S13E03: Winning the cyber war, and building a community of 1.7 million, with Haris Pylarinos (CEO, Hack the Box)

Haris Pylarinos
So I did a few trainings in the process of, you know, becoming again acquainted with cyber security. I wasn't very satisfied. I thought that this is the way cyber security upscaling should be delivered. So I coded the platform, I created the first virtual environments in the platform. I designed the logo, I did everything because it was a 1 month show in the beginning, it took me 2, 2 and a half months to actually release the first version of the platform. And the only thing I did was to post a link of the website into a Facebook group related to cybersecurity to check it out. And Since then, it started skyrocketing.

Richard Medcalf
I've never spent a single dollar in pay dags or any form of marketing or advertisement. Welcome to the Impact Multiplier CEO Podcast. I'm Richard Medcalf, founder of XQuadrant, and my mission is to help the world's top CEOs and entrepreneurs shift from incremental to exponential progress and create a huge positive impact on our world. Now that requires you to reinvent yourself and transform your business. So, if you're ready to play a bigger game than ever before, I invite you to join us and become an Impact Multiplier CEO. Harris, welcome to the show. You founded Hack the Box in 2017, and I know it's because you were dissatisfied with traditional training options for cybersecurity. And you set out to change this through what you call an out-the-box thinking, offering hands-on, fun, practical training. And I know you've scaled now 4 years later, 4 or 5 years later to 190 employees. You've got the world's biggest cybersecurity community with 1.7 million members. You just closed your Series B funding round. So you're being very successful and you're making a positive impact as you go. I want to start with a question which was buried in that little intro, out of the box thinking. I hear it, I see it in previous conversations we've had, out-of-the-box thinking is big for you. It's even in the name, right? Hack the box. It's a notion of getting out of the box. But for many people, it's a buzzword. So tell me, What do you mean when you think of out-of-the-box thinking? It's...

Haris Pylarinos
First of all, thank you very much for having me. You're welcome. To answer your question, it's finding clever ways to tackle a problem, thinking unconventionally sometimes, finding a solution where everyone tells you that, you know, there isn't any. And this is precisely what ethical fighting is. When a system is designed, it's not designed to be bypassed. The Security system is not designed to be bypassed. So it's designed to be secure. And with out of the box thinking, you find very creative ways on bypassing the security measures. So this is what actually defines a hacker mindset and an out of the box thing. I don't know if it was clear.

Richard Medcalf
Yeah, I get it. So ethical hacking is saying, yeah, you've got an IT system, it's been designed in a certain way, if you're going to test that and push it to its limits, You have to come up with creative ways to get in. Exactly. Yeah, so you're saying this is the way to address challenges which might seem impossible, which is great. I love that mindset, right? It's what I stand for, it's what the Impact Multiplier CEO podcast is in the name, right? What are we going to do differently to multiply impact and not just add value? But let's dive into that. So how do you do that? Because a lot of people go, wow, that'd be amazing to think out of the box, but where would I start? Because it's easy to say, oh, you've just got to be creative. So if you have a business challenge, perhaps now outside of the world of hacking, if you know in your business as you have a challenge, what do what questions do you start to ask yourself that get you to think out of the box?

Haris Pylarinos
I usually phase out. So I phase out of the problem away as and I'm trying to find the goal. And I start reverse engineering from the goal towards achieving it, disregarding the actual problem. Okay, so you zoom out to look at the bigger goal. Exactly. I zoom as far out as I can. I see the issue, okay, but I'm focusing on the goal. I'm finding creative ways, okay, again, creative buzzword to tackle the problem and achieve my goal.

Richard Medcalf
It's interesting, I think it was, I think it was Eisenhower, General Eisenhower, he said that whenever he had a problem he couldn't solve, he could never solve it by making the problem smaller. He would solve it by making the problem bigger.

Haris Pylarinos
Yeah, that makes some sense. Indeed. Looking at the bigger picture, right? Looking at the bigger picture. Of course.

Richard Medcalf
So also on this topic, I know we've jumped straight in here with this idea of out of the box thinking, but it's in the name, right? So it's a good place to start. In your journey of management, can you think of an example of where you've had to, where you have done something quite out of the box? So not so much in terms of the actual technical side of the ethical hacking, but in terms of how you built the business, was there a moment when you had to really think out of the box?

Haris Pylarinos
There are several. Most of the ones that come to mind are technical, though. For example, our decision not to utilize a cloud provider, rather create our own private cloud.

Richard Medcalf
I mean, the easy solution and, you know, the standard in the industry is, OK, you go with 1 of the major cloud providers. OK, let's dive into that. So, yes. So Why didn't you do that? So what was the moment when you went, hang on, before we do that, before we sign up to Amazon or whoever it is? Let's try this.

Haris Pylarinos
In the beginning, it was primarily a cash flow issue. We started with no funding. We started bootstrapped. The entire investment in Hack the Box was 2000 euros. That was it. Wow. And the bad thing with those cloud providers is that if you are not funded with a seed or whatever, you don't also get the free credits that they provide. So with the cloud, we had the company made no profits in the beginning because it was purely free, purely community. We've had to find a very cash efficient way to deliver our content, which is resource heavy because we simulate virtual environments. And we came up with a very custom solution utilizing some hypervisor brand With a lot of customization and middleware, which is like a let's say DevOps tool Developed by us in order to deliver the simulated environments with a fraction of the cost And also with I don't know at least at least 20 times faster than any cloud provider. In the beginning it was, the funny thing is that in the beginning it was purely cost. Then we got funded. Cost wasn't that important. But then it was efficiency, because we've created it so fast that it was much faster than any cloud provider. So we kept it. On the later stages, which we are now, this has a tremendous impact on our gross margins. So it provided different value along the way, but keep providing value this decision that we made back then in 2017.

Richard Medcalf
Yeah, necessity is the mother of invention, right? So you started off with something and then you built it from there. Exactly. Let's jump back to the bigger picture here. Why did you found the business? I know you had a couple of co-founders and you created the business in 2017. What was the conviction that underpinned that? You know, what was it that made you go on this long, complicated journey of entrepreneurship? 

Haris Pylarinos
First of all, I didn't, you know, wake up in the morning and say, yeah, I want to be an entrepreneur, I want to create a business. It happened very gradually, my transition into that role. Initially, it was about, I don't like the training that is out there. Training could be a lot better with the current technology that we have now, could be a lot better than this. So I will create it. This is cyber security training, right? Cyber security, yes. Okay, in your previous corporate role, I guess that you were doing, you were taking this course. I was, To take you a bit further back, as a kid I was an ethical faggot. When I became of age to work, there was no profession related to that. Cybersecurity was not important at all. So I followed a career in IT for a lot of years. And at the latest stages of my previous career in IT, I saw that cybersecurity was becoming more and more critical. And since this is what I loved since I was a kid, I decided to pivot back. In my effort to pivot back to cybersecurity, I wanted to refresh my skills. But as I found out as a kid, the best way to learn cybersecurity and to develop this out of the box. The thing is to experiment. It's to be in front of a system and try to actually bypass its security measures.

Haris Pylarinos
So instead of doing this multiple choice questions or whatever you were doing in the corporate setup, you wanted to create something that was much more interactive by the sound of it exactly so I did a few trainings.

Haris Pylarinos
In the process of you know becoming acquainted with cyber security I wasn't very satisfied. I thought that this is the way cyber security upskilling should be delivered. I called the platform I created the first virtual environments in the platform. I designed the logo, I did everything because it was a one-month show in the beginning. It took me 2, 2 and a half months to actually release the first version of the platform. And the only thing I did was to post a link of the website into a Facebook group related to cybersecurity to check it out. And since then, it started skyrocketing. I've never spent a single dollar in pay dubs or any form of marketing or advertisement. It was 1 link. Each person joining told it to the next, to the next, to the next, and this had the multiplication effect, reaching... What was it about that which was so compelling that it forced people to share? The way it was delivered, apparently, was the way many people wanted it. So many people had the same thought as me. I didn't know that, but it turned out to be true.

Richard Medcalf
Beautiful. Yeah, that's amazing, isn't it? You came up with this 1 shift and it was so compelling.

Haris Pylarinos
People just had to know each other. Yeah. And I'm very happy to say that the entire market is now shifting towards that.

Richard Medcalf
Yeah. Amazing. So let's, let's go. So I love this fact that your, your mission did start in your youth and then you kind of let it to 1 side and then it came back and you were able to close that chapter or close that loop in your life story. And I know that you've said that your ultimate impact in the world might be to change people's perception of the word hacker.

Haris Pylarinos
Why does that matter, do you think? Why is that important? It is important because I've met, especially now through Hack the Box, I've met thousands of hackers. And by default, hackers are ethical. The ones damaging systems or spreading ransomware or whatever, they are called cyber criminals. They are not called hackers. But you always see a news front line, hackers did that, hackers did that. So it's cyber criminals that did that. This is my thesis, at least, because I've met many faggots in my life and they all share a very strong code of ethics.

Richard Medcalf
Yeah. And related to that, I mean, cybersecurity, I know you mentioned that you think that we're losing the cyber war. You said that elsewhere, with catastrophic consequences. So tell me, what leads you to that perspective? I mean, is this just a marketing line so that you can get more people to sign up?

Haris Pylarinos
Or what's going on there for you? What do you see that others don't see yet? There is some truth in it, a lot of truth actually. The problem is that we are investing a lot in cyber security, all organizations do.

Haris Pylarinos
But they are investing more in software and tools rather than the humans. And humans are in the center of cybersecurity. The core of cybersecurity is the human element. Software comes on top and amplifies the effectiveness of the human. But software by itself won't do much. If you want to win a race, you don't just buy a Ferrari. You have to invest the time to actually learn how to drive a Ferrari before you buy it. So the software is the Ferrari, but you still need the operator, the driver, which is the human. That's why I believe we should invest more in the human element. We should teach them how bad actors think and act. And this is also critical. Even if you pass all of the trainings, the most expensive trainings in the world regarding cybersecurity, what you actually need to know is all the clever and creative ways the criminals will use to enter your organization. It's like if you have your house, again, you want to protect it from thieves, you will go to this security firm, they will put cameras, superb doors with complex locks and everything, And then a thief will come, he or she will see a small window in the basement, and they will enter through there. And you have the most secure place in the world. So you need to think with creative and clever ways on how to bypass the security measures. And if you think like that, as you set up a system, as you go, as you do anything related to your daily tasks, the moment you see 1 of those, let's say, clever, creative ways to bypass your security system, you will automatically fix it. Yeah, and so when you say people are losing the cyber war, or risk of losing the cyber war, why is that? 

Richard Medcalf
Are you saying just because the scale is like, the growth in the people is not matching the growth in the threat. Yeah. What, how do you see that?

Haris Pylarinos
There is a huge gap in demand for jobs of cybersecurity professionals versus the actual professionals that are available in the market with a lot of asterisks to that because I believe there are many professionals in the market. 

Haris Pylarinos
They just don't fit the criteria of the HR managers to actually pass them on to an interview. Right. Why? Because they haven't got the right certifications. Or the right education. Right.

Haris Pylarinos
Again, HRs need to be creative as well on exciting cybersecurity skill because there is a huge talent gap, we know that. But there are a lot of professionals without any degree that are extremely skewed at that. And we've seen that first hand. I mean, in fact, the box, as you understand, we tap into our community to hire people. In this community, we have biologists, we have professional drivers, I mean, the list goes on, they can be anything, but they can also be very good at cybersecurity, because they have developed this out of the box.

Richard Medcalf
And so if you were speaking as you are now, on this podcast, you're speaking to a bunch of CEOs, right? There's other people obviously who listen to the podcast, but there are a bunch of CEOs who listen. So what would you recommend to them? What would you want to say to them if you were literally on the conference stage and you had all these people in the audience? What's your message for them? You know, how can they win the cybersecurity war?

Haris Pylarinos
What can they do? Everything hiring completely practical skills assessment and soft skills tech from HR, forget degrees, forget everything, and invest a lot more in the human element. That's the core tool to tackle the cybersecurity problem.

Richard Medcalf
So don't get a sense of security by just on the software budget that you're spending alone.

Haris Pylarinos
Exactly. Exactly. I'm not saying don't spend on software, obviously spend on software, but make sure that you have the right operators before you invest in software.

Richard Medcalf
I like it. Harris, you mentioned that cyber awareness you think should start even in primary school, which is an interesting point of view.

Haris Pylarinos
Yes. Why is that? Why do schoolchildren need to know about cybersecurity? Everyone needs to understand cybersecurity from a very early age.

Haris Pylarinos
So it's part of our daily lives. We are now more and more connected with everything. Criminals and con arts and scammers are everywhere. We should be aware from a very early age what to trust and what not to trust, so we avoid a lot of cyber incidents in the future. It's not the 80s or the 90s where some people had a mobile phone, some people didn't. Or some people had this Nokia 3220 or whatever.

Haris Pylarinos
Now we are online. The majority of our lives is digital.

Haris Pylarinos
Yeah. So you're saying before people get a phone, they should be… They should understand, yeah, they should understand all the dangers that come with the internet.

Richard Medcalf
I hope you're enjoying this conversation. This is just a quick interlude to introduce you to 2 transformative programs that we run. The first is Rivendell, my exclusive group of top CEOs who are committed to transforming themselves, their businesses and the world. It's an incredible peer group and a deep coaching experience that will push you to new heights no matter how successful you've already been. The second is Impact Accelerator, a coaching program for executives who are ready to make a big leap forward in their own leadership. It's regularly described as life-changing and no other program provides such personal strategic clarity, a measurable shift in stakeholder perceptions and a world-class leadership development environment. Find out about both of these programs at xquadrant.com slash services. Now back to the conversation. So I think this is interesting Because I know you talked about, you know, we talked a bit about impact. And obviously impact has multiple levels. You know, you talked about changing the perception of what a hacker is, right? Obviously, you've got an impact to grow your own business, to multiply the impact that can make in the world. I want to put it to you. 1 of your possible futures involves being the person who changes cyber education might not be for this year in the middle of scaling up, But I can see that that's a passion. You started very young in that whole world of ethical hacking. You want people to understand the difference between hacker and cyber criminal. And you understand that as the world gets more complicated and even more digitalized, is basic awareness like road safety, you know, cyber safety is going to be even more important. So cyber Security might be as important as physical security is really what you're saying.

Haris Pylarinos
More important. I would say more important.

Richard Medcalf
More awareness even at a young age. So I'll just put on that seed. Perhaps that's part of your future, because you have the credibility, the relationships, the understanding, building a very successful business in this area. And you might just want to be thinking, you know, as a North star, well, what impact might I make in raising up a new generation of people who take this seriously. I'm just curious, how does that land with you? I'm just throwing things into your future that you haven't asked me for, but I'm curious as to how that lands, whether that resonates or whether that's not what you're all about. It does resonate, although I find it very hard to digest.

Haris Pylarinos
So, it's that long, that ahead in time. So, if you've asked me 3 years ago, if you outlined what I would be doing today 3 years ago, I would say most likely he's exaggerating. So the same applies now. Maybe that's the case. I haven't had the time to actually think this through or to digest it. Obviously I hope for the best. I want to impact this industry because I believe that I can impact it for the better. And my goal is to get there eventually.

Richard Medcalf
Well, famous phrase is we always overestimate what we can do in a year and underestimate what we can do in 5. Right. So for me, this is more of a seed. I just like to kind of plant these seeds. It might happen, it might not happen. It might not be the way you want to go in life, but sometimes just having that what if in the back of our mind can create little shifts. So we'll see where that goes. Now, this season is called Business is a Force for Good. So I'm kind of wondering how you see that, how you see business, because obviously I'm sure you're making good money with your business, and obviously that's great to make financial rewards from all this. And then you have this, this impact that you're trying to make as well as time. How do you see that ethical dimension of business? I believe that at least I won't speak for everyone but for me

Haris Pylarinos
I don't believe I would grow a successful business if my ultimate goal was money. I consider money as a byproduct of doing something very well and to do it very well you have to actually devote the time and effort and fall in love with what you do in order to excel. So obviously, based on our conversation, also you understand that I practically tried and partially succeeded on shifting the training industry on the cybersecurity towards what I believed was better. And yes, we've grown and we've made a lot of revenue through that process, but the main goal remains to actually make a safer cyber world for the generations to come.

Richard Medcalf
Yeah, thank you. I feel it when you say that, I hear it, I hear the conviction in your voice. Let me just jump back, before we get a wrap up, I want to ask you a bit of a tactical question which is about your growth you've experienced. 4 years ago, you were 4 employees, which I think about 3 were founders, perhaps. Yeah, plus 1. And now you're 190. So that's a huge growth.

Haris Pylarinos
It's actually above 200 now. Okay.

Richard Medcalf
Between when we gave you the data and now we've hired a few people. There we go, excellent. So you're now over 200 people, so that's like a whatever it is 50x growth in 4 years. I know you said you perhaps even scaled too fast and that created challenges. So looking back, what were those challenges and what advice would you give other leaders who are in that high growth scale up phase?

Haris Pylarinos
The biggest challenge is Constantly changing the way you manage the company because the practices you use when you were 30 stop working when you are 60 or 80 then again. When you're a hundred and you have certain procedures around the business you become a hundred and 50 those begin to find a away. You constantly need to adapt and change the way you work. If you employ the motto or the mindset that if it works, leave it alone, don't touch it, you lose this game. You need to constantly find better, more efficient ways to operate the business. And another thing I found out is that because we scale too fast and we hire too fast, is that hiring doesn't resolve the problem always. It sometimes amplifies the problem. First, you have to resolve a problematic department or a problematic procedure or strategy or management style, and then hire.

Richard Medcalf
Because hiring people towards resolving the issue, we just multiply the issue. That's really fascinating and it's a great point. I've heard other clients say this as well, right? Sometimes, you know, if you scale something unhealthy, you just create even more dysfunction. Exactly. So yeah, what are the kind of signs that hiring is not going to be the solution, would you say?

Haris Pylarinos
Actually, the sign is when, when you think I need to hire more people because, you know, the job is not getting done. Usually, you have to dive really into this department and start to understand the way they work, any issues they are facing. Maybe there are bottlenecks from other departments. So, if, let us say, department X delays department Y, and you hire more people in department Y thinking that they don't deliver, you will amplify the problem because they will just need more resource from the other department, which they will not have. So it's always, at least it's proven always wise for our case to dive into any malfunction that we witness in the company, understand it, try to resolve it the best we can. And after that, decide about hiring.

Richard Medcalf
Right, yeah, it makes a lot of sense. What's a big, what's a mistake that you've made? Like, what's 1 area where you say, oh, that was, you know, I made, I did made the wrong decision there, or I wasn't the leader I could have been in that situation. And that kind of created issues for us.

Haris Pylarinos
I think the mistake goes very, very early on before raising capital. If I did this again, I would raise capital on day 1. I would not wait to bootstrap it 1 and a half year. This time was in 1 and a half year, if I had the capital that I had on my seed round, I would go 5 times faster. And I witnessed this first hand when I actually got the seed investment that was able to hire the people I wanted. 

Haris Pylarinos
So, raise money faster would be my 1 thing I should have done. And what was the mindset shift you think that you have now? Like, why did you change that mindset? Or what was holding you back, perhaps, to do something? I didn't even know that was an option. It wasn't a part of mindset.

Haris Pylarinos
It was part of me not knowing the startup industry, the startup ecosystem. I didn't know financing could be a venture capital firm. I thought the only way to finance something that you don't have the capital for, you have to get a loan from a bank. Got it.

Richard Medcalf
Well, again, back to education, not so much in cyber education, but in financial education, right? Again, it's another big issue. That was purely financial education. Yeah, yeah, so it's a Great point. So let's look at the future. You want to make Hack the Box the one-stop point of reference for everyone in cybersecurity. You want to multiply the impact that you're already making in this industry. What's that going to take? What's going to have to be different in the business for you to fulfill that ambition?

Haris Pylarinos
We are already in the process of materializing that. The goal is to broaden the user personas that we attract. Currently, as Hack the Box, we are known for the hardcore ethical hackers, red teamers, penetration testers. We are gradually expanding to capture also the blue teamers, the shock analysts, the security engineers, and we also want to embrace general IT staff on the basics of cybersecurity. So as an organization, you have a single pane of glass, a single dashboard that shows the entirety of your skill set in the organization. And this would be mapped with, you know, the relevant frameworks that you use to report to your board. So with 1 snapshot, you know exactly what is going on on a skill level on your organization, and you are able to fill the skills that are missing either by directing your employee base to the relevant modules or by finding new employees if you need through Hack the Box platform by tapping into the community and posting your job ads.

Richard Medcalf
Yeah, that's great. So yeah, you're really expanding the kinds of people that you're serving. Exactly. For this to work, we need to capture the entire spectrum of cybersecurity.

Haris Pylarinos
And as you grow that business, so what would need to change in your business for you to do that? Minor things. It's mostly assisting, adding relevant content and fine-tuning the platforms to be able to deliver that content with all the features it will require. It's not a massive thing, it's not something pivotal to the business. I would say it's a natural progression. It's natural progression And this is the path that we are on right now.

Richard Medcalf
Got it. Yeah, so right in the middle of that journey of scaling by the sounds. Exactly. Rather than adding disruptive new elements. Yeah. And so for you as a leader, what will it take for you to multiply your impact? Because we always have our own ceiling that we are trying to break through that will take us to another level. And I'm wondering what thought you've given to that? What way might you want to work on your own leadership for you to be able to lead this company at a higher level?

Haris Pylarinos
I'm trying several things. I try to get myself in very uncomfortable positions. So this is the number 1, whatever seems uncomfortable, I try on forcing myself to do it, so I learn from it. And I'm obviously constantly learning for, looking for coaching, lessons, even English lessons, which, okay, I'm not very bad at English, but I wouldn't say I have the best accent out there, as you can probably see. So I'm always trying to develop myself, both with the help of experts, but also by putting myself to positions where I have to develop or lose. 

Richard Medcalf
Yeah, it's called the inciting event, right? Like in movies, it's where the hero gets disrupted in some way, you know? You know, it's where whatever, Gandalf knocks on your door and gives you the the ring of power or whatever, you know, or wherever happens in, you know, in Star Wars, whatever, they get Luke out of his, you know, his thing and into a journey. It's this thing. So I think that's a great point. When we actually forcibly put ourselves into an uncomfortable situation, then we are forced to rise to the occasion.

Haris Pylarinos
To deliver. Exactly.

Richard Medcalf
Which is, I think, which is probably a great place to end, right? I think, yeah, Harries, I've really enjoyed our discussion today. I think we've really focused on a whole number of areas. We've looked at this idea of out of the box thinking and zooming out to really think about what are creative ways we can address that. You know, we've looked at that the underlying driver for who, you know, for you founding the business. That actually started off right when you were a teenager and just kind of lay there dormant until the right situation came to bear. And I see that all the time. My mission now to help the world's top leaders transform their companies and make a systemic change for good in the world, That comes from my own journey, which I've talked about in the past, of having a mentally handicapped sister. We had very different journeys. I had all this high-flying career, and she stayed at home needing 24-hour care. These stories come back to shape who we are. And set us on our own path. I think for any leader, it's really worth mining. What's the stories in my path that are meaningful to me now and that set me on fire? And then I think looking at the future of, you know, the importance of cybersecurity awareness, the dangers of scaling too fast, you know, how we could work on that. We've really covered a lot of ground. So I want to just thank you for all of that. It's been a fascinating conversation. Thank you. Thank you very much for inviting me as well. Yeah, you're welcome. And I look forward to kind of seeing the next stage as you kind of become the go-to resource for perhaps the whole IT industry in this area and beyond, right? Perhaps you'll have a module for primary school children in the next few years. Who knows? So, Haris, It's been a great pleasure. Thank you so much and I look forward to following your journey. Thank you. So, Haris, thanks so much. Before we go, where can people find out more about you and about the business?

Haris Pylarinos
On our website, it's the number 1 place, Hackthebox.com, and for me, it's LinkedIn. Perfect. Great. Well, again, thanks so much, Harris. It's been a great pleasure and look forward to following your journey in the future. Thank you.

Haris Pylarinos
Goodbye. Thank you very much.

Richard Medcalf
Well, that's a wrap. If you received value from this conversation, please do leave us a review on your favorite podcast platform. We deeply appreciate it. And if you'd like to check out the show notes from this episode, head to xquadrant.com slash podcast where you'll find all the details. Now, finally, when you're in top leadership, who supports and challenges you at a deep level to help you multiply your impact? Discover more about the different ways we can support you at xquadrant.com.