From Naval Cryptology to Cybersecurity Founder With Vincent Scott
Vincent Scott, founder of Defense Cybersecurity Group, is our guest in this edition of our Founder Spotlight Series.
Vincent spent years as a US Navy officer, including combat operations in the First Gulf War and a career in the Navy's cryptologic community, where the job was breaking into other people's information.
Today he runs Defense Cybersecurity Group, a 15-person firm that helps defense contractors meet their Department of Defense cybersecurity requirements, and by his count it's his seventh company.
I sat down with him for the podcast to talk about how a naval officer thinks about building a business, why he believes the security industry spends its effort in the wrong place, and the win he's proudest of. His answers are lightly edited for length and clarity.
The conversation
You came to cybersecurity through the Navy. How did you get from there to running your own company?
I'm an early computer science graduate from the US Naval Academy. In the late '80s, computer science was just becoming a thing. I went to sea for six years, including combat operations in the first Gulf War, and then on my shore duty I fell into the clutches of the National Security Agency and transferred into the Navy's cryptologic community.
People hear cryptology and think about protecting information. I had nothing to do with protecting information. It was all about breaking into other people's information and using it against them.
Entrepreneurship wasn't anticipated. I came to the conclusion that the way to security and taking care of my family was not working for somebody else, so I started to very deliberately move in that direction, reading books and learning before I started my first company.
Counting the not-for-profits and a little property management business my wife ran, I'm probably on my seventh. Defense Cyber Security Group is the main one, and the most successful.
Where does the company name come from?
At the end of World War II, the Navy was fighting internally over who would own codebreaking. Communications wanted it, operations wanted it, intelligence wanted it.
So they created a new command called the Naval Security Group, a political compromise, and its radio message tag was NAVSECGROUP. Defense Cyber Security Group is a play on that name, and so is my website address.
What does DCG do, and who are your clients?
We help companies in the defense industrial base meet their contractual requirements for cybersecurity. For 10 or 15 years, there was a clause in government contracts, buried among about 100 others, that technically required all of this, and nobody asked about it.
Now the government is checking people's homework, with government auditors and commercial companies certified to audit. We're not an audit company, although I'm personally one of the 500 lead auditors in the country, and one of 30 certified instructors.
Most of what we do is help companies get ready for those audits, both as consultants and through a compliant IT practice. Our largest client is a $25 billion-a-year company, and our smallest has fewer than 10 people.
We work with a company that does rolled aluminum, which doesn't sound exciting until you learn it goes into some really interesting weapon systems, and with universities doing R&D for the government. We're 15 people today. We were six years old in April, so we're beyond the new-start phase, but we're still growing.
You say detection is the most undervalued skill in cybersecurity. Why?
Everybody spends a ton of time on prevention. Probably 80% of the effort goes there, and we know prevention is gonna fail. Maybe another 15% goes to response, and detection is maybe 1% of what's left. I think that's enormously wrong. Most hacking tries to not be found, rather than rub your nose in it. I've even seen hackers go in and patch systems so somebody else can't use the same exploits.
Culturally, cybersecurity people came up through IT or through governance, risk and compliance. Neither one really wants to know they've been hacked, and the executives feel the same way. We don't wanna know that we've been hacked.
I think about it as a Navy concept: the combat information center, where all the information comes together. All too often companies buy the sonar, the radar, the missile systems, and then nobody's manning the combat information center.
We spent money on the kit, and we did not adequately fund the people we need to make that kit actually defend our organization. It's like a ship sitting at the pier with all the sailors on liberty. We gotta treat this like an operation, and focus on detection first, because I cannot respond to what I do not detect.
What is DCG building next, and how does AI change the picture?
Much more recently, we added IT services, because customers kept saying, "Stop trying to train us to do this and just do this for us." We've also built our own internal AI, focused on the compliance side, which we may productize.
And we're doing what I call military-grade cybersecurity virtual desktops, where none of the data flows to your endpoint device. Bad guys could hack your iPad or your laptop all day long and it won't give them access to the data.
The next thing we're working on, which I think is the future of cybersecurity, is AI cyber defensive agents. Over the last nine months, AI offense has exploded. We're seeing AI agents attacking companies directly, inventing new zero-days on the fly.
I think the only way to address a cyber offense agent is with a cyber defense agent, working at machine speed. The defensive bot needs a very strong detection capability. Even if it can't win the fight, it can sure shoot flares and get people involved that can help us.
How did you get your first ten customers?
Really, I'm not naturally a sales and marketing person. But we took a couple of decisions early. One, build my brand around my personal experience. Two, go heavily into LinkedIn, not X or Facebook, because the professional community I wanted to reach was primarily there. I think about it as planting seeds. You talk to a person, and maybe two years later they come back and say, "Now I think I really need help." It's not even a direct sales channel. Conferences helped too, but LinkedIn was really the key.
Early on we were a subcontractor. We'd established the brand, and somebody with a bigger project would say, "Vince, could you subcontract to me on this?"
The catch is that when you're selling and delivering, you end up with a sine wave. Marketing brings in clients, delivering to them leaves no time for marketing, and then you're struggling with payroll because you didn't sell enough work over the last three months. The way to break it is dedicated sales resources. I'm a huge believer in surrounding myself with people who are smarter than I am in their area.
What's been your biggest challenge?
Business operations. You start as an army of one and you do everything. I chose not to have partners. I'm a believer in unity of command, and partnerships can slow you down and create rifts. The best thing you can do is make the right decision, the next best thing is make the wrong decision, and the worst thing you can do is not make a decision at all.
But growing from me doing it all to bringing on employees means more training, more structure for people delivering to clients, invoicing, and pushing pieces off my plate. I don't know that it's overcome completely. There's only 168 hours in every week, and I have to sleep some of them.
I also try to hire and train young people. I tell them, "In two years, you can be an expert, because what came before that is probably old think," because this industry changes at the speed of information technology. Though old age and cunning will overcome youth and enthusiasm, and some fundamentals, like how people behave, don't change.
And your biggest win?
Healthcare for my employees. It's not about money I bring in or the biggest client we sign. It's about taking care of my people. I want to build this company to take care of my family, the employees of our company, and our customers, kind of in that order.
Mississippi is the poorest state in the union, so not famous for its tech hub environment, but we have some really great young people and universities down here. One of the people I hired had been mowing lawns for a year with a cybersecurity degree. I want to give those kids more opportunities. But it's terrifying too. I'm worried about letting them down, and we gotta have cash flow to make that work.
What can your customers expect over the next five years?
One is expertise. Everybody hangs an expert sign out their window, and most of them aren't. We're super deep in DOD cybersecurity requirements, and I think we're one of a handful of real expert organizations. The other is that we're expanding into a more full-service security company, not only a compliance company in the DOD space: other commercial clients who need a high grade of cybersecurity, and more standard commercial offerings like a security operations center.
What's the one takeaway you'd leave readers with?
If you think hiring a professional is expensive, try hiring an amateur. That's reportedly from Red Adair, the famous firefighter, and I think it's very true in this space. Clients are told they need to buy very expensive tools and change their entire way of doing business, and then they find out they're still not meeting the requirements, because the people giving them advice didn't have that real expertise.
Closing thoughts
Vincent's answers keep returning to a few ideas he learned in uniform: be clear about who is in command, treat security as an operation rather than a purchase, and surround yourself with people who know more than you do. Thank you to Vincent for his time and candor. If you're building in cybersecurity, here's what to take away:
Detection is the most undervalued skill in cyber. By his estimate, about 1% of security effort goes to it.
Tools don't defend; people do. Fund the people who operate the kit.
LinkedIn, a personal brand and patience won his first ten customers.
Hire people smarter than you in their area, and hire experts, not amateurs.
Want more conversations with founders?
Follow Vincent on LinkedIn and learn more at cybersecgru.com
