In 2007, Michael D. Watkins wrote for the Harvard Business Review that the human immune system was an apt metaphor for organizational culture, explaining that an organization’s culture provides a level of protection to the organization that allows it to continue with intended and effective functioning. A weak immune system provides little protection from “bad actors” with the ability to disrupt functioning, while an overly zealous one can keep new and potentially beneficial actors from doing any good they could have done. Watkins likens effective leaders to effective viruses: “In this, effective leaders are like the most sophisticated viruses: they fool the immune system and are able to inject new DNA without destroying the host…In acting as role-models, and in encouraging and discouraging specific behaviors, leaders are in effect vaccinating their organizations.”
Deja vu Security is a cybersecurity consulting firm in service to some of the most prolific companies in history as well as disruptors in investment finance, mobile operating systems, and more. Director of Operations Joe Restivo sat down with Deja Co-Founder and CEO Adam Cecchetti to get his take on the history and future of Deja’s organizational culture, especially in the context of a fast-growing company.
Joe: What does ‘company culture’ mean to you?
Adam: Our company culture is the shared set of beliefs and behaviors that guide our organization. It’s the soul of our organization.
Joe: Give me three words that describe Deja’s specific culture.
Adam: Trust, expertise, and growth. Without trust, what we do for our customers just wouldn’t be possible. In turn, them asking their customers to trust their technologies wouldn’t be possible. So trust is core to our business and enables our customers to turn around and do good work and sell good products to their customers. As for expertise, part of what we do here is help some of the most sophisticated companies in the world with some very hard problems. To do that, we need to be the experts and give not only actionable advice, but actionable advice that’s backed by research, history, and experience.
Joe: Expertise is one of the core pillars supporting trust—customers trust us because of the expertise we bring to the table. The third word you mentioned—growth—is the most interesting to me: What do you mean when you say a culture is ‘growing,’ or that it’s a ‘growth-based’ culture?
Adam: Culture is not static. It’s not something you do at a group meeting or a weekend retreat and say, ok, this is our culture. It’s dynamic. It needs to always have its heart and soul, but the way the culture expresses itself will change as the organization changes. A growth mindset means, one, that your organization is growing and changing, but also that you’re enabling your people to grow. You can’t have an expertise culture that relies on people to constantly learn if people aren’t allowed to be vulnerable. If someone feels like they’re going to be reprimanded for making a suggestion that in their mind maybe isn’t perfect, or for making a mistake, you’re never going to get real trusted expert feedback. And if you’re protecting your ego, you’re not learning. Making mistakes is part of growing, and part of making your organization better. And our customers grow by understanding where and how they’re vulnerable as well.
Joe: Did you have an idea of what kind of culture you wanted when you founded Deja? I know you didn’t want some aspects that can be part of other work environments, such as excessive travel, multiple concurrent engagements, and 60+ hour workweeks.
Adam: I wanted to make sure we were building a place I would want to work if I wasn’t one of the people founding or running it. A place where people could learn from each other, teach each other, and grow together. One of the things that can happen is organizations that are expertise-based [like Deja] is that they become too meritocracy-based and that can lead to a lot of toxic behaviors. I wanted to enable people to come in, learn from each other, feel free to ask questions, and have a positive and healthy work environment.
Joe: I’ve noticed during our hiring process that we’ve received a ton of positive feedback from candidates about the fact that we talk them through some of the benefits of working at Deja that aren’t directly tied to compensation. There’s a certain expectation that many people have entering a technology business, and I think we’ve done a pretty good job of shattering some of those expectations. Would you agree with that?
Adam: My perspective is, we’ve come a very long way, but there’s always good work to be done there and we can always be improving. I do feel really happy about where we are today, but I’m always keeping my eyes on the horizon and asking how we can be a better organization.
As Deja’s rate of projects and staff counts swell, Cecchetti finds himself in the role of Michael D. Watkins’ aforementioned “virus”—as a leader, he must help affect the company’s immune system so that it’s protected against changes that would negatively impact culture, while maintaining a permeability that allows in positive ones. He personally describes this role as a “focusing lens”
Adam: We’re growing, we’re scaling. It’s easy to lose your soul in that, to lose bits of culture by chasing a metric or growth. We need to make sure the heart and soul ring through while rapidly expanding, and as both founder and CEO, I help set that vision and help execute that vision.
Joe: We’re definitely growing fast. My third-anniversary here is soon, and I remember, we used to have maybe ten full-time employees. What are the aspects of that small company culture that you want to preserve as we’ve grown from ten to fifty and to, someday, 500?
Adam: As you scale, communication becomes key to enabling not only an understanding of where we’re going and how we’re getting there, but what the role of the individuals is in helping us build a better Deja.
Everyone has role models, and Joe wanted to hear about which organizations inspired Adam’s own cultural work as founder and CEO.
Joe: I’m sure there are organizations you look to and admire with respect to culture. Walk me through a few.
Adam: One of the things I absolutely love about Amazonian culture is that it’s still “day one.” We need to be able to throw everything out to make sure we can get to the next step, the next phase, the next version of our organization. I wholeheartedly believe that’s a key to growing a good healthy business and culture. I prefer that bias for action.
Joe: I believe that’s one of their leadership principles, and I like that they’re called leadership principles but they’re expected to be embodied by every Amazonian, not just managers.
Adam: You can have the greatest ideas about culture at the top, but really it’s the people in the organization that make the culture, but if they haven’t bought into those beliefs and they’re not empowered to change things from one day to the next, then you’re blind to what your culture really is.
Adam also praised MOD Pizza, another Seattle-made business.
Adam: MOD believes in giving almost anyone a chance to learn, make mistakes, and grow as part of the organization. They go out of their way to find and hire individuals that want to help build an organization but might not otherwise get a chance to. And what I do fundamentally believe is, as a security firm—as some of the world’s experts in computer security—we need different mindsets, different backgrounds, and people who perhaps wouldn’t normally think about being in technology or computer security. That’s core to our strength. But to make that happen, you have to give somebody that first chance. We’ve had space engineers, music majors, chemistry majors, meteorologists—all kinds of people from different walks come through our door.
Wrapping up, Adam reflects generally on Deja’s culture and its ongoing growth: “Our culture is something that’s very close to me and why I’ve enjoyed being a leader of this organization. I’m very proud of Deja—the culture we’ve had and the culture we continue to sustain through our growth. It’s the soul of who we are.
Adam Cecchetti is a founding partner and Chief Executive Officer at Deja vu Security and is dedicated to the leadership and relentless innovation in Deja's products and services. Previously he has lead teams conducting application and hardware penetration tests for Fortune 500 technology firms. Adam is a contributing author to multiple security books, benchmarks, tools, and DARPA research projects, and he holds a degree in Computer Science and a Masters from Carnegie Mellon University in Information Networking.
Joseph Restivo currently serves as Director of Operations at Deja vu Security, overseeing its human resources, marketing, and financial functional areas. Throughout his career in business leadership, Joseph has had the opportunity to grow and develop teams of all sizes within the financial technology, information technology, and legal domains.