That makes it a “unicorn”–a tech startup valued at more than $1 billion. It’s only the third billion-dollar company in Ann Arbor’s history, after Domino’s and Borders–and it only took seven years for Duo to get there.
Awareness of the need for computer security has skyrocketed in recent years, as hackers hit everyone from former secretary of state Hillary Clinton to the National Security Agency. To defend themselves, 10,000 companies, including Facebook, Yelp, and Paramount Pictures, deploy Duo’s software.
You wouldn’t guess any of this from meeting Jon Oberheide, Duo’s chief technologyl officer and, along with Dug Song, its cofounder. With his work shirt and jeans, scruffy beard, and aw-shucks manner, Oberheide looks and acts like what he is: a pure-bred Midwestern hipster who comes across as slightly embarrassed by his success.
Asked if he’s celebrated Duo’s status by buying a new car, Oberheide says he doesn’t even own one. “It’s not a status symbol,” he smiles. “It’s just a car. I see that kind of stuff as a utility. I live alone on the west side. I have a five-minute walking commute. Dug shows up for work every day in his Ford Focus, pulls out his skateboard, and skateboards down the street to our office.
“We don’t get caught up in the glitz and glamor of what lots of Silicon Valley companies pride themselves on,” he says. “We blame it on our blue-collar work ethic and orientation towards building a business. But it’s also just the right thing to do. Our dream is that Duo is an enduring company, not just another flash in the pan that won’t be here another five years from now.”
Oberheide sits in the conference room of the company’s newest space: the venerable Allmendinger Building on S. First St. at Washington. It’s a block from their other location on N. Ashley.
“From a community perspective, Borders is a good analogy,” he continues. “The imprint that it left on Ann Arbor is compelling, and when we think about the tech ecosystem and the emerging security startup scene here, we want to be the foundation for that, to be supportive of that community and folks like our early employees at Duo. Some have moved on to other companies and are now starting their own companies in Ann Arbor. We want Duo to be a great place to be from, not just a great place to be at.”
He downplays Duo’s unicorn status. “It’s a good milestone for everything we’ve been able to build so far, but our focus is always on what new set of customers we can address, what problems we can be solving for our customer base.”
Oberheide says the secret of their success is service. “There’re about fifteen hundred security vendors out there, and so many of them aren’t focused on the right problems. Dug and I started the company because we had been in the security industry for a couple decades and seen how poorly vendors treated their customers.”
They came up with a “duo” solution using two-step verification to prevent unauthorized access. “It’s meant to be simple and easy,” he explains. “At Arbor Networks, where Dug and I were previously, we built security for the 1 percent. But there are a large number of companies that are below the security poverty line and can’t afford to protect themselves. We have had a lot of success designing security for people that they can use every day.”
Being a unicorn doesn’t guarantee long-term survival. After leaving Borders, cofounder Louis Borders started a grocery delivery company that was briefly valued at more than $1 billion and went public–only to go bankrupt when the dot-com bubble burst and the flow of new cash stopped. But Duo is already past that point–it’s a real, operating business, not just a promise to be one someday.
“Last year we were cash-flow positive, which is extremely rare for many venture [capital]-backed companies,” says Oberheide. “The normal recipe is you raise money, you burn through, you raise more, you burn through it, [and] you hopefully reach some outcome before your investors get tired of giving you money. We have control over our profitability, how much we want to leave [in the company] and invest.”
Duo isn’t done growing. “There’re still a lot of good opportunities to go after in terms of new markets,” he says. “The federal government is the largest single buyer of cybersecurity in the world. That’s an important market for us, and there’s additional geographic expansion we can look at.”
How big can they get and still stay in Ann Arbor? “There’s a ton of space outside of downtown that’s easy to obtain,” Oberheide replies. “But the quality of work life is very different in the downtown area, to have all of the shops, all the restaurants easily accessible. Trying to find space and opportunities that are suitable for rapid growth–that’s hard to do when landlords are looking for ten-, twenty-year leases and we’re [asking], ‘How about ten, twenty months?'”
They now have about 500 employees. About 350 are in the two downtown offices, with the rest in San Mateo, California; Austin, Texas; and London; plus a few working out of their homes or doing field sales.
“Duo a year ago [had] 250 people here, and now it’s 500,” says Oberheide. “It’s a whole other half of the company coming on board, basically a brand new company every year, and it’s always been that way since we started the company: we’ve basically doubled every year. You develop a different understanding of what it is to operate a company in that phase of hyper-growth. If you like change, it’s really exciting. If you don’t like change, it’s hard.”
Where Duo will be in three to five years is “hard to speculate. But we’re staying in Ann Arbor. It’s a great talent pool to draw from, especially with the university and the other tech companies that are in the area. And it’s not cutthroat. We do a lot of joint recruiting and networking events with the other tech companies, because we can bring more people here [and] have a larger talent pool to compete over.”
And there’s no shortage of work. “It’s a crazy time,” says Oberheide. “Cybersecurity is going to be the biggest problem on a geopolitical scale for the next decade. You can steal government secrets, as we’ve seen with the recent allegations about Kaspersky and the Russian government.”
Kaspersky Lab is the Russian company accused of using its antivirus software to target the home computers of NSA employees. “Everyone knew they were a Russian-founded company, but they had a good reputation, good product. The allegations, whether they are true or not, are really damaging to their brand, and there’s already been federal orders to ensure that it is not used on our government’s systems.
“It’s a really hairy, challenging problem, but I’m bullish on the future of cybersecurity,” he says earnestly. “Every company in the modern day is a technology company. They have to leverage technology to be competitive against their peers in their market and be efficient and effective. And we allow them to, so they don’t have to worry so much about the risks represented by new technology.
To do that, they’ll have to keep growing. “We’re hiring,” Oberheide says. “We’ve got about fifty positions open.”
This article has been edited since it was published in the December 2017 Ann Arbor Observer. Duo’s valuation and Jon Oberheide’s title have been corrected.