Stacklok Insight is a free-to-use web app that provides data and scoring on the supply chain risk for open source packages.
Culture is the ‘operating system’ of a company.
If you asked me what my job (CEO) was at Stacklok, I would summarize it as three things: #1 define and live the culture of the company, #2 hire and engage strong leaders who embody that culture, #3 work with those leaders to create and execute a strategy that will drive disproportionate value in the world. Of those three things, #1 - Culture setting is arguably the most important and least understood.
As a new company, people are undoubtedly wondering about Stacklok, who we are, and what we do. Starting with the culture is a good way to explain how we look at the world. It is also worth recognizing that we see culture as a living thing that will adapt and grow with us. We see it as a process of ‘intelligent evolution’. Start with the best design we can, but recognize that there will be oversights and bugs and that we will have to adapt and adjust our culture over time.
Without future ado, here are the five key ‘virtues’ that we believe define Stacklok as a company. I have tried to not only explain what we stand for, but tie it back to my own lived experiences and why I believe it really matters. FWIW, we like the word ‘virtue’ vs. ‘value’. In our minds a value can be a somewhat abstract and intellectual concept, whereas a virtue is something that you live and demonstrate every day that speaks to your character.
We are the tide that lifts each other up. We seek out the strengths in ourselves and one another and rely on those strengths to balance our mutual shortcomings. We go to extreme lengths to treat each other fairly. No one is lifted up by pushing someone down.
I have worked on a lot of different teams, some of which were amazing and introduced some truly disruptive capabilities to the world. Looking at something like the Kubernetes project, we had star-quality talent. Each of the individuals would be a star on any team, but the thing that truly made Kubernetes shine was the fact that the individuals on the team had non-overlapping superpowers. They worked in an environment that lets them bring those superpowers to bear. Joe’s design acumen, Brendan’s creative genius, Brian’s attention to detail, Tim’s pragmatic wisdom, Clayton’s dedication and focus, Kelsey’s charisma, and Sarah’s genius-level EQ. The team was strong not simply because it had people with superpowers, but because it found a way to unlock individuals’ use of their superpowers. This can only happen if you start from a position of fundamental respect for others and work incredibly hard to create a sense that the success of an individual is a success for the team. It is a shared fate system.
We are missionaries, not mercenaries. We believe that the good work we do has the potential to make the world a fundamentally safer place for our loved ones. We do hard things because they need to be done.
When my older kids were little, I would take them on rustic ‘adventures’ in the backcountry of Washington. We had a saying: ‘discomfort is the price of adventure’. Startups are an adventure, and adventures are uncomfortable. Curiously the root of this discomfort isn’t intensity - you can find that anywhere, and smart founders will push their teams but not burn them out. The root of discomfort is, often as not, change. A growing startup is in a constant state of flux - every day, it is a new place with new faces and new challenges. The sheer rate of change isn’t comfortable for a lot of people. With that in mind it is critical that the people that embark on that adventure share a vision for the future and truly believe in what is being built. To be able to relish the adventure, you do need to be able to see through the discomfort of a fast-growing and fast-changing environment and engage with the mission.
In the case of Stacklok, I truly believe in the mission. I do not want to live in a world where a self-driving car’s pedestrian avoidance system suddenly becomes a pedestrian-seeking function globally at a certain time of day in certain geographies because state-sponsored villains got into someone’s control system through their supply chain. I believe in our mission and am willing to pursue it to exhaustion. Everyone who joins the company needs to see it for what it is: an opportunity to create unique value in the world and to personally benefit from that value creation. But from experience, there is no comfortable path to great success.
When we succeed, we look out and see the contributions of others. When we struggle, we look in and find the strength to own our mistakes, to learn from them, and to do better tomorrow. We are restless in our desire to improve.
Why does this matter? When I met my co-founder Luke, words from a management book I read a long time ago came to my mind. ‘This is a level 5 leader’. The book was ‘Good to Great’ (well worth reading if you haven’t), and it described a unique kind of invisible leader. Luke is a very humble guy, but I have not often met his kind in terms of fundamental relentlessness. He runs hundreds of miles through the mountains in winter for fun. You have to be a special kind of person who has a peculiar relationship with pain to do that. Reflecting back on the Kubernetes experience, one of the most singular things about that team is that no one seemed willing to take much credit for the success of the project, and no one was willing to give up on it either. Sit down with any of the people, and they will likely tell you how wonderful the other people were and generally dismiss their own contributions.
We are curious by nature and believe in the power of experimentation and incremental improvement. We don't let emotions or ego get in the way of learning. We seek to understand the fundamentals of things. We share data openly and unemotionally. We accept feedback as the gift it is.
There has been much written on ‘growth mindset’ that does not bear repeating here, but it does matter. If the concept is new to you, you owe it to yourself to go read about it.
There is a deeper point that is worth pushing on. To create an environment where people can truly unlock their potential, you have to take charisma off the table. Charisma is a superpower, and if faced with a choice of my kids having charisma or not, I would rather they have charisma - it makes things easier. The problem is that I haven’t noticed a specific correlation between charisma and being right. The two attributes seem more or less normally distributed. You will encounter the occasional Steve Jobs who is five standard deviations out on both, but that is the exception, not the rule.
Being deliberate about making data-centric decisions is critical to level the playing field. Leveling the playing field is important from a DEI perspective. Not just because building an inclusive environment is the right thing to do, but because it is the smart thing to do. One way to do this is through the formal use of written communications versus presentations. When faced with a tough choice, I would rather read a document than sit through a PowerPoint presentation delivered by a gifted orator. At the end of the day, the thing that matters most is the quality of the decision, and the best decisions should be made based on a cool assessment of the facts.
Our work is security, and it is good work worth doing. We won't ever forget that there are people who mean badly trying to stop us from protecting our community and our customers. We will stand vigilant. We aren't militaristic by nature, but we are vigilant by necessity.
Self evidently, we are a security company. Luke has been in the security space for quite a while, but this is new territory for me. While I have shipped products where security matters (when doesn’t it?) I have to constantly remind myself that we are sailing in waters in which ‘there are dragons’. Constantly reminding myself and our team of who we are, and what we face will be critical to our ability to perform our mission for our customers. I believe that open source will help in many regards, as will the judicious use of AI/ML, but this bears keeping front-of-mind at all times.
At Stacklok, we take culture seriously, and so should you. If you are an entrepreneur, you owe it to yourself to get serious about defining and living your culture. If you are a talented employee, you owe it to yourself to hold your management accountable to living a culture that resonates with you.
We are hiring! If this feels like the type of environment that you would enjoy working in, and if our mission aligns with your passions, please do take a look at our open positions.
I took time to explain the company through the lens of our culture, but there is a lot more to be said on how we got here, and how we live this work. Depending on how things go I will look at writing more on cultural ‘intelligent evolution’, living culture, and related topics.
Craig McLuckie
CEO
Craig McLuckie is Stacklok's CEO and the co-creator of the open source project Kubernetes.