WorkBoard at Malwarebytes
Business Process Owner:
Chief People Officer
Enterprise wide platform, program launch and OKR coaching services
WorkBoard CEO Deidre Paknad sat down with Marcin Kleczynski, CEO of Malwarebytes, to hear his incredible growth story and how they’re using OKRs to accelerate growth.
Deidre Paknad, WorkBoard: Marcin is what I think of as a phenom. He’s got this amazing company — Malwarebytes — that is defending and protecting our computers and laptops and those of tens of millions of people — it’s phenomenal. His growth story starts in his dorm room, is now a couple hundred million in revenue and he continues to lead it at a very high growth rate. What is super interesting is not only how you’re leading, Marcin, but that this is your first run. And so you have such a fresh perspective with none of the baggage that many of us have about how business “should” work.
Marcin Kleczynski, Malwarebytes CEO: I barely held a job outside of this!
So let’s start with the company story. Where did you start? What’s the journey? What are the growth stages?
I started the company — actually the concept of the company — well before college. We had one of those old Dell computers everybody had under their desk back in the 2000s. And I loved video games. We came from a pretty poor family out in Chicago, and I would download these pirated video games on Kazaa. One day this thing is just happening on my computer — I think it was a purple gorilla jumping around trying to sell you crap. And my parents obviously were incredibly annoyed.
This is the only thing that we have of worth in the household, and I’ve broken it within two months of having it. So, of course, I’m the one fixing it.
And that’s what I did. I went online, and I found a message board full of people that I consider superheroes today, and right there and then I posted: “Here’s what’s happening: purple gorilla.” And a woman from Belgium named Mika — I can’t make this up, right? — came to my rescue and said, “here’s a pamphlet of 40 pages of instructions.” And I was using one of these paid antivirus companies already. They were running there in the right-hand corner, yellow color — you guys know exactly who I’m talking about — and it let the threat onto the computer, and it wouldn’t fix it.
I followed the 40 pages of instructions, and the computer was clean again, but why did this happen to me? Why couldn’t it fix it? Why can’t we protect it? And that’s what I set out to do. And that was really kind of the first inspiration of Malwarebytes.
I stuck around this community of people, of superheroes. I started building free apps for them from a For Dummies book. So that’s how I learned everything. And in 2008, right as I’m heading to the University of Illinois, we launched the first version of the product called Malwarebytes. Now to go a little bit backward: my co-founder is somebody I met on this message board, and he’s this 30-year-old guy out in Boston; I’m this 15-16-year-old kid out in Chicago.
Imagine telling your mom you’re working with some guy on the internet building an antivirus company! We didn’t meet or even talk on the phone until the company had turned over a million dollars.
We implemented OKRs on WorkBoard, and we’ve seen an acceleration of growth this year.
So you’re way over $150 million now. What were the growth stages?
We were bootstrapped from the very beginning. I was a kid out in the Midwest – from Chicago, went to the University of Illinois, and ran this thing out of a dorm room to $30 million. And I ran it like it was still bootstrapped, because you take this guy from a poor family in the Midwest, drop him in where everybody’s spending money hand over fist — but that’s not how I operated and how I grew up.
My favorite story from that time: I’m playing around; I’m in the dorm room — at the University of Illinois, you have to go into a dorm room your first year, and we’re already doing some serious cash — and I have my computer there. I’m connected to the school network and I’m disassembling a virus with Bruce. Really fun stuff. And then I get a white page that says “you’ve been banned from the school network. There is suspicious activity happening on your computer. Go run one of these three of your competitors or call this number.” So I call the number, and a kid no older than I shows up in the dorm room and says “Hey, I’m from IT.” He sits down at my computer and runs Malwarebytes right in front of me. And so that was like “I’ve made it”, at least in 2009. And so that was the first stage.
And then since then it’s been, you know, really formalizing the structure of the company, and I hate to say that, but it’s so necessary after a certain scale. They say, things change at 100 people, 500 people and all that. It is absolutely true. And OKRs have been a big part of.
So tell us what the shape of the company is now.
We’re about 850 people now and have been growing about 150 to 200 people a year the last couple of years. We’re a unique business in that we do consumer and enterprise, and that is a really difficult thing to do.
You moved through the stages to get more formal, more structured. And obviously you have a pretty deep leadership team?
I do. And one of the things I definitely recognize is the people that got you there aren’t the people that are going to get you there going forward. And especially with a young entrepreneur like myself: I know my limitations, and so I have to hire around those limitations. And the people that are good startup people are not necessarily good at scale.
As you moved through those stages, what were the things that you gained and what went away as you got bigger?
So up until maybe three or four years ago we did an all-team summit. Everybody all over the world would fly into a city. And we did a planning session, and we did presentations, we did like a carnival where you go around and learn different departments and stuff like that. And then everybody goes eats and drinks and all that but everybody left with a clear alignment of what we’re doing, and it was super worthwhile.
Well, when you do the cost analysis, at 500 people, at $3,000 a person, it’s hard to justify.
I think that definitely hurt the culture quite a bit, even though it’s that scale that is really driving that cost. So how do you replace that? I’ve had to just help implement culture on a daily basis and OKRs have played a big part in being connected, motivated and aligned without these.
At 800 people, we’re talking thousands of micro decisions every single day. Each of those incrementally add up to big strategic decisions.
What are the set of first principles for growing the company? Do you just think let’s make great products or is there more method?
The answer a year ago was just build great products; the rest will get figured out. That proves to be incredibly hard at scale. So, to grow $100 million and then another $100 million, you’re actually growing slower. Law of numbers. If you’re supposed to maintain 40-50% growth over the next 10 years, that’s actually harder every year.
At a company of 800 people, we’re talking about thousands of micro-decisions happening every single day. Each of those incrementally add up to big strategic decisions. I mean, there are only 365 days in a year, and you’re expected to produce 40% growth. Do the math and things have to go really, really right.
It’s almost that you’ve got to get smarter about how you grow the more you grow?
Yes. I’ll give a great example of where growth has gone wrong for Malwarebytes. About six years ago, I had the bright idea of building a secure backup product for our customers. We have so many consumers, if we can just sell one more damn thing to them, we’re going to be flowing in money, right? Bad, bad way of thinking about it. What if we just build something and mold it and sell it to a customer? They’re going to love it. And it wasn’t the Malwarebytes way. And that thing produced $4 million in revenue but took up half our time.
Time is your most precious resource and so are your people. And so, we’d invested all these resources, all this time into something that just didn’t play out. And the hardest thing for me was to then kill it, because otherwise you’re dragging it along for forever and we killed it.
Not killing it is like competing with yourself.
Every company – every team really – should be making those “keep or kill” decisions. How did you think about the conversation with the developer team or the sales team who’d you invested in ramping up on go to market and thinking? How’d you communicate and navigate through that?
This is the interesting thing I’ve learned in my career: All we had to do was talk to those people, and they knew it, they saw it. We have open office, so people approach me all the time and that’s kind of where the idea came from is like, “Hey, you know, there’s some people talking about this. We should probably all know; it’s not going so well.” And at the end of the day, you’d be surprised. The same thing with people transitions. Everybody already knew it was needed.
“Keep or kill” communications weigh heavy for many leaders; that everyone already knows it needs to be done is liberating.
And your customers can tell you too! You can look at the data all day long. You can do the market analysis all day long, but go talk to your people, go talk to your customers and they’ll tell you. And then you’ve got to decide how are we going to invest more or truly kill it off.
The OKR session created some sense of purpose. “How am I helping the company grow?”
Why is results alignment important to you? And it may be more important now than in the past, why?
Two years ago, the way we set goals was in a spreadsheet. And then at the end of the quarter, you’d get paid on them. And I never saw any of them. People managers likely never saw any of them. We started working on real OKRs at the beginning of the year.
We had our annual operating plan to align strategically, and OKRs became simply a way to drive the results in the organization. And we came up with 20 initiatives for the year, and at first, I thought that was a lot. But those 20 initiatives were now aligned across the company. Whereas before there were probably 300 isolated initiatives that everybody was writing into their personal goals, working on things that they thought were important to the business but really weren’t.
Now our objectives that drive those initiatives are simple so everybody could consume it and understand it:
- We’re going to grow
- We’re going to get a little more effective with how we spend our money, and
- We’re going to take care of our people.
And underneath each of those was: Grow, here’s some product launches that we need to get done and nothing else matters. Under Efficiency it’s, “Hey, we spend a lot of money on AWS. Let’s go figure that part out.” And under People, it’s “how are we going to progress people’s careers?” When you really think about the alternative, it’s not great: 800 people, 300 initiatives because everybody’s working on their own thing, and then coming at the end of the quarter saying, “Hey, I did everything I said I was going to do.” But because we were never aligned on what those things were, a lot of it didn’t matter unfortunately.
One of the conversations I have with people is that they’ll have five objectives at the top, and they’ll KRs for each one of them and they’ll say wow, isn’t that a lot? But your point that when you really think about an organization at any scale and you think everybody’s working on something, actually it’s already a lot, it’s just misaligned and opaque.
Yes, and the KRs helped quantify some of this stuff, because we historically have not been outcome driven. So, if you look at our OKRs before, they were like “launch this product.” Well, that’s great, and I’m sure it’ll be successful. But what does success actually mean?
The OKR session was three hours per team. It created some sense of purpose of how you do align to the top-level goals. “How am I helping the company grow?” Well, now I can concretely say that. Before it’s was like “Well I think I am, I’m doing this, I’m doing that.” It’s just the process of sitting in the room and having those conversations on what are our objectives and results are going to be as a team. And we stayed true to the principles of OKRs, we strive for best possible outcomes.
And you know, in the first quarter it was very important for me to not react. “You only hit 50% of best possible — are you serious?” But don’t react. People were ambitious. They believed they weren’t going to get whacked because they set a really high goal. And that’s been pretty cool. We implemented OKRs on WorkBoard, and frankly we’ve seen an acceleration of growth this year.
I’ve now been in at least three or four conversations a week where people talk about it as “their” OKRs.
Tell us a little bit about what you observed and particularly that first-quarter cycle? How did it impact how you interacted with them and what you saw your leadership team interacting with each other?
I think it was before we started the process of getting the teams in a room. There was a lot of skepticism: “Oh here’s just another way that they can hold us accountable. Here’s just another way that I’m going to get paid or not paid.” We really had to do a good job of not reacting and having healthy conversations that were engaging. And I remember you walking in and saying, “this is going to be three hours, two hours and 50 minutes of mess, 10 minutes of radical clarity”, and it was down to the minute.
I said the same thing to the next level of managers. I said, “Listen, I’m an expert in this.” “And it’s going to be two hours and 50 minutes of mess and in the last 10 minutes, you’ll have radical clarity.” And it just happened like that — all the way through the organization! We knew exactly how long this should take.
And you know, there were some nonbelievers, but they came along for the ride and I think now they believe, and the second time we did the OKR reset, I thought it was really easy. In the reset the first thing we did was look at if these things still mattered. If they didn’t, cut them out. And I think that was 40 minutes.
What are some of the surprises you saw — in particular, skip level? When you looked below your leadership team, L3, L4, L5 teams, what did you see there that surprised you? Did they lean into best possible? Did they lean out?
I certainly think they learned in. What was interesting to me — was people went in there and started updating on their own. There was no calendar invite sent: “update your KRs [key results].” There was nothing like that. And in fact, I’ve now been in at least three or four conversations a week where people talk about it as their OKRs. “Like, oh no, that’s one of our OKRs. We’ll get it done. Don’t worry”. We were in a retention meeting and “Hey, this lifecycle stuff — oh no, that’s an OKR. We’re getting it done. We’re measuring it.”
So now there’s a common language, whereas before, there were random goals that weren’t aligned with anybody, in a spreadsheet that was managed locally. And maybe you submitted it as a goal at the end of the quarter. And we had no real visibility, no way to see how that aligns to what you’re doing. The way that people are talking about it and self-updating it, and I think that’s creating just radical focus. It’s pretty cool.
Now there’s a common language; before there were random goals that weren’t aligned. And we had no visibility.
What do you wish leaders in your company — your direct reports and their direct reports — either knew or better understood about growing the company and in particular where you need to grow it next?
You know I think we need to accelerate some of the changes that are happening. And again, we’ve had executive turnover, we’ve had strategic changes, we’ve had a lot of different changes in the company; more so probably in the last year than in the last three before that. And the company is doing the best that’s ever done, in fact accelerating growth. I’m not saying it’s directly correlated, but you know, a body at rest stays at rest.
Is it important to set OKRs at the team level? And what about in engineering?
Yes, absolutely in terms of doing team OKRs and getting product and engineering in a room and doing team OKRs together.
Because — and I’ve seen this now through a couple of sessions — our engineers are not just order takers. They don’t just pluck a ticket off the backlog and say I’m going to go do this. They want and are more motivated when they see, “well, I’m bringing revenue in.” So those processes from a product management and engineering perspective are in my opinion too sterile.
Here’s a good example: we are working on (user) retention in a certain product. We got the team in a room, not just the product team, not just the engineering team. And we made it a KR to get to a retention rate. Well you may say, well, how’s the engineering team going to do that? Well, to deliver and even generate ideas to doing just that. So, it just kind of creates a sense of purpose on a quarterly. And it brings out a lot of creative ways to accomplish that.
And when you bring engineers into an OKR session, it gets people aligned and excited. On the growth side they go, “we’re going to drive how much million in revenue next quarter?”. They decide to shift projects forward, not just deliver to the roadmap, but deliver a month before the roadmap. That’s our OKR, that’s our stretch.
The company is doing the best that it’s ever done, in fact accelerating growth.
What is the impact of OKRs on cross-functional collaboration?
Well, no team can function in a silo. And this is driving the right conversations and interlock to happen more affirmatively, whereas before you do it maybe once for the annual operating plan and even then, maybe not as well as you should. This is impacting people even down to updating their KRs. They’ve got to go get that information from another system, from another team. And those conversations are happening. So before, I swear they were driving goals in a silo with Engineering saying, “I’m going to go deliver this product.” And then Product saying, “we’re going to go deliver that product.” You look at the two and they’re not aligned. Now, we’re moving in the same direction faster.
And it starts with my objectives, and the nice thing is that you can pull them through the ranks. If my goal is a user retention goal, then that can be shared by the team underneath me, the team underneath them and, be systematized.
Right. What was the impact on culture?
Well, the fact that people are talking about OKRs — that is a cultural shift of, “Hey, we want to be held accountable. We have a way to be held accountable.” Before, there was no talk about team performance in the company. And I know that’s a CEO-focused mindset, but teams do want to feel like they know how they’re doing and standing in the company. Before nobody was talking about key results progress before that. Nobody was talking about that spreadsheet that they had in their pocket that said, “here’s what I’m going to go and do.” They were hiding from that. This brings it front and center — this is what we’re going to accomplish as a team and we fail together or we win together, and we’re going to go try to win.
No team can function in a silo, and OKRs are driving the right conversations and interlock to happen more affirmatively.
How do you create and describe your OKRs?
Well again I’ll try to answer that question in terms of how this construct came to be. So, when we set the goals, it was easy to just say, “Grow 30%, drive $10 million out of cost, and make our people happier.” We could have flown with that, but we did it a little bit of a different way. We said, grow so that we can protect even more people from malware.” And that’s a mission statement, right? “Operate more efficiently so we can invest that money into our customers, our people and our technology,” and “Make our malwarenauts better so that they can fight the enemy even better.” And so on. That was step one.
And then in the next level down, they had to come up with an impactful statement too for their objectives. It’s not like you can just say, okay, then “we’re going to take out 10 million in costs. Like in engineering, they said, “we’re going to build the best engineering ninjas in the world”. And then here’s how we’re going to do it with these KRs. They made it a little bit more fun. And I think that made it resonate through the organization instead of like this sterile KR of “80% retention,” whatever it is. So, I think if you can have fun from the top, it’ll stay fun. Do you think people have forgotten those goals? No. Because we were passionate about them, and had some fun that made real, relatable.
For most leaders, if you go to your company right now and say, “Give us the top three, five strategic initiatives” ... your year started seven months ago, do you think they still remember them? Maybe if you keep talking about them, but with OKRs, you have a system that tells you right there: “Grow faster so we can protect more people”.
When I think about alignment and accountability, sometimes if you’re the CEO when you’re saying it, it might sound like it’s a forced march. But if you flip it on its head and say, what does it look like without alignment, without accountability from an employee’s perspective, it sounds like this: “I don’t know if this work matters and I don’t think anybody cares anyway.” That’s the absence of alignment and the absence of accountability. That’s not a great place to be or work. I think they have a bit of a bad rap as labels, but I think they’re so foundational.
And what’s really been fun is me to go four or five levels deep and comment on a KR and people freak out like “Oh my God, this is awesome — he looked, he looked!”
Thank you for sharing your story, Marcin.