An Interview with Jessica S. Hall
Tidal Cyber VP of Product Jessica S. Hall discusses scaling from Series A to Series B, responsible AI, customer-led product strategy and building a culture where people can thrive.
About the Interviewer:
Lydia Morfett-Murdock
Lydia is Vice President at Intaso, specialising in building Engineering, Product and AI teams for cybersecurity start-ups. She has placed more than 200 professionals across these functions, supporting businesses through periods of hypergrowth and helping them build high-impact teams aligned with their commercial and strategic goals.
Jessica S. Hall
Jessica S. Hall is Vice President of Product at Tidal Cyber, where she leads product strategy for a platform that helps security teams focus on the threats that matter most. She has spent her career building and transforming complex B2B products, helping teams get closer to their customers, make sharper product decisions and turn ambitious strategies into products people can use.
Key Takeaways
Scaling from Series A to Series B means moving from promise to proof. Cybersecurity startups must demonstrate that their products are reliable, easy to implement and capable of delivering measurable customer value.
Domain expertise should be assessed across the whole team. Product leaders from outside cybersecurity can add valuable experience in customer discovery, organisational design and scaling, provided strong cyber expertise already exists elsewhere in the business.
Customer insight should guide product strategy. Regular customer conversations, problem validation and prototype testing help product teams prioritise genuine needs rather than assumptions.
Good product decisions combine evidence with clear direction. Customer feedback, performance metrics and an agreed North Star give leaders a principled framework for making difficult trade-offs.
AI should solve a defined customer problem and produce results that can be evaluated. A credible AI use case needs high-quality data, measurable value, explainable results, ongoing evaluation and monitoring for drift, inaccuracy and bias.
Conventional software remains the better choice when it can solve the problem reliably. AI should not be added simply to support a marketing story or follow a market trend.
Tidal Cyber’s NARC AI turns unstructured cyber threat intelligence into MITRE ATT&CK-aligned knowledge. This can reduce hours of analyst work to minutes and help security teams act on threat intelligence faster.
Startup culture is shaped by leadership behaviour. Founders create cultural norms through what they reward, tolerate and model, whether or not those expectations have been written down.
Flexible, high-performing teams require intentional leadership. Clear priorities, decision frameworks and trust allow people to work independently while supporting parents and others with responsibilities outside work.
Watch the interview:
At Tidal Cyber, Jessica leads product strategy, helping security teams turn complex threat intelligence into clear, actionable decisions.
As part of Intaso’s interview series with women leaders across cybersecurity, Lydia Morfett-Murdock spoke with Jessica S. Hall about entering the industry from a non-traditional background, helping a business scale beyond Series A, finding valuable applications for AI and creating a culture that supports both high performance and life outside work.
You built your career across several industries before joining Tidal Cyber. How did you move into cybersecurity?
Jess: It may be surprising that I haven’t spent my entire career in cyber. I’ve worked across education, healthcare, media, financial services, information services and real estate, as well as with a couple of cybersecurity startups over the years.
I ran into Rick Gordon, one of Tidal Cyber’s co-founders and its CEO, at an event. We began talking about his product team, how he wanted the product to evolve and how the team needed to develop. It happened to coincide with me becoming available, and that became my first full-time role focused solely on cybersecurity.
The breadth of my background has proved useful. I can draw on work such as benchmarking hospitality companies around the world, analysing commercial real estate loans and assessing corporate maturity. Those experiences give me different ideas and ways of looking at problems that I can bring into Tidal.
What surprised you most when you began working in cybersecurity full-time?
Jess: Cybersecurity contains many different subdomains, each with its own language, values and ways of working. Whether I am speaking with somebody in vulnerability management, cyber threat intelligence, red teaming or compliance, they approach the job and the information in a slightly different way. Understanding how all those parts work together is fascinating.
I also joke that half the job is protecting the company and the other half is explaining to the company how you are protecting it. Security professionals usually tell me the second part takes much more than half their time.
Many cyber products do not fully account for that organisational dimension. A person’s job is not purely functional; it also has emotional and social aspects. How do they want to feel about their work, and how do they want others to see them?
Making a customer look good in a weekly status meeting might sound like a small thing, but it matters. Some of our customers have been called before their boards to discuss a threat and have been able to explain exactly what they had done, where the remaining gaps were and what they planned to do next. They left those meetings having answered the question and demonstrated the maturity of their security operation. I want every customer to have that experience after using our platform.
Cybersecurity employers often prioritise previous domain experience. What can a product leader from another industry bring?
Jess: Domain expertise is extremely valuable in a B2B company, but you have to look at the capabilities of the whole team rather than treating every hire in isolation.
Tidal already has deep cybersecurity knowledge across its founders, engineering, sales, marketing and customer success teams. Some of the world’s strongest MITRE ATT&CK expertise sits within the business. What the company also needed was an understanding of product management at this stage of growth: the problems businesses typically encounter next, how to solve them and how to build an organisation that can scale.
A product manager’s job is to seek answers, not to know every answer. Deep domain experience can occasionally work against people if it makes them feel they should already know or if they become threatened by somebody else’s expertise.
My approach is the opposite. If a subject-matter expert knows far more than I do, I want that person next to me. I recently spoke with a customer who had spent ten years building vulnerability management programmes at three different companies. I will not know as much as he does about that work. What I can do is understand his perspective, the outcome he wants for his team and the experience he is trying to create, then help make that possible through the product.
Curiosity, rapid learning and the ability to draw from adjacent industries are powerful. Much innovation comes from taking an idea that works in one context and making it useful in another.
That will not be the right answer for every company. If an organisation lacks market or subject-matter expertise, it may need that experience in its product leader. But if the expertise is already present and the business needs a different set of skills or ways of thinking, industry background should not become an unnecessary constraint.
What changes as a cybersecurity company moves from Series A towards Series B?
Jess: The details depend on the market and fundraising environment, but the fundamental transition is from selling a promise to delivering a dependable reality.
At Series A, you are often selling a view of how the world should work and how your company will solve a problem. Your earliest customers may share that vision. They want to join the journey and are prepared to move budget to do it.
Businesses can come out of the gate with strong sales and fundraising, then begin to stall. Reaching the next stage means selling to the early majority. Those buyers are not necessarily true believers in the vision alone. They need to know what the product can deliver, how reliable and easy to use it is, and how demanding implementation will be.
Cybersecurity adds a particular constraint because much of the budget is already allocated. A new product may have to displace an existing line item rather than create a new one. That means the product needs to solve the customer’s problem well enough, and cover enough of the relevant use cases, to earn that share of the budget.
There is also limited appetite for complex implementation projects. Security teams are already overloaded, so customers reasonably ask whether the value will justify the effort.
The companies that become stuck between Series A and Series B often struggle in one of two ways: they cannot retain customers because the product is not yet delivering consistently on its promise, or they cannot persuade the early majority because those buyers need evidence rather than possibility.
How does the role of the product leader evolve during that journey?
Jess: First, you need to articulate clearly where the organisation is going. At Tidal, I spend significant time with our three co-founders so we can understand the long-term vision, define a three-to-five-year North Star and identify the product pillars that matter most.
Second, you need a robust way to learn from customers. We speak with multiple customers every week. We validate problems, share prototypes and test whether what we are building will make sense in practice. My background is in UX design, as is that of our lead product manager, and we also have a UX designer, so the team is well equipped to do that work.
Third, you need operations that fit the company’s current size and stage. Many Series A businesses still run on heroics: one person holds something together with duct tape and sheer effort. That cannot last. The person will eventually burn out or leave, so the company needs sustainable systems.
Founders also tend to move further away from the day-to-day product as fundraising, customers, sales and other departments demand more of their time. If the connection between founders and the product team breaks, the product team can begin focusing on the wrong things. Maintaining that connection and a clear strategy is critical.
The company’s methods must evolve too. A planning process that worked three months ago may suddenly create friction. Change it. Early-stage companies do not yet have layers of corporate bureaucracy preventing them from adapting. Too many people try to lead the company they used to have instead of the company they want to become.
You described an “AI squeeze” affecting growing product companies. What does that mean?
Jess: Investors want an AI story because they believe it can improve the company’s growth and valuation. Leadership wants teams to do more with less. Customers and internal stakeholders want more capabilities. Meanwhile, engineering teams are dealing with the pressure AI places on infrastructure, performance, architecture and security.
That creates a squeeze: fewer people available to meet greater demand, with additional strain on the company’s underlying systems. Somebody can quickly prototype or “vibe code” an idea, but turning it into a secure, reliable product may still require days of backend work that nobody has planned or staffed.
AI has enormous potential, but leaders need to direct the effort towards the right problems and recognise the second- and third-order consequences for the rest of the organisation.
How do you make the constant trade-offs required at this stage of growth?
Jess: Every day is a trade-off day. Do we solve this customer’s problem or that customer’s problem? Do we focus on retaining existing customers or address the needs of a new segment? Which forward-looking investments will enable the next stage of growth?
You also have to consider the effects of each investment on other teams. If you expand sales without expanding customer support or engineering, more customers arrive but fewer people are available to look after them.
If you grow engineering without increasing product capacity, a larger engineering organisation depends on the same small product team. More salespeople and sales engineers also create more prospect feedback and product requests, all of which need to be triaged and validated.
The reality is that somebody will be disappointed by almost every prioritisation decision. I have to make the best decision I can with the best information available today, because not deciding is also a decision.
What helps people accept a difficult product decision?
Jess: It begins with listening. Product managers should regularly say, “Let me play that back,” or, “Here is what I heard.” People are more likely to accept an answer they do not like if they know they have genuinely been heard. More importantly, listening helps you gather the evidence and signals required to make a good decision.
You need strong inputs: customer conversations, feedback, metrics and other evidence. You also need something to point to, your North Star, principles or agreed organisational objectives. If an idea does not support anything the company has said is important, it can be placed in monitoring rather than prioritised now.
Finally, you need to deliver value regularly. If a decision proves wrong, as some inevitably will, you can change course. People will tolerate disappointment when they feel heard, understand that the decision was principled and trust that the team will keep learning and delivering.
It also helps to ask whether a decision is a one-way or two-way door. If it is easy to reverse and you will learn quickly whether it worked, move. If it will take a long time to implement, a long time to judge and a long time to undo, apply more rigour before committing.
What advice would you give leaders navigating the difficult journey from Series A to Series B?
Jess: There will be days when you think, “I am terrible at this and everything is on fire.” If you are trying to do something genuinely difficult and help a company fulfil its potential, those days are real.
Give yourself some grace. Take a walk, take a break and then come back to the question: what are we going to do next? You can only change so much at once, so progress has to be step by step.
A release will contain a bug. An idea you thought was brilliant will fall flat when customers see it. A process that worked recently will begin creating tension. You may believe you have explained something three times and realise the audience still does not understand. If they are not getting it, you need to find a better way to communicate it.
It is a constantly humbling process, but it also gives a product leader enormous scope to make an impact. In a large public company, you can work incredibly hard to move something a small distance because of legacy systems, organisational dependencies and internal politics. At this stage of a startup, the work is still hard, but the impact can be much greater.
Why is customer focus so central to your view of B2B product leadership?
Jess: I love B2B because I know many of my customers on a first-name basis. We can speak openly, learn together and see the effect that better products have on their work.
My goal is to be at the back of the room when a customer is presenting, quietly applauding while they have their moment. The product is there for the director of the SOC, the head of cyber threat intelligence, the red team leader or the person who must report to the board. It should help them be well informed, credible and thorough, and leave their leaders thinking, “We made the right decision when we hired this person.”
Product leadership is not about being recognised for your own brilliance. The question is: what did you help somebody else accomplish?
That matters particularly in cybersecurity. Our customers are protecting financial institutions and other important organisations. Helping them protect their own customers is meaningful work.
How do you decide whether AI belongs in a product?
Jess: I always begin with the customer problem and ask whether AI is the right way to solve it. A good AI use case needs to meet several tests:
- It must create clear value for the customer.
- We need enough high-quality examples and data to support it.
- We need a baseline measure of performance so we know whether it is an improvement.
- We must be able to validate the output and monitor it for drift, inaccuracy and bias.
- If conventional software engineering can solve the problem well, we should use that instead because it is generally cheaper and more reliable.
One strong use case at Tidal is NARC AI. A cyber threat intelligence report can take a skilled analyst several hours to decompose, map to MITRE ATT&CK and make operational. NARC can transform unstructured intelligence into ATT&CK-aligned knowledge in minutes, making that intelligence actionable much sooner. It saves time and expands what analysts can do, while producing outputs that can be checked and monitored.
AI is most useful when it removes drudgery and allows skilled people to spend more time on judgement and problem-solving.
What mistakes are companies making with AI?
Jess: Some organisations have rushed to describe themselves as agentic or added AI without being able to explain the underlying methodology, governance or value. Customers are right to be sceptical. They need to know where an output came from, why the system made a recommendation and whether they can trust it.
Imagine an AI system prioritising vulnerabilities. A security professional will reasonably ask, “Why these vulnerabilities, and why in this order?” The product needs enough explainability for an experienced practitioner to review the reasoning and judge whether it makes sense. The organisation then needs to validate whether taking the recommended action produced the intended result.
Think of it as a loop: understand the problem, collect the relevant data, make a decision, act, measure the result and feed that learning back into the system.
AI products often fail because teams build only part of that loop. They ship a model without the evaluation and monitoring needed to establish whether it is performing well. An AI capability will improve only if the team continues to tune and monitor it. If it is shipped and abandoned, its quality can deteriorate and create significant reputational risk.
The goal is not to sprinkle AI over everything. It is to identify the most important problems AI can solve, measure whether it is solving them meaningfully and keep the system accountable over time.
What does a supportive culture look like in a fast-growing cybersecurity company?
Jess: I have two daughters, one in elementary school and one in middle school. I enjoy my work, and I also want to be there for them.
Tidal is growing quickly, and the work is demanding, but the company also provides meaningful flexibility. Our co-founders and senior leaders are often the first to tell somebody to leave a call and attend to something important. That support should not be limited to parents; everybody should be able to have a life and respond when things come up.
We are largely distributed, with an office in Reston that people use when meeting in person is valuable. For the most part, people work remotely and have reasonable flexibility to organise their schedules while communicating clearly with their teams.
As a working parent, I have learnt that you will not win every day. Sometimes you simply did your best in a difficult situation, and you need to give yourself some grace. I have also learnt that deciding what not to do is one of the most important decisions you can make.
I intentionally design my schedule around the things that matter, from school logistics to sleep, exercise and the meetings that genuinely require my attention. Your calendar should not become a repository for everybody else’s objectives.
Has being a parent changed how you lead?
Jess: Being a parent makes every minute count. I enter a conversation wanting to understand what we are doing, where we need to get to and why it matters now. You learn to use the time available deliberately.
Leadership also means creating teams that can operate without you at the centre of everything. I have an excellent lead product manager. People do not always need to come to me; they can go to him, trust that he has a plan and know that he will involve me if needed.
Leaders should elevate the people around them and give them the tools to make good decisions independently. I use a “direction stack”: a clear one-line purpose, key strategic priorities and decision filters that explain what we optimise for. Those filters might clarify whether retention or growth takes precedence, or whether speed or accuracy matters most in a given context. The aim is to help people make sound decisions whether or not I am in the room.
Children are also wonderful teachers. Watching how they learn through examples can deepen your understanding of how AI systems learn. I once watched my daughter use generative AI to create something in Canva. She could picture exactly what she wanted, describe it, assess the result and explain precisely what needed to change. That ability to conceptualise, communicate and give feedback came completely naturally to her.
What should founders understand about building culture?
Jess: A startup’s initial culture comes from its founders, whether they define it intentionally or not. Culture is how people make decisions, what gets rewarded and how they treat one another both when others are watching and when they are not. Everyone looks to the founders for signals about those things.
As the business grows and many new people arrive with their own experiences and assumptions, it becomes important to crystallise the organisation’s values. Those values need to show up in ordinary behaviour. If a company says it is family-friendly but imposes rigid schedules and provides no practical support, it is not family-friendly. Values cannot just be slogans on a wall.
Leaders must model and uphold the culture they want. The more senior you become, the more closely people watch you, and the easier it is to underestimate the effect of your own behaviour.
A casual remark from a CEO can become an unwritten rule. If a leader once complains that there was no blueberry muffin at an event, teams around the world may spend the next two years ensuring that a blueberry muffin is always waiting. People look for subtle cues and often act on them much more intensely than the leader intended.
The same dynamic applies to what really matters. If you never leave work to attend your child’s school event, other people may not believe they are free to do so. If you say respectful behaviour matters but ignore bullying, you have compromised the culture.
Founders should choose the culture thoughtfully, build practices that reinforce it and address behaviour that conflicts with it. As the company evolves, parts of the culture may also need to evolve. Make those changes deliberately, because people throughout the organisation will feel them more strongly than those at the top.
Final Thoughts
Scaling a cybersecurity company requires more than a compelling vision.
The move beyond Series A demands:
- a product that reliably delivers;
- a team that listens deeply to customers;
- and leaders who can make principled trade-offs without losing momentum.
AI can help security teams act on complex information faster, but only when it addresses a real customer problem and is supported by good data, explainability, evaluation and ongoing monitoring.
The same intentionality applies to culture. Founders and leaders set the standard through their everyday behaviour. By creating clear direction, enabling others to make decisions and modelling the flexibility and respect they want to see, they can build companies where both people and products are equipped to grow.