He was arrested for hacking at 17. Years later, he turned that skill into an 8-figure sale to Microsoft

When Terry Dunlap recounts his career to this point, he hits the big events, starting in 1986 when he was arrested for hacking computers. He was 17.

From 2002 to 2007, he worked at the National Security Agency where he was paid to hack terrorists and foreign governments.

In 2007, he launched his own hacking company, and, 10 years later, spun out ReFirm Labs, which identified security vulnerabilities in devices like smartphones.

In 2021, he sold the SaaS company for 8 figures to tech giant Microsoft.

How they hacked it: growing ReFirm Labs through funding

Based in Fulton, Maryland, ReFirm Labs was co-founded in 2017 by Terry Dunlap and Peter Eacman, an experienced CTO. Over the years, they grew to a team of seven employees and 1.1 million ARR, servicing customers including AT&T, Charter Communications, Siemens Energy, Nestle and Verizon.

ReFirm Labs was a cybersecurity company that identified security vulnerabilities in IoT (Internet of Things) devices, which transmit data over the internet or other cloud networks. Think: smartphones, smart thermostats, home security systems, fitness trackers and more. The challenge was to find weaknesses in these devices, or in what’s called firmware security, before hackers do. (The company’s website redirects to Microsoft’s Azure.)

One of the biggest challenges of growing the business, Dunlap said, was splitting his time between marketing and raising venture capital. Eventually, they hired a CEO who had experience raising funds. Over its lifetime, ReFirm Labs raised $3.668 million in seed funding and convertible notes, Dunlap said.

How ReFirm Labs captured Microsoft’s attention

Microsoft first took notice of ReFirm Labs when it was a top 10 finalist for the RSA Innovation Sandbox Contest for cybersecurity companies in 2018. After the founders’ presentation, Steve Cole, the director of business development at Microsoft, approached, Dunlap said. In short, they wanted to acquire the company to enhance Microsoft’s security capabilities.

The team wasn’t looking to sell, Dunlap said, but it was becoming increasingly difficult to raise additional rounds of VC funding.

“As we were raising our A round, we realized many VCs would not invest in a ‘feature,’” Dunlap said. “When Microsoft explained how we would become a feature within their Defender for IoT product, it made sense to pursue the deal.”

In the meantime, they continued their attempts to raise an A round — just in case the deal backfired.

In November 2020, Microsoft and ReFirm Labs decided to move forward with the acquisition. The deal closed in May 2021, and ReFirm Labs sold for low-8 figures, Dunlap said.

Microsoft explained in a blog post that the company was an appealing acquisition target both because it brings “world-class expertise in firmware security” and because its software helps Microsoft protect its customers from threats. In other words, they wanted both the team and the software.

“Device builders typically integrate third-party software and components in their solution, but they are missing the tools and the expertise in analyzing the components they consume, and as a result may unknowingly ship devices with security vulnerabilities,” the blog post reads. “This is where ReFirm Labs comes in. Microsoft believes that firmware is not a future threat, but an imperative to secure now as more devices flood the market.”

A year before the acquisition, Microsoft acquired another cybersecurity startup, CyberX, that focused on IoT devices, Geekwire reported.

The most challenging part of the sale process, Dunlap recalled, was “the sheer amount of due diligence questions Microsoft wanted answered.”

Now, Dunlap is locked up again — but it’s a little different from when he was 17.

“Microsoft locked up me and my co-founder for two years,” he joked. Dunlap works as a principal program manager for the company, and Eacman signed on as a principal software engineering manager. His release date is May 20, 2023.