notessamuele onelia

Ten Years of Quiet Building Before The Newsletter Existed

The Story

Matt Johansen launched the Vulnerable U newsletter in 2023. The growth came from work he had done in the decade before launch (Source 1).

“I’ve been talking about cybersecurity on the internet since Twitter was born,” he told Growth In Reverse. “I ran a blog back when that was cool. I gave hundreds of conference presentations. I was on podcasts before that was cool. I just couldn’t shut up if you tried.” (Source 1).

That activity began at Adelphi. “I was a junior at Adelphi when Twitter first came out. I joined it but didn’t really see the point at first. Then I started finding people in the computer science industry I was interested in” (Source 2). From a dorm in Chapman Hall he ended up replying into a conversation between the heads of privacy and risk at Verizon and PayPal: “I was watching conversations people would pay to be a part of. I would interject a question, and they would actually answer me” (Source 2).

The output compounded into “industry clout” — a phrase he uses about himself — built by years of consistent public engagement (Source 1). His credentials accumulated alongside it: “As a former CISO with 15+ years of experience, I’ve helped defend startups to the world’s biggest financial institutions” (Source 3). He frames the credibility the same way to interviewers: “In cybersecurity, credibility comes from doing the work. I’ve been a practitioner for 18 years. That’s what earns trust” (Source 4).

Then the public output stopped. After joining Goldman Sachs and then Bank of America, he was told the public presence was off limits. “No tweeting, no speaking, no public presence. So he went dark. For years” (Source 1).

He started posting again only after joining Reddit, “a company that encouraged employees to be public-facing.” Around that same time a friend suggested he write a newsletter (Source 1).

When he announced Vulnerable U in 2023, the dormant audience converted instantly: “he converted 1,500-2,000 subscribers almost immediately from his existing 10,000 Twitter followers” (Source 1).

Lesson for Creators

The instant-conversion number is misleading on its own — it was paid for by ten years of helping people without trying to sell them anything. The audience that showed up at launch was the same audience that had been arguing with him in tweet threads and watching him at conferences since Twitter existed. Two corporate years of forced silence didn’t erase any of it. The lesson is that the unit of investment isn’t a launch campaign, it’s the decade of unmonetized helpfulness that earns the right to launch in the first place. If you’ve built that asset, you don’t need a growth hack at launch; if you haven’t, no growth hack will substitute for it.

Backlinks

External sources