TORONTO—Securing corporate data and networks from hackers is complex and challenging, but companies compound their problems by making many needless errors, according to serial entrepreneur and hacker Dug Song.

Mr. Song is co-founder and CEO of Duo Security Inc., a cloud-based security service that authenticates network users with multiple steps. The company based in Ann Arbor, Mich., was acquired by Cisco Systems Inc. for $2.35 billion.

The deal, which closed Oct. 1, involved Mr. Song’s third startup. He was founding chief security architect at Arbor Networks, which was sold to Danaher Corp. Earlier in his career, he said, he sold a network anomaly detection system to Check Point Software Technologies. He also founded Tech Brewery, a shared workspace housed in a former brewery in Ann Arbor.

“It is back to basics, truly,” Mr. Song told WSJ Pro during a networking event at the Collision tech conference, which drew more than 25,000 people to Toronto earlier this week. “What companies fall victim to are known basic gaps, not patched for years and years.”

Companies often fail to address basic security mandates, such as maintaining an accurate and complete inventory of what is on their networks. Such lapses, he said, reflect, a misunderstanding of how hacking has evolved.


“Smart attacks focus on users, not systems,” Mr. Song said. But he thinks companies overinvest in advanced technology while giving short shrift to vital areas of defense such as identity verification, he said. Duo focuses on identity verification, which includes strategies like multifactor authentication. The company also assesses the health of devices.

Companies also may fail to understand that hackers increasingly collect vast amounts of data in indiscriminate fashion. They are often less inclined to pursue specific targets. “So attackers have a field day spraying and praying. They collect huge amounts of data, just as businesses do,” Mr. Song said.

The reality is that smaller, undetected breaches occur all of the time, he added.

Individuals, he said, often fail to protect themselves because they don’t believe anyone would bother to come after them. ”It is not about that anymore,” Mr. Song said.

People neglect to employ strong passwords or update software because they just don’t see themselves as targets, he said: “It is hard for people to understand” that often individual companies or people aren’t being singled out, but that hackers are attacking many targets and seeing what they can get.

Mr. Song, a self-described “’90s cyber punk,” said he has no particular method for developing startups. “No. I wish,” Mr. Song said. “I am a skateboarder. I feel like I am playing in traffic most of the time. I am not a surfer, but it is probably more like surfing. You see a wave and try to catch it while you have some momentum behind you.”

But his work does reflect a belief in the importance of security and privacy. “Privacy is necessary for a free and open society,” he said.


As a leader, he also encourages a process of “blameless retrospection,” in which people can assess what went wrong. This culture, he said, promotes faster learning within an organization.

Write to Steven Rosenbush at