Richard Stiennon is one of the most respected independent analysts in cybersecurity — a former Gartner analyst who has tracked the industry with rigorous skepticism for decades. When Stiennon sat down with Stuart McClure in 2014, Cylance was still a young company and the idea of using machine learning to prevent malware before it could execute remained genuinely novel, not yet the category it would help create.
The conversation is a valuable document of Cylance at an inflection point. Stuart explains the core thesis in the direct way he delivered it to every skeptical audience: the detect-and-respond paradigm is fundamentally broken because it requires seeing something malicious before you can stop it. A machine learning model trained on the mathematical properties of executables — rather than signatures of known-bad files — can predict malicious behavior before execution, without needing to have seen that specific threat before.
Stiennon brings the kind of probing questions that surface the real substance of any security claim. He pushes on false positive rates, on the model's coverage of novel threats, on the economics of replacing incumbent security stacks. Stuart's answers are the kind that have characterized his best technical communication: specific, honest about limitations, and clear about where the evidence actually sits.
Looking back from the present, the interview captures a moment when prevention-first AI security was just beginning to prove itself. Within a few years, Cylance would demonstrate the model at scale, reaching a $1 billion valuation before its acquisition by BlackBerry in 2019.