Cylance is Stuart McClure’s cybersecurity yesterday. ShiftLeft Inc. is the OC innovator’s future.
McClure co-founded Cylance, the Irvine-based internet security company, a decade ago and sold it in 2019 to Canada-based BlackBerry for $1.4 billion.
He later served as president of BlackBerry Cylance—now called BlackBerry Cybersecurity—for about eight months after the sale and then was self-employed with a company called Silent Shadow.
Now, the 53-year-old Newport Beach resident has joined Santa Clara-based cybersecurity company ShiftLeft as chief executive. The Aug. 2 announcement from the application security firm trumpeted McClure as a “cybersecurity visionary” as he seeks to expand his new company’s offerings.
McClure, long among Orange County’s more prominent tech execs, counts three decades in the cybersecurity field during which he’s authored “Hacking Exposed,” a best-selling IT security book, and much earlier in his career was a founding team member of the cybersecurity practice at Ernst & Young.
McClure, a 2016 Business Journal Innovator of the Year award winner, will stay in OC as head of ShiftLeft, which emphasizes early implementation of cybersecurity in the code development process (see story, this page).
McClure says that code—the basic building blocks and instructions that tell applications, operating systems, servers and networks how to operate—is the source of the cybersecurity problem and the key to the solution.
“We started to realize that 100% of all cybersecurity threats—the things that an adversary takes advantage of—begins and ends with source code,” McClure told the Business Journal on Aug. 11.
ShiftLeft was founded in 2016 as the first code security platform that analyzes software apps from an attacker’s viewpoint, according to the firm.
In May, the company said it received an additional $29 million in funding from cybersecurity-focused investor SYN Ventures, Blackstone Innovations Investments and existing investors. Reports at the time put the company’s total funding at over $58 million.
The following month, ShiftLeft announced an investment from Wipro Ventures, the strategic investment arm of Indian IT firm Wipro Ltd. (NYSE: WIT).
“I have been waiting almost 30 years to shift the entire discussion left and take prevention to the root cause of cybersecurity vulnerabilities: source code,” McClure said in a statement announcing his appointment. “ShiftLeft is set up for success.”
McClure’s entry into the cybersecurity world began following a tragic airplane flight he was on more than three decades ago.
In February 1989, the door of a Boeing 747 flying from Honolulu to Sydney, burst open mid-flight, tearing a 20 by 40-foot hole in the side of the plane, killing nine passengers.
The jumbo jet returned to Honolulu and made an emergency landing.
It was the day he found his purpose, McClure told a University of California, Irvine business school graduating class of 2019.
McClure went on to pioneer the use of mathematics, artificial intelligence, machine learning and data science in his cybersecurity work at Cylance.
“I knew I had to find a purpose that was bigger and beyond me of preventing catastrophe. And in my place, it was cyber. It was cybersecurity and it was using AI to do it, and machine learning,” McClure said.
ShiftLeft’s emphasis on cybersecurity at the code level aims to enable developers and application security teams to prevent cyberattacks.
This strategy could help employers prevent hacking attempts—such as emails with fraudulent links sent to staff members.
Cybersecurity dangers also include ransomware attacks demanding money and thefts of credit card information leading to fraudulent purchases, for example.
“The operating system itself should not allow for these malicious actions to take place,” McClure said. Preventing the problems is “down at the code level.”
Bad actors in the cyber world range from young troublemakers to dangerous, sophisticated teams in Russia and North Korea.
He calls young “ankle-biters” a nuisance, yet “they’re a real threat when it comes to quantity,” while top concerns are nation states and professional teams.
“They can be in a system or network, and you’ll never see them. They can do incredible damage over a long period of time,” McClure said.
“What do I worry about at night? It’s the nation state stuff.”
Threats can also come from individuals planted within a firm to target a specific company.
“It’s come across my screen for 25 or 30 years now,” he says. “Even at my earliest days at Ernst & Young, we’d get called in to all sorts of insider threats, people that had been planted inside organizations.”
McClure plans to turn ShiftLeft into an industry leader, a challenge in the vast and fragmented cybersecurity field.
“I do see this as a very big play potentially. But we’ve got a lot of work to do. We’ve got to really elevate the message.”
McClure Looks Local
ShiftLeft Inc. is based in Silicon Valley, but the company’s new CEO Stuart McClure plans to remain in Orange County, where he is on the lookout for cybersecurity talent.
“I’m working out of Orange County,” said McClure, who has lived in Newport Beach for about a dozen years.
He spoke to the Business Journal from the Black Hat information security convention in Las Vegas earlier this month.
“We’re very open on location” when it comes to ShiftLeft’s hiring efforts, McClure said.
“We really follow the talent. And if the talent’s in OC, we’ll be absolutely hiring down there.”
He believes there to be a strong base of skilled, front-line workers in Orange County, including developers and data scientists.
The more challenging headwind is filling vice president and above levels requiring “seasoned executives.”
At Cylance and an earlier job in OC, when he was looking for vice presidents, “I’ve either had to really develop them internally into that broad leadership role or I’ve had to hire from outside of Orange County.”
In a Leader Board published last month in the Business Journal, McClure and world-renowned artificial intelligence and technology expert Stephen Ibaraki said in order to achieve “long-term economic success, Orange County needs to stake its claim in the digital economy and emerging tech.”
“If we want OC to gain a larger share, we need to build out a tech hub—and our focus should be artificial intelligence (AI),” the two wrote.
Experts predict AI will be worth $15.7 trillion to the global economy by 2030. The United States has been a global leader in the research, commercialization and use of AI.
“There will also be a need for talent to support the infrastructure of AI, including cloud computing and cybersecurity,” McClure and Ibaraki said.