Sign In

Graham McNicoll

Co-founder & CEO at GrowthBook (YC W22)

Graham McNicoll is a technology entrepreneur and software engineer who currently serves as the Co-Founder and CEO of GrowthBook, a Y Combinator-backed startup that provides an open-source feature flagging and experimentation platform.23

Professional Background

McNicoll has an extensive career in technology and engineering, with notable experiences including:

  • Education Background: Graduated from Carnegie Mellon University with a Bachelor of Science in Physics from 1996 to 200012

  • Previous Roles:

    • Vice President of Product and Engineering at Education.com (February 2020 - April 2020)
    • Chief Technology Officer at Education.com (November 2014 - February 2020)
    • Systems Architect at Education.com (January 2011 - November 2014)
    • Senior Software Engineer at Education.com (August 2007 - May 2011)
    • Co-founder and Senior Software Engineer at Worldlinked, Inc. (January 2004 - May 2007)2

Current Venture: GrowthBook

With GrowthBook, McNicoll aims to help companies make data-driven product decisions through feature flags and A/B testing. The platform solves common issues with existing SaaS solutions by using a company's existing data infrastructure and business metrics.3

Professional Skills

McNicoll has expertise in various technical skills, including:

  • PHP
  • MySQL
  • JavaScript
  • HTML5
  • React.js
  • Linux Server Administration
  • Search Engine Optimization
  • Database Design1

Personal Details

Highlights

Jul 24 · linkedin

𝐄𝐧𝐡𝐚𝐧𝐜𝐢𝐧𝐠 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐧 𝐅𝐢𝐧𝐭𝐞𝐜𝐡: 𝐌𝐢𝐧𝐢𝐦𝐢𝐳𝐢𝐧𝐠 𝐀𝐭𝐭𝐚𝐜𝐤 𝐒𝐮𝐫𝐟𝐚𝐜𝐞𝐬

TL;DR: • Security certifications alone are not enough to prevent attacks. • The best way to secure data is to minimize the attack surface. • Self-hosting tools can significantly reduce the risk of data breaches.

I recently received a letter from my bank stating that I should ‘not worry; my account was safe.’ This immediately worried me. The email mentioned a data breach at a partner bank that may have exposed our account information. This attack was impressive in scale. Evolve Bank and Trust, the bank behind finance apps such like Mercury, Affirm, and Wise, was compromised. The attackers stole a whopping 33 terabytes of data-roughly equal to half the online data from the Library of Congress. This likely represents almost the entirety of Evolve’s Azure Cloud storage.

The troubling aspect of this breach is that Evolve Bank and Trust had all the expected security certifications, including SOC 2 Type II, HIPAA, HITRUST CSF, and PCI DSS. Despite these certifications, the attackers still managed to infiltrate their systems.

Although we still don't know how the attackers breached Evolve, this incident highlights the importance of robust security practices. Architecting secure systems involves many principles, but the best way to secure data is not exposing it in the first place, thereby limiting the attack surface.

The attack surface is the sum of points where an attacker can attempt to enter or extract data from an environment. Reducing this surface is crucial as it limits the potential entry points an attacker can exploit. In 2022, the financial sector experienced 566 data breaches, exposing over 254 million records. This statistic highlights the critical need for enhanced security measures in the fintech industry.

In fintech, where the stakes are high, minimizing the attack surface is crucial to reducing breach risks. The safest data is not connected to the public internet. While cloud-based applications are convenient, they often overlook the need to limit the attack surface, regardless of the vendor's certifications. Hosting a service on-premises is the best way to add functionality without increasing your attack surface.

Self-hosting tools, whether air-gapped or behind your firewalls, can significantly reduce vulnerabilities. This approach doesn't impede innovation; most systems, including GrowthBook's feature flagging and A/B testing platforms, offer self-hostable solutions. By adopting self-hosting, you maintain security while leveraging the best tools available.

Oct 11 · linkedin

GrowthBook 1.7 is now out! It includes a lot of new features, including dark mode (who doesn't like dark mode?), improved ratio metrics, SQL Server support, self-hosted SSO (Okta, Azure AD, Google, etc), and saved groups for easier targeting. This release covers over 50 projects- kudos to the amazing GrowthBook team! Read more about it here:

Related Questions

What inspired Graham McNicoll to co-found GrowthBook?
How did Graham McNicoll's experience at Education.com influence his role at GrowthBook?
What are some of the key features of GrowthBook?
How has Graham McNicoll's background in physics influenced his career in technology?
What challenges has Graham McNicoll faced as CEO of GrowthBook?
Graham McNicoll
Graham McNicoll, photo 1
Graham McNicoll, photo 2
Add to my network

Location

San Francisco Bay Area