· Dug Song, Jon Oberheide

Dug Song & Jon Oberheide: How Duo Security Went Zero to $1B ARR in Ann Arbor

Duo Security reached $100M ARR on only ~$14M burned by designing security for end users, selling down-market where non-consumption was the real TAM, and building capital-efficiently outside Silicon Valley in Ann Arbor to win a talent-density and culture advantage.

capital-efficiencycybersecurityproduct-led-growthgo-to-marketculturegeographyacquisitionfounder-partnership0% confidence

Why this is in the corpus

A canonical capital-efficient scaling case ($14M burn to $100M ARR, $2.35B Cisco exit, $1B+ ARR today) with two operators covering GTM, product-led wedge, culture, geography-as-moat, and acquisition integration.

Summary for skimmers

Dug Song and Jon Oberheide built Duo Security in Ann Arbor, flipping cybersecurity to design for end users, starting down-market to solve non-consumption, staying capital-efficient, and selling to Cisco for $2.35B.

Briefing

What survives the editorial filter

This page should feel like a smart colleague already listened for you and left only the operating logic worth keeping. Not everything said in the episode makes it through.

Trust signal

Direct episode extraction

Best used for

Decision-grade retrieval metadata not yet added for this episode.

Hold lightly

No explicit downgrade reason stored yet for this episode.

Principles

Durable claims that survive beyond the speaker's biography — each with explicit limits, transferability judgment, and evidence.

Principle

Make security easier, not harder

Reduce friction to increase real security adoption.

Duo inverted the industry default of hurdle-based security, betting that easier tools get used and therefore protect more.

Measure security by adoption, not by how many hurdles you impose.

“we make, we do it by making secure, making it easier to do things, not harder. We we most secure is really about putting hurdles and front of people to jump through.”Dug Song

Principle

Have some Silicon Valley in you without being in Silicon Valley

Import the Valleys network and ambition without paying its location tax.

Duo chose Valley-connected investors (True, Google Ventures, Benchmark) to inject perspective while keeping operations in Ann Arbor.

Buy the Valleys network through your cap table, not your zip code.

“we need to have a little bit of Silicon Valley in us, but we, we do not need to be in Silicon Valley.”Dug Song

Principle

Maintain optionality; do not paint yourself into a corner

Do not maximize every round; preserve future optionality.

Duo took reasonable valuations (1-on-4, 5-on-20) rather than pushing marks that could box them in later.

Optimize rounds for future flexibility, not for the peak headline number.

“we could have pushed for higher valuations and less dilution, but we did not wanna paint ourselves into a corner.”Jon Oberheide

Principle

Get big before you get loud

Prove the business quietly before you make noise about it.

Being outside the Valley let Duo stay under the radar and build metrics before publicizing, avoiding distraction and early competition.

Delay the PR until the metrics can carry it.

“we could really, as Doug would say, get big before we got loud. Like prove out the business, show our metrics before making a big deal about it externally, we were a little under the radar.”Jon Oberheide

Principle

The idea is not the moat; execution is

Defensibility comes from execution of GTM and product experience, not from the idea.

Duo built on a decades-old commodity idea (MFA) and won on delivery, design, and go-to-market rather than novelty.

Stop guarding the idea; invest in the execution stack competitors cannot copy.

“it is not about the idea. It is about can you actually build and execute, again, a a go-to market motion build kind of an onboarding build the kind of product experience that leads those customers to be successful”Dug Song

Principle

Push decision-making to those closest to the work

Decisions belong with the people closest to the context, not up the chain.

Duo pushed decision rights down so ICs and managers acted as owners, and treated an appeal to authority as toxic.

Design your org so the closest-to-the-work person owns the call.

“We wanted people closest to the work making those decisions.”Jon Oberheide

Principle

Never delegate product, culture, or brand

Delegate broadly but keep product, culture, and brand as founder-owned.

Duo drew a hard line: obsolete yourself everywhere except product strategy, culture, and brand.

Name the few things you will never delegate and delegate the rest aggressively.

“Doug would always say, never gonna delegate, you know, product, culture or brand, you know, the product strategy of what we are building, the culture of what we are trying to build internally as a team. And the brand is kind of that external promise to customers.”Jon Oberheide

Principle

Hire outside the domain to get first-principles thinking

Hiring outside your category avoids importing the incumbents blind spots.

Duo deliberately avoided hiring from Symantec and McAfee so that new hires would rebuild security from customer-facing first principles.

When flipping a category, hire for product judgment over domain tenure.

“Instead we are like, let us hire people with a blank slate that are not, you know, disillusioned by decades of the cybersecurity space like we had been. And guess what? They are gonna come at it from first principles.”Jon Oberheide

Principle

Design for the end user, not the buyer

Design for whoever touches the product daily, even when a different persona pays.

Duo treated ordinary employees who just want to log in as the true customer, which made the product loved and therefore easier to expand upmarket.

Identify who actually touches your product every day and design for them.

“it is not for the CIS admin or the security director, it is for the people that just wanna log in and be productive.”Jon Oberheide

Principle

Founder mode is owning the soul of the business, not a 996 work style

Founder mode is about holding the why of the company, not about hours or control.

Dug reframed founder mode away from behavioral intensity toward being the soul and master of the business.

Debate founder mode as who holds the why, not who works the most.

“for me it is always been more about like, you know, versus the master of the business, the soul of the business. That is, that is what cannot be replaced, right? When founders move on very hard to sort of recenter and, and kind of root the company.”Dug Song

Principle

Prefer reluctant leadership

Self-doubting, humble leaders keep the company self-correcting.

Dug openly asked the board to replace him if underperforming, an attitude the board and Jon considered healthy for the company.

Treat a leaders humility and self-questioning as a positive signal.

“I prefer sort of reluctant leadership, right? Yeah. Like it is, you know, it is a hard job. It is a thankless, it is a terrible job, frankly.”Dug Song

Principle

Security engineering and design engineering are two sides of the same coin

Good security is achieved by making the right thing the default, not by adding friction.

Duo rejected the industry premise that design says yes and security says no, and instead engineered defaults where the secure action was also the frictionless one.

Stop treating security and UX as a tradeoff; engineer the secure option to be the easy one.

“security engineering and design engineering are just two sides of the same coin. How do you make the Right, right. Things happen by default”Dug Song

Principle

Truly valuable products reshape or create their market

If your product is truly new, the existing TAM understates it because you are reshaping the market.

Duos TAM slide showed ~$2B, smaller than its eventual sale price, because the real market was the non-consuming SMB it created.

Judge new markets by the reshaping thesis, not a spreadsheet TAM.

“if you are building something really of value, you are either reshaping or you are creating their market for it in some way. Right? There is, there is, there is, you know, it is, it is inevitable If you are, if you are doing something that is really different than no one has done before”Dug Song

Principle

Turn where you are into an unfair advantage

Extract a structural advantage from your specific location instead of relocating to the default hub.

Duo mined Ann Arbors research talent, low costs, and loyalty as an edge rather than defaulting to Silicon Valley.

Audit what is uniquely available where you are and build your advantage on it.

“There is something strategic about any place that you will be. Right. Whether you know how to tap into it or not, and make the most of that. And that is your job as an entrepreneur, right. Take the best of what is around you and really you, the alchemy of turning that into some, some unfair advantage”Dug Song

Frameworks

Reusable systems and operating models — including when they help and when they break.

Framework

Build the power tool a three-year-old can use

Force radical simplicity by designing for your least sophisticated user.

Starting with customers like a coffee shop or a doctors office forced Duo to hide sophisticated tech behind a trivially simple experience that also delighted Facebook.

Use your least sophisticated segment as the design constraint that yields universal usability.

“how do you build power tools that your 3-year-old can use, you know, like it has to, has to work, it has to be let know, sophisticated, but like, you know, the kids gotta be able to use it.”Jon Oberheide

Framework

Solve for non-consumption, not the existing TAM

Target the people who cannot consume the category today, and design to convert them.

Duos real market was every SMB, clinic, and university that got attacked but had no product simple enough to deploy, invisible to RSA-based TAM math.

Ask who is being attacked or underserved but structurally cannot buy, then design for them.

“the actual problem solving was the non-consumption of security.”Dug Song

Framework

Three ways an acquisition integration can go

Acquisition integration goes one of three ways, and the true-integration third way requires deliberate people investment.

Duo rejected both assimilation and isolated-BU independence, investing heavily in leader-to-leader embedding to build a shared third way inside Cisco.

Plan post-acquisition for a true integration and staff it with heavy leader-to-leader time.

“there is kind of three ways that goes. It is either sometimes, sometimes their way right as you are assimilated into the Borg, sometimes it is your way where you are so peculiar that, you know, they do not know what to do with you and you sort of stay independent business unit... And then some of the third way, which is what we really pursued, which is it is, it is truly an integration”Dug Song

Framework

Match talent to stage: zero-to-one builders vs scale operators

Sort people by the stage they thrive in and redeploy zero-to-one builders onto new initiatives rather than forcing them to scale.

Duo sent zero-to-one builder Patrick to open new regions and offices instead of expecting early hires to become scale operators.

Assess whether a role needs a builder or an operator, then place people by stage-fit.

“often, you know, startup folks are who are really happy dealing with the chaos. So we are gonna start, you know, the journeys, they are great at that stage, but not great as, as operators, right? Just doing incremental stuff or optimizing later”Dug Song

Signals

What appears to be shifting, for whom it matters, and what happens if you ignore it.

Signal

The growth bar has inflated: T3D2 is now considered slow

AI-era growth expectations have inflated to the point that Duos historically elite trajectory now reads as slow.

Jon notes VCs now expect zero-to-100 in under 12 months, making Duos T3D2 look quaint and pressuring founders toward heavier burn.

Recognize the inflated growth bar as a narrative, and weigh efficiency against the pressure to blitzscale.

“even now that is like a T 3D two is like, oh, that is, that is cute in the world of, you know, AI going through like VCs will like get on and be like, I I triple every month. Yeah. If you have not gone from zero to a hundred in less than 12 months and you are not a real company anymore.”Jon Oberheide

Signal

Re-industrialization is pulling hard-tech companies to Michigan

Hard-tech and re-industrial startups will increasingly cluster where factory infrastructure and manufacturing talent already exist.

Dug observes re-industrial companies actively fighting to come to Michigan for its abundant factories and manufacturing talent.

If you build hardware, weigh regions with existing factory infrastructure and talent.

“there is a whole category of them that are all fighting to sort of come here, which are all the re industrial companies, right. All the, anyone building anything that needs a factory, they come here like, oh my God, like you have factories come outta your ears and, and, and you have the talent for it more importantly.”Dug Song

Opportunities

Only included where there is a buyer, a real wedge, and a plausible revenue path — not vague idea theater.

Opportunity

SMB and mid-market security was a wide-open non-consumption gap

An underserved SMB/mid-market segment being attacked with no fit-for-purpose product is a market-creation opportunity.

Duo saw that RSA-defined TAM ignored the whole SMB and mid-market that was being attacked yet had no deployable product.

Look for segments with real pain and budgets that no existing product is designed to serve.

“all the, you know, traditional early stage startup TAM calculations are, are nonsensical because the TAM that existed was like mostly RSA and it was mostly large enterprise customers and did not take into account that this need existed throughout the entire sort of spectrum of SMB mid-market enterprise.”Jon Oberheide

Opportunity

University research commercialization is an under-tapped deep-tech pipeline

University research pipelines hold under-commercialized deep tech that first-look programs can capture ahead of the coasts.

Jon points to scout programs and incubators forming around universities to tap an underexplored research-commercialization pipeline.

Build first-look access to university research commercialization, especially outside coastal hubs.

“There is more like scout programs and sort of incubators that are being set up, particularly around university where there is so much like untapped pipeline that it is not maybe fully exploring, like research commercialization.”Jon Oberheide

Lessons still worth keeping

Useful takeaways that did not fully clear the bar for durable principle status.

Lesson

Following investors to Waltham built a business but a painful culture

Moving a company to please investors can produce a successful business but a culture no one wants.

At Arbor Networks the founders followed Battery Ventures to Waltham, producing a painful culture Dug fled first, which shaped Duos decision to stay put.

Weigh cultural cost, not just capital, before moving your company for investors.

“the one mistake we made was that we, we decided that we would follow our investors to Boston for a company called Arbor Networks after Ann Arbor... we built a business that was successful, but a culture that was so painful that even I did not wanna be part of it and I was the first one to leave my day job.”Dug Song

Lesson

EMEA expansion stalled without culture and institutional-knowledge transfer

New regions need transplanted culture-carriers, not just local hires.

Duos EMEA teams had no Duo experience or connection, and the region ramped far slower than the 200-300% growth of the core business.

Seed every new region with experienced culture-carriers before scaling local hires.

“the culture and institutional knowledge transfer is so huge. And I think that is a place where we, we missed, we spun up teams in EMEA that had no experience with Duo, no connection. You are literally across the ocean.”Jon Oberheide

Lesson

Legal removed the EULA click-through to improve the user experience

A customer-obsessed culture makes even legal optimize for user experience.

Duos legal team removed the mobile EULA click-through because it was unenforceable and hurt UX, an unusually customer-centric move for a legal function.

Spread customer empathy until even legal and finance optimize the user journey.

“our legal team was like, we should remove that from the mobile app. And the engineering team was like, why?... Legal team is like, well first of all, these like, click grab agreements are not actually enforceable. And it makes the user experience painful.”Jon Oberheide

Lesson

Architecture, not the idea, gave a six-year lead over RSA

Incumbent architectural and process lock-in, not idea secrecy, is what buys a startup years of lead.

Duo expected a six-month head start on the copyable app; RSA took six years and still lagged because legacy systems could not adapt.

Bet your lead on incumbents structural inertia, not on keeping the idea secret.

“it took RSA, which is our primary competitor at the time, it took them like six years to build an equivalent app. And it was still a way worse experience. They are locked into legacy architectures and just business processes that, that could not adapt.”Jon Oberheide

The Plays

Try these this week

Verb-first executable actions — each one tied to a stated outcome in the episode.

Hire blank-slate talent from outside the domain to force first-principles product

Outcome: To build a different company, hire people who have not been marinated in the old one.

Context: Hiring from Symantec/McAfee would have reproduced "the same shitty company those companies were." Instead Duo hired outside cybersecurity -- security is learnable, product sense is not. The founders cite Christina from Vanta (a Dropbox PM) as proof: judge whether someone is a good product person, not whether they are a quantum-cryptography expert.

“let's hire people with a blank slate that aren't, you know, disillusioned by decades of the cybersecurity space like we had been. And guess what? They're gonna come at it from first principles.”
— Jon Oberheide
From founding through scale per
  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  6. 6

  7. 7

Scripts

Before you start

  • · Founders who hold the domain depth themselves
  • · A market whose incumbents are stagnant and assumption-bound
  • · Willingness to teach the domain internally

Get big before you get loud: keep the geographic edge secret and prove metrics first

Outcome: Prove the business quietly before you advertise it; protect the source of your edge.

Context: Michigan was Duo's "secret weapon" and they kept it secret. Outside Valley noise they hired whoever they wanted in engineering, rarely competing for talent, while a $400k median Ann Arbor home vs a Mountain View ranch created real comparative advantage. They proved metrics before making external noise.

“we could really, as Doug would say, get big before we got loud. Like prove out the business, show our metrics before making a big deal about it externally, we were a little under the radar.”
— Jon Oberheide
From founding until metrics are undeniable per
  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  6. 6

  7. 7

Scripts

Before you start

  • · A genuine structural advantage worth protecting
  • · Discipline to resist Valley visibility theater
  • · Capital efficiency that removes the need for hype-driven fundraising

Wedge into non-consumption by launching self-serve, credit-card SaaS down-market first

Outcome: Start where incumbents refuse to go (SMB/VSB), sell self-serve, then move up-market.

Context: Duo inverted the security 101 playbook of three enterprise AEs selling to banks. They let customers sign up off the website, plug in a credit card, and deploy without a sales rep -- new to security even though common in SaaS. The North Star was who they wanted to serve (mid-market and SMB) because that is where attackers were operating and where no vendor had innovated.

“we were starting down market with VSB and SMB, and we're gonna work our way up over time with product maturity”
— Jon Oberheide
Multi-year climb from launch (2010) to $100M ARR per
  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  6. 6

  7. 7

Scripts

Before you start

  • · Cloud-delivered architecture
  • · A product simple enough for a three-year-old to use
  • · Consumerized SaaS procurement expectations in the market

Deputize the entire user base as fraud sensors with a one-tap reject

Outcome: Make the reject button a security signal: every user becomes a monitor.

Context: Duo's app sends a push with a green (approve) and red (reject) button. Tapping "not me" produces positive fraud signal. In the SolarWinds intrusion, attackers moving laterally into Mandiant (a Duo customer) hit a Duo-protected account, which set off red flags, let Mandiant catch the intruder, and traced back to the SolarWinds backdoor -- uncovering a worldwide compromise.

“you could report fraud, right? If it wasn't you logging in, it's like, no, that's not me. That becomes positive signal, right? To a security team saying like, actually wait a second. Like our, our entire user base was basically been deputized, right?”
— Dug Song
Real-time per login per
  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  6. 6

  7. 7

Scripts

Before you start

  • · Mobile push-based authentication
  • · Full inventory/visibility of devices and logins
  • · A feedback loop into the customer's security operations

Run open-book board reports (plans, progress, problems) shared with the whole company

Outcome: Write a plans/progress/problems memo each cycle and share it with board and staff alike.

Context: Before every board meeting each VP wrote 3-5 paragraphs of plans, progress, and problems plus a preamble on the business story; it went to the board for calibration and to the entire company. Board meetings then focused on 2-3 strategic topics rather than a weather report, and even engineers asked sharp SaaS-metric questions (e.g., why the CAC ratio moved) because they had the context.

“every one of our, you know, VPs would write three to five paragraphs of plans, progress and problems of their function... And so they all knew kind of how we were investing for the money, where our growth was coming from, what our big bets were and why.”
— Dug Song
Recurring per board meeting / mid-quarter call per
  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  6. 6

  7. 7

Scripts

Before you start

  • · A culture comfortable with radical transparency
  • · Trust that shared financials will not leak destructively
  • · Leaders willing to be questioned by ICs

The Duo pizza play: buy credibility by helping a CISO mid-breach instead of pitching

Outcome: When a prospect is in a breach, send help (pizza + energy drinks), not a pitch.

Context: Every rival BDR finds the CISO cell number during a breach and says the sale would have prevented it. Duo instead sent pizza and a card ("give us a call when you come up for air"). Responders know they will be pulling all-nighters -- one employee bought a sleeping bag from Home Depot on hearing of a breach -- so the gesture lands as the first genuinely positive vendor interaction in a crisis.

“One of our sales plays was we would send pizza to the company hq. We just order pizzas. Maybe some like Red Bull or Five Hour Energy and say like, with a card that's like, so sorry, this is happening. I hope this is helpful. You know, give us a call when you come up for air.”
— Jon Oberheide
Same-day response during the active incident window per
  1. 1

  2. 2

  3. 3

  4. 4

  5. 5

  6. 6

  7. 7

Scripts

Before you start

  • · Genuine understanding of the responder's situation (all-nighters, PR pressure)
  • · A brand willing to invest in goodwill before revenue
  • · Sales culture that tolerates delayed, indirect payoff

Decision Moments

Actual decisions, real outcomes

Specific decisions narrated in the episode with their outcomes and transferable lessons.

Board members repeatedly pushed for faster growth; Duo had just done a T3D2 (tripled thrice, doubled twice) but the only marketing levers left looked wildly inefficient. The choice was to blitzscale by pulling those levers or to keep growing responsibly while staying near cash-flow positive.

Did: Chose capital-efficient, responsible growth over blitzscaling -- refused to pull inefficient marketing levers, stayed cash-flow positive for several years, and let cultural coherence (not capital) be the governing limit on growth.Outcome: Burned only ~$14M to reach $100M ARR (roughly $8M to $100M, ~$20M by exit), later cited by Redpoint as the best SaaS metrics they had seen; over-raised but never touched a $100M+ cash balance, exiting to Cisco for $2.35B.

In a hype cycle that treats T3D2 as slow, bottom-line efficiency and cultural coherence can outperform grow-at-all-costs and preserve founder optionality.

Part of an emerging decision pattern across multiple episodes

Andreessen Horowitz and Sequoia (Toro) signaled that any great technology company must be in the Valley; a16z gave a term sheet expecting relocation. Duo had to decide whether to move to San Francisco per the venture default or build in Ann Arbor, Michigan.

Did: Made staying in Ann Arbor a non-negotiable -- turned down the implicit relocation condition, chose investors (True, Google Ventures, Benchmark) who would augment rather than override their perspective, and treated Michigan talent and cost as an unfair advantage kept deliberately quiet.Outcome: Hired top engineering talent with little competition, enjoyed large cost-of-living arbitrage, avoided Valley churn and distraction, and built the culture and capital efficiency that carried the company to a $2.35B exit; Ann Arbor became Michigan's first billion-dollar tech exit.

A location can hold a real strategic edge; the founder's job is the alchemy of turning where you are into an unfair advantage rather than defaulting to the herd.

Part of an emerging decision pattern across multiple episodes

Cisco (and earlier Workday, via a signed LOI that fell apart, and an ~$700-800M Cisco bid) wanted to acquire Duo while the business kept doubling. Board member Matt Kohler insisted Duo was worth at least $2B when offers started with a one. The founders had to decide whether to take an early sub-$1B exit or hold out.

Did: Rejected the early ~$800M bid ("not even the zip code"), let the Workday LOI lapse, and kept doubling the business; 12-18 months later closed with Cisco at ~$2.35B, at the time the largest multiple ever paid for private-stock acquisition.Outcome: Sold to Cisco for $2.35B (plus retained cash), roughly triple the original bid; Duo became Cisco's fastest-growing business for four straight years, now $1B+ ARR inside Cisco -- though in hindsight holding to the 2021 public window might have been worth even more.

Growth is the best negotiating leverage in M&A; a credible board anchor plus continued doubling can multiply the price several-fold versus taking the first serious bid.

Part of an emerging decision pattern across multiple episodes

Tensions surfaced

Contradictions and trade-offs the episode raises — judgment calls a thoughtful operator has to navigate.

Tension

Grow as fast as possible vs protect cultural coherence

When growth speed and cultural coherence conflict, cap growth at the rate culture can absorb.

Duos board kept asking why they could not grow faster; the founders deliberately grew responsibly because the worst startup outcome they had seen was people running around not knowing what to do.

Let the pace at which you can preserve culture govern your growth rate, not the boards ambition.

“the the one thing we said we would never break, which would, would be our culture, the, the governing, the, the governing factor, kinda limiting our growth was cultural coherence.”Dug Song

Tension

Take the easy enterprise money vs discipline to serve the underserved end

The easiest early revenue can capture your roadmap; anchor on who you must serve instead.

Banks would pay $100k paid pilots easily, but Duo disciplined itself to build for the SMB non-consumption end because that is where the security problem actually lived.

Resist the easiest early money when it would bend your product away from the market you set out to create.

“it was maybe the easiest s letting for us to go. But we sort of had a different discipline to say, well, no, no, no, we, we really wanna solve for a different end of their market.”Dug Song

Corpus connection

Where this episode fits for retrieval

What kinds of decisions this briefing is best pulled into.

Primary decisions

  • • strategic-bet
  • • hire
  • • go-to-market
  • • fundraise