like, “Yeah, you’ve got a crisis.”
Like a nuclear power plant?
Exactly. Right now, you want some clear lines and communications, and hopefully, you have the right leader. There’s time for a safety culture. There’s time for innovation culture. That’s my general belief on culture.
There’s a paradox in that in terms of what I heard in that. There are some things that have to stay the same, foundational beliefs, but it also sounds like it needs to adapt based on the stage and situation.
I think you have to evolve cultures based on the mission. I think that’s hard. Look, the hardest part is that not every leader is suited for every context. I think if you take culture out, you have to say, “Is the leadership and the range of cultures that I bring to the table suitable for the mission and the challenge that’s in front of us?”
Look, I’m going to get in trouble for saying this. You would never want me to drive a safety culture that delivered 2% or 5% point improvements every year. I like creating. I like change. I like navigating. I’m going to go in there, and I’m going to be like, “How can we take this and expand here?” That’s just where I’m centered. That’s not the right thing for me.
If you want a real-world example of culture and context, I always look at history. Take Lyndon Johnson. Was he a great leader or a poor leader? If you look at how he navigated the politics of the civil rights thing, you can say he was extraordinary. If you look at what he did with the Vietnam War, he was horrible. Same person, again, domestic politics, exceptional at how you get votes. Probably one of the best leaders in history about how do you get votes and vote counting. When you talk about how you treat a geopolitical dynamic, he is horrible. I think sometimes leaders are in the same moment and they have very different needs.
Sometimes, leaders are in the same moment. They only have very different needs.
I always say a little bit to universities. They have very different value propositions. You might have a big, large city institution that has a value proposition and then a rural campus, and people at one school probably won’t like the other. They both can be great cultures, but their value proposition is fundamentally different.
It’s different. It’s not right or wrong. It’s suitable for you, what you need, what the time is.
I agree with you. In leadership, there’s too much absolute good and absolute bad. One of the examples, I think, as soon as you said that, was Andrew Cuomo. When COVID broke out, everyone in the world watched his newscast, excellent communication, clear, great. That doesn’t excuse what came after that and everything he deserved that happened to him. Two totally different scenarios.
Two totally different things. One of the things I think successful people have to watch out for, and luckily, I’m married to a minister, and I have a family that’s very good at reminding me of my watch-outs, is that it’s easy when you’re successful in one domain to think you’re successful in every domain. You extrapolate your success. This is why you see people commenting about stuff they know nothing about. My wife, she’s just like, “You should just reflect on whether you have any real knowledge or depth of experience on this topic that someone asked about.”
Social media exacerbates this. You have a million followers because you do makeup, and then suddenly, you’re a vaccine expert. I’ve thought that they should Facebook in a maybe dystopian way or whatever, should put some context to your credibility score. Corey’s got a million followers, but he’s known for this.
Exactly. I get asked all the time as an example. I have opinions as a parent, but I get asked all the time about education and the education system. I have no expertise in education. Now, what I have expertise on is I can talk about my personal experience. I can talk about as a parent and then I can talk about from a workforce perspective about what I need. I think we have to be aware.
You could sound authoritative if you wanted to, but you wouldn’t.
I could.
I like this quote. “You’re looking for people with high accountability but a low need to control exactly how they deliver on that commitment to their team.”
Look, I always think about what are the healthy tensions that you need in the world. This is one of those tensions in which lots of people are only willing to accept accountability and responsibility, and ownership as if they have control. It turns out that that’s an inherent weakness because you take away the power of the team dynamic.
One of my friends gave me a great example of that. The key that you want to have in lots of ways is people who have a sense of ownership and accountability, but they don’t feel the need for that accountability to come with excluding, filtering, and limited the power and the impact of the team. That’s where you get that sweet spot.
One of my friends, Sargal Jha, who stars on Broadway, did Mulan, Mooj Fellow, and a couple of other things. We were having this conversation, and he talked about how we get shows like Broadway and other places. He was just like, “If you come in and you’re maniacal about your ideas, it’s only you.” He’s just like, “You have to have strong ideas, but you have to hold them gently so that other people can enhance those ideas and those concepts.” He’s like, “That’s what creates the magic around things.” It was a powerful concept.
It’s interesting. It also means inherently being comfortable being responsible for all the things that you don’t control rather than rolling everything up to you and having a fourteen-person management team and all that stuff.
That is one of the hardest concepts that I face in leaders, is just that they want the accountability to come with select big orgs. That’s just not a practical, feasible, reasonable, or helpful thing in most cases.
Grabbing A Shovel
Talk about grabbing a shovel.
Grabbing a shovel is, I think in some ways, it’s the test that you give yourself more than anything. You could say you give it to others every single day and say, “Are you still connected? Do you still have what it takes to truly lead?” There are sometimes moments in times when people treat leadership as a philosophical thing.
What you have to be willing to do is you have to be willing to dig in as appropriate and be in it and be in the details made in the weeds. Now, that does not mean micromanagement, does not mean doing other people’s jobs, but you can tell when leaders are disconnected and there’s always somewhere where a leader should be deeply connected to what’s going on.
If at no other place, then basically, if the team is operating at peak capacity and everything’s fine, then they should be digging into areas. They should be digging into basically constituents or customers or affiliates or partners and digging in what’s happening, what’s going on, showing the interest to being out there. They should be digging into the team development, digging into not just their team, but what’s the development capacity.
Bench building.
There’s always a place to dig in. If a leader is a little bit too distant and they’re spending their time, I would just say, at the high level and they’re not dug in somewhere, then that’s a sign on the outward trajectory of relevance. I always think about leadership, are you relevant or not?
It’s a good point. Some of the best leaders I’ve seen seem to have this good ability to fly over. You have to take those deep dives. Either things that they’re intellectually curious about, things that are broken, or things that need their expertise and get down and dirty at that peer level.
Exactly. Look, you could say whether it’s situational management or crisis response, there’s a whole bunch of different ways you can look at it. The only point is that if there are issues, if everything’s great, that’s different. You can just focus on the customer and then you still get in. When things are not going well, leaders have to resist the urge to micromanage.
When things are not going well, leaders have to resist the urge to micromanage.
I think, especially with young leaders, what happens is the result is they are disconnected. When things are not going well, it’s important that you be personally connected and understand, as you don’t try to control it. I think the mistake is that my engagement requires control. My engagement requires engagement, and that makes everything better.
Which is you’ve seen the best salespeople. They ask the right questions.
That’s engagement. I have to go in and solve it. I have to be directed. I had one the day before. We were going through a thing, and I was in it, but I was in it for two things. One, it sounds like what we’re trying to solve is not clear. You all have to come back and be very clear about how you frame the problem and what you’re trying to solve. It sounds like we’re not clear who owns this. You have to decide who owns this. That was my job. My job wasn’t to solve it, but my job was to help figure out what was bottleneck in the issue.
Help orchestrate it, coordinate it. I know people hate sports analogies. Sorry, 50%. You can guess which 50% sometimes. I think from a leadership standpoint, they’re so instructive. The one that someone pointed out to me once, and I think it’s just a great model, is coaching versus leadership. A coach can never step onto the court. They cannot cross the line. Either they’d be thrown out or something. If leaders accepted that same threshold of like, “Look, I can call time out. We can talk about this, but I can’t take the ball and go shoot it instead of the other player.”
That’s exactly it. That’s the example that you asked about earlier. Accountability without complete control.
Cyber Security And Artificial Intelligence
I’m curious to pivot to cyber security and what Rapid7 does. Obviously, it’s a huge field. Talk a little about who are your customers. What part of the industry do you serve?
We serve primarily, I would say, mid to very-large enterprises. We have 11,000 customers around the world, and we serve a specific group of customers called Security Operations Center. They are responsible for looking at their attack surface or all the technology they have, seeing where it’s risky, vulnerable, exploitable, reducing that exposure or that exploitability surface that allows them to be compromised, and then monitoring for attacks. Our goal is we provide technology that allows people to detect attacks quickly when they happen and make sure that they’re mitigated or shut down. That’s the technology that we provide. That ability to assess, detect, and respond to emergent attacks in the environment.
Do you protect against a lot of the ransomware stuff that we’re seeing in municipalities and those sorts of things?
We do have some technologies to protect against it. Mostly, what our technology does is analytical technology. Our technology analyzes this. Here’s where you’re susceptible to technology and here’s how you change your configuration to make you less susceptible.
It’s before an actual threat.
It’s before and after. We go through and we map out the environment. We say, “These are your attack vectors. Here’s what you can do to change them. We can automate changes for you in that environment. We then monitor that environment to say we’re seeing active attacks.” We enable that team to respond and mitigate. We’re monitoring. We’re the alarm system for the technology environment.
It’s always been a little bit of a cat-and-mouse game. I have to imagine AI has just turbocharged the good and the bad on this.
AI is a foundational technology. Unfortunately, all of us have access to. I’m excited about it. It enables a lot of positive things.
So are the criminals.
That’s the thing. It has not changed the status quo yet.
Has it changed the pace of what you’re doing or how fast the game’s being played?
No, I don’t think so. I think that you could argue in a tight timeframe. Yes. You zoom out. You’ve had these moments where new attack vectors come out, and you see a rash of compromises and other stuff. You had places where defense accelerates, and you have accelerated defense. I would say that if you zoom out, the question is, do we keep that balance in that ecosystem?
We have to. If defenders do not adopt the technologies to keep pace with attackers, then they get behind. It’s possible to stay ahead. I think some of us were hoping that some of the AI and automation, and machine learning advances would allow us to accelerate ahead. It turns out they’re generally available to everybody.
I’m curious. You do some investing. You obviously have the organization when you look at all the AI and are you in the it’s properly hyped, over-hyped, under-hyped. Does it just become a baseline expectation at everything?
I think it’s poorly understood but properly hyped, like what it means. When you have prior versions of technology that were more based on machine learning, it was hard for your average user to understand and see the realized value of what was happening. I think when large language models have introduced is the democratization of that value. The reason that I think it’s appropriately hyped is if you go back over a 20-year to 30-year arc, very few of the technology revolutions that we had have generated. I would say if you just want to take out from a GDP protective, actual productivity value in the overall economy.
Are you saying social media hasn’t created GDP value?
Exactly. Just actual productivity, things that are extra productivity. You can argue that when virtualization came out, it changed the cost curve there. If you think about big data, how did big data make companies more profitable and more efficient? There’s a lot of questions that happened there. The benefit, and why I say it’s not overhyped, is that we’re already experiencing lots of use cases where large language models specifically are driving increased productivity and people could feel it and see it and realize it.
I think that’s appropriately hyped, that potential for the productivity gain, the potential for ease of use, there’s a lot of potential there. I think what’s overhyped right now but could be appropriately hyped depending on the face of technology. I think people don’t understand that it’s a prediction system. It’s the best prediction system that we’ve seen in a lot, but it’s predicting the outcome of how you frame it matters. I think people don’t understand the underpinnings.
Angel Investing
There’s a lot of noise. In addition to your CEO and Chairman role, you also do some angel investing. Do you invest in the spaces that you know? Are you a jockey or a horse? I’m guessing you have some rubric for what makes a good investment for you.
When I was a student at Harvard Business School, Warren Buffett came in to speak. He said something that was important that I remember to say. He’s just like, “If you don’t understand it, don’t invest in it.” The thing that was interesting, we all said that he talked about technology and why he had lagged. He’s just like, “I just don’t understand it.”
I don’t feel bad about the fact that my performance lags. I’m trying to figure out how to understand it, but he’s just like, “Don’t feel guilty about doing things that you don’t understand. Understand them. When you understand them, do them.” That was great. Why do angel investment? It’s only enterprise software. I have to understand it.
I do occasionally some things that are invested in talent because I want to see the talent thrive. In diversifying technology for women and people of color, I’ve made some small, limited investments there when I have time and capacity. By and large, it’s enterprise software. That’s the domain that I understand. The other thing that I have to have is time. I don’t have time right now. I’m not doing active investments right now because I don’t have time.
You’re involved when you do it?
I’m involved because I’m investing. There are plenty of ways to make money. I’m invested because I’m interested. It’s a learning thing. It’s interesting. The other thing is that in order to make the investment, you have to be able to do due diligence. I do tend to partner with different venture funds and own that because I don’t have the capacity to do due diligence.
Conviction, Curiosity, And Humility
How important do you think it is? The plan’s often not the plans. How important are the people you invest in? That they’re adaptable and willing to change as the conditions change?
I think that’s hugely important. It’s not just conditions. I would say it’s not less good.
Or as things prove out or don’t prove out.
The conversation that I have with every CEO is attention. I want a CEO who has conviction about what they’re doing. They’re excited, and they want to put all the chips on the table because they believe. That’s one thing. The tension is I don’t want them blind. I want them hungry and curious and interested in customer feedback and what’s happening and what competitors are doing. That’s the thing, conviction, and curiosity.
You’re like this yin and yangs, I’m noticing.
Those are too hard, but that’s what great leaders hold tension well. Conviction and curiosity is what we look for. I have this rulebook that says conviction, curiosity, and humility. The humility is I tell every CEO I work with, I say, “Look, the only thing I talk to you about is that you always have to be willing to do the job that needs to be done. Not the job that you want to do.”
That’s the milkshake case study, Clayton Christensen. What was the job of a milkshake? Have you ever read that?
I haven’t read that.
It’s fascinating. Here’s the thing. What’s the job to be done? They studied how to market a milkshake because it kept people comfortable. It was a very interesting case study.
Sometimes, especially entrepreneurs, as they get successful, they want to do the job that they want to do, not the job that needs to get done. Sometimes, you’re a technology entrepreneur, and you have to build a sales team, and your job is to do that. I always tell people that you have to understand what’s the job that needs to get done that only you can do. You have to be willing to do that job. Those are the three things that I always think about when I’m working with entrepreneurs.
Some entrepreneurs tend to do the job they want to do when they become successful instead of accomplishing the job that actually needs to get done.
Balancing Different Roles
The conviction and curiosity sound like I like when people say I have strong opinions loosely held. People heard in the bio that you have quite a lot on your plate these days between career investing boards. I know last February that President Biden announced his intent to appoint you as one of fourteen members of the National Security Council. How do you manage your time, or how do you make decisions on how to allocate your time among so many different things?
It was a huge honor. It was the National Security Telecommunications Advisory Committee that advised on a whole bunch of things about technology and security. I work with my assistant every year to say, “Where we’re going to allocate or rotate our time?” Based on what’s needed. One, I have a job and a family. I have Rapid7 and my family. That’s the dominant thing that’s in need.
They do get benefit from me spending time outside of there because it’s the growth and learning. Part of what I’m always looking at is time outside of my job and my family needs to be both growth and contribution. I need to be contributing and growing at the same time. Otherwise, I should just be donating to it, but I shouldn’t be doing it.
It fits an interest area. For my job, it became a geopolitical issue, too. As we were doing it, so understood what was happening around the world. The Council on Foreign Relations and the NSTAC were like both areas for me but also helped me. I was genuinely interested. I got to learn a lot and I got to contribute back to my country that I love.
That was an opportunity to contribute and grow. That was the big thing. The Federal Reserve system, where I’m the Chair of the board, has always been an opportunity to learn and understand the economy. We sit down, and we say what’s necessary, what’s growth, and where’s the intersection of growth and contribution to country, society, city, and that’s where I spend. The Federal Reserve and the presidential NSTAC are contributions and growth. That’s the sweetest part of that.
Writing A Book And Being A Slow Burn Introvert
Awesome. Have you thought about writing a book? You have all of this fascinating stuff that you’ve done. Have you thought about putting that all together?
My chief of staff, Grace, is very talented and tries to prompt me for us to sit down and do one periodically. After she goes through the exercise and just talks about what we want to spend our time on now, she’s just like, “Let’s hold that discussion to next year.” I spend a lot of time with customers. It’ll be something I do at some point in time. In fact, I think Grace was starting to make more notes. Luckily, I do a lot of speaking.
You just have AI find everything you ever said.
Exactly. There’s a lot of speaking and writing and other stuff, but that’s an area that we’re focused on.
There is something you identified yourself that resonates with me. I’m sure other people have, too, but a slow-burn introvert. What does that mean? Especially for someone who’s a CEO, who knows out there talking to people, a board role. I think there are a lot of people who perceive that people are extroverted because they have to play that role, but they’re not.
I think you were asking and I apologize for that. What does it mean to be a slow-burn introvert? Technically, I’m on the borderline of the buyer’s grid thing, but at the end of the day, the way to think about it is I do not get energy from others. I get energy from taking walks, reading books on my own, and being in my head and my space. That’s how I recharge and refresh.
I have a large pool of energy, and it’s a slow drain. Being around people is a slow drain. It’s not as a fast drain. They just burn the energy down fast. For me, it’s a slow drain. I have lots of capacity to be around people, but if I am all day and then it’s the cocktail parties and stuff like that, it’s draining down, and it hits. I have to be able to recharge time in there at different points in time.
For you, that’s just quiet or outdoors or reading.
In my way, I do get recharged in very small groups. Taking hikes with my daughter, doing something like that. I do find that recharging or with a friend, it’s just very small groups. I love being outdoors. The hikes, activities, sports, all of that, I find recharging.
Biggest Mistake
Last question for you. This is multivariate. It can be singular or repeated or personal or professional, but what’s a mistake that you’ve made that you’ve learned the most from?
There are so many over the years. I think one of the biggest mistakes I made, I got corrected on it, and it changed a little bit of it. It was the idea that doing things fast was a way to make you successful. I used to be focusing on how fast things happen, and how fast I get promoted. One of my mentors pointed out that when you’re young, the stacking up of the accomplishments, while it may matter, but they gave me this visual. They said, “You’re robbing yourself of the depth that’s needed to sustain any success you have.”
The feedback that they gave me said, “If you think about the depth, it was how rich are your relationships? How deep is your understanding and your foundation also knowledge of it?” It was long-term building a deep reservoir was better overall than the speed of how fast you move from one thing to another. That shift, I think, has changed the quality of my life and the opportunity for me to have an impact.
Building a deep reservoir of knowledge is better than how fast you move from one thing to another.
Closing Words
That’s an important one. Corey, how can people learn more about you and your work at Rapid7? Where should they go?
For my work, I’m always happy to talk about the work that we’re doing in cyber security. You can go to our website, www.Rapid7.com. On there too, we have lots of my talks and speeches and other stuff on the site.
Awesome. Corey, thanks for joining us in this episode and sharing your story with our readers. You have an incredible story, an incredible background, and I don’t know how you have enough hours in the day.
That’s a lot of fun. Thank you so much for having me. I’m honored.
To our readers, thanks for tuning into this episode. If you enjoyed this episode, make sure to follow the show to be notified about new episodes and have them downloaded right into your app. Thanks again for your support. Until next time, keep elevating.
Important Links
About Corey Thomas
Corey Thomas is the CEO and Chairman of Rapid7, a leading public cybersecurity software company valued around $3.5B. He is also an angel investor in several tech companies, a member of the Council on Foreign Relations, a director and deputy chair of the Federal Reserve Bank of Boston, and a member of the Blue Cross Blue Shield of Massachusetts board of directors, among other honors. Before Rapid7, Corey worked extensively at companies such as Microsoft, Deloitte, and AT&T.
Corey joined host Robert Glazer on the Elevate Podcast to talk about his leadership approach, how he rose through the ranks at Fortune 500 companies, and much more.
