Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Crafting Precise ICPs for Better Cybersecurity Marketing Outcomes with Sri Sundaralingam

Transcript

Crafting Precise ICPs for Better Cybersecurity Marketing Outcomes with Sri Sundaralingam · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: At various times in the journey of a startup, it's important to take a step back as a leadership team and assess the shape of the business.
• 0:39
  SPEAKER_00: You look at marketing, assess how sales is doing, alignment between the two, competitive in the market space, how good markets working in general, pipeline generation efforts, and on and on, lots of things to look at.
• 0:51
  SPEAKER_00: One of those times is when you get a leader who leaves.
• 0:54
  SPEAKER_00: And that's what happened at Cyber Donut recently, where the marketing leader up and quit.
• 0:59
  SPEAKER_00: And now the CEO wants to reassess the whole marketing efforts before deciding if and how to replace her.
• 1:06
  SPEAKER_00: Which is why I'm really pleased to have Sri Sundra Lingham on the podcast.
• 1:11
  SPEAKER_00: And Stri is the CMO at Zayde Security, and he's going to help us out.
• 1:15
  SPEAKER_00: Zaid is actually Sri's fifth startup and the third one where he is the marketing leader and is the person who's building out the whole marketing function.
• 1:25
  SPEAKER_00: So he has the experience, he has the stories, he of course has the wins and losses to be able to help us out in this process.
• 1:33
  SPEAKER_00: We cover all of that and also why he had breakfast with John Chambers when he was just a junior product manager at Cisco in the early 2000s.
• 1:43
  SPEAKER_00: I'm Andrew Monahan, and this is a Cybersecurity Go to Market Talk podcast where we tackle the question: how can Cyber Donut get to 10 million ARR by the end of 2025?
• 2:05
  SPEAKER_00: All right, Stream, welcome to the podcast.
• 2:08
  SPEAKER_00: Today, what we're doing is we're helping Cyber Donut.
• 2:12
  SPEAKER_00: In uh in a surprising turn of events, the marketing leader that we hired last year decided to quit uh at the start of this year.
• 2:20
  SPEAKER_00: And with the focus of getting to the$10 million in ARR, the CEO is thinking carefully about what he should be doing for the marketing side.
• 2:30
  SPEAKER_00: So what he's done is he's invited us in to go talk to him.
• 2:33
  SPEAKER_00: And we're gonna have uh a session where we think about and talk about what he should be, I guess, revalidating at least, or or looking at again, given that this is a chance to maybe reset and figure out the span and the focus for the end of the year.
• 2:50
  SPEAKER_00: So I guess the first thing is um if you were to have the conversation with the CEO, where would you start in trying to assess and think about the the way the marketing is going?
• 3:03
  SPEAKER_01: Yeah, and specific to uh I think we're focusing on pipeline generation as a key initiative, let's say, Andrew.
• 3:09
  SPEAKER_01: So um, but let's say even beyond pipeline generation, some other areas that need to be looked at.
• 3:16
  SPEAKER_01: Uh but pipeline generation, first and foremost, you know, thinking about it, uh looking at, you know, your ICP, right?
• 3:24
  SPEAKER_01: Based on uh what's the technology you're bringing to market, what would be your ICP, what's the current definition of it, what have you learned, how can you evolve it?
• 3:33
  SPEAKER_01: Uh that would be the first area, right, to look at.
• 3:36
  SPEAKER_01: The second one is your messaging positioning or an overall value proposition.
• 3:41
  SPEAKER_01: I mean, that's important, right?
• 3:43
  SPEAKER_01: Uh to uh position the company, you know, uh to the broader audience, as well as to help drive meaningful pipeline generation.
• 3:52
  SPEAKER_01: So I would look at that as a as a second area.
• 3:55
  SPEAKER_01: And you know, third area is what I found through my experiences, you know, when companies are in these stages, you're only a limited amount of investments.
• 4:05
  SPEAKER_01: And it's it's not even when you get beyond 10 million in ARR, it's not like you're given unlimited budget on the marketing side, right?
• 4:12
  SPEAKER_01: So you have to prioritize, scrutinize your investments, right?
• 4:17
  SPEAKER_01: Um most of the situations, what I've seen is most of the investment is going to go towards pipeline, you know, generation investments.
• 4:24
  SPEAKER_01: Uh, but regardless of whether how much is going to pipeline generation, how much is going outside of it, you know, look at the overall investment, scrutinize it, you know, make sure you're not peanut, you know, you're peanut, you know, peanut buttering your investments, right?
• 4:39
  SPEAKER_01: And not getting the ROI you need.
• 4:41
  SPEAKER_01: So those are the sort of the three areas I would go through, you know, with the CEO to help them.
• 4:46
  SPEAKER_00: Well, let's go back to the first one and ICP.
• 4:48
  SPEAKER_00: Now, when I hear people talk about ICP, or I've seen it in real life, I've seen everything from as vague as you know, CISOs, right down to people who go, CISOs of financial companies of over 10 billion in revenue with 50,000 employees who drink coffee on Tuesdays, kind of thing, right?
• 5:07
  SPEAKER_00: So where's the balance there that an early stage company might have about trying to figure out what what what area the ICP should should be really dialed in and which one should they maybe not think about?
• 5:18
  SPEAKER_01: Yeah, I mean, there you go.
• 5:19
  SPEAKER_01: You you nailed it.
• 5:20
  SPEAKER_01: Like if you go too broad, right?
• 5:22
  SPEAKER_01: If you if you sort of move with the move with an assumption, you're gonna go broad across, let's say, large enterprise, and you're gonna go target every industry, right?
• 5:33
  SPEAKER_01: And and then you're gonna be able to get to C level within those industries, uh, you're gonna it's gonna end in tears, right?
• 5:40
  SPEAKER_01: So one of my learnings is uh you know, you have to figure out like for the technology product that you're bringing to market, which specific industries would be of the best target, right?
• 5:52
  SPEAKER_01: Uh, you know, uh even within a large enterprise.
• 5:55
  SPEAKER_00: So vertical first then.
• 5:57
  SPEAKER_01: Yeah, and uh, you know, not I would say a lot of the times it works in cybersecurity because now it's a very competitive market in cybersecurity.
• 6:05
  SPEAKER_01: So many vendors, so many different solutions.
• 6:08
  SPEAKER_01: So I do believe in going vertical first, regardless of what you're whatever you're bringing to market.
• 6:14
  SPEAKER_01: And, you know, so in addition to the the verticals, the industries, um, you know, it's it's still important to map out the personas because if you're targeting large enterprise, everybody to your point will want to go after the CISOs.
• 6:27
  SPEAKER_01: But the CISO is already super busy, right?
• 6:30
  SPEAKER_01: Firefighting, helping you know, SRR team scale, run day-to-day business as much as focusing on strategy.
• 6:36
  SPEAKER_01: So you got to figure out, okay, in the security organization, who else, like who else, you know, who do you need to target who are key technology decision makers who may also have budget uh authority, right?
• 6:49
  SPEAKER_01: In addition to kind of you know, sharing that with the CISO for key purchases.
• 6:53
  SPEAKER_01: So, you know, that ICP definition, don't fool yourself, right?
• 6:58
  SPEAKER_01: Really scrutinize what are your key strengths of your technology, right?
• 7:02
  SPEAKER_01: And which industries uh can you succeed and which personas.
• 7:06
  SPEAKER_01: And sometimes you may even go beyond the security team if you if you're able to sell it to the business unit to get the budget allocated for a security initiative.
• 7:15
  SPEAKER_01: And I can give you an example uh that I learned at Shape Security.
• 7:19
  SPEAKER_00: Yeah, let's go with that.
• 7:20
  SPEAKER_01: Yeah, so at Shape Security early on, we were having a lot of success with uh e-commerce and financial services organizations.
• 7:27
  SPEAKER_01: So Shape Security had brought uh you know a very large-scale, advanced, sophisticated bot prevention, bot mitigation capabilities to market, right?
• 7:38
  SPEAKER_01: And initially the real traction was in you know large e-commerce type of companies.
• 7:44
  SPEAKER_01: You know, Starbucks was one of our clients early on, uh, financial services customer, customers, and you know, trying to sort of understand what's the value prof, right, for them to deploy this technology.
• 7:57
  SPEAKER_01: Well, fraud prevention was the biggest value profit, right?
• 8:01
  SPEAKER_01: So, like in e-commerce, a company could be you know losing, you know, tens of millions of dollars on an annual basis due to fraud, and a lot of that could you know originate from account takeover attacks, you know, your your threat actors basically targeting consumers, right?
• 8:18
  SPEAKER_01: Taking over their accounts and cashing out uh valuable assets in those accounts.
• 8:24
  SPEAKER_01: Ultimately, the brand that's dealing with it has to pay the price for it because those people are going to complain back to the brand that, hey, you know, my account got stolen.
• 8:33
  SPEAKER_01: Even though it may have been their fault, you know, they used a weak password or whatnot.
• 8:37
  SPEAKER_01: So one of my early experiences at Shape Security was when I was studying the market, um, you know, what I realized is, hey, this bot prevention technology can apply outside of e-commerce and financial services, right?
• 8:51
  SPEAKER_01: So without broadening too much, when we started to scale, you know, sales and marketing, uh, you know, really looking at which other verticals would be relevant.
• 9:00
  SPEAKER_01: And what we found out, you know, working with the sales team, you know, with some initial inquiries and conversations, you know, uh, travel and entertainment industries were getting hit with similar problems, right?
• 9:12
  SPEAKER_01: Where, like if you're an airline company or hotel company, you know, threat actors are targeting their, you know, end users, right?
• 9:20
  SPEAKER_01: Their customers and cashing out travel coins or valuable points uh that can be transferred to cash.
• 9:30
  SPEAKER_01: So it was really important to try to understand what is the technology, what is the key value prop, right?
• 9:36
  SPEAKER_01: And you know, how do you justify that purchase and then try to map that across uh you know to industries where you can succeed early on?
• 9:45
  SPEAKER_00: You know, one of the things that struck me as you were talking there, you said uh if you're honest with yourself, um I think you know, founders, especially maybe technical founders, are notorious for all the possibilities where their super magic widget they just built could apply all around different parts of the world.
• 10:03
  SPEAKER_00: Do you have to deal with that where you have to rein in the kind of expectations or the desires, I guess, of the finding team to say, look, we need to get the focus as opposed to think about the 45 different places this might be relevant?
• 10:15
  SPEAKER_01: Yeah, great question, you know, Andrew.
• 10:17
  SPEAKER_01: And uh I think founders should have that strong vision, that broad vision.
• 10:22
  SPEAKER_01: And what I try to educate is yes, let's put together the messaging and positioning and the value prop uh, you know, to have to to that to be more broader.
• 10:32
  SPEAKER_01: That's fine.
• 10:33
  SPEAKER_01: I wouldn't, you know, overly uh kind of uh fool yourself there either.
• 10:37
  SPEAKER_01: But like be real, if it's a large enterprise-focused way, you can put together the messaging positioning to be a little bit more broader.
• 10:43
  SPEAKER_01: But at the same time, you can also invest in things like content and in your website to target the specific industries, right, where you're gonna have traction and drive your pipeline generation that way and drive your sales team, you know, in terms of you know getting the qualified leads and meetings that can produce qualified deals and and start to succeed early on.
• 11:08
  SPEAKER_01: So there's nothing, you know, to your point, there's nothing wrong about actually being you know broad and having a you know uh a story that can resonate.
• 11:17
  SPEAKER_01: Uh, but at the end of the day, when the you know uh when the rubber hits the road, be real in terms of you know where are you going to win your initial deals and where are you gonna invest your dollars, right?
• 11:29
  SPEAKER_01: Uh for pipeline generation uh as an example.
• 11:32
  SPEAKER_00: And of course the salespeople never deviate from the ICP, right?
• 11:35
  SPEAKER_00: They're not off targeting anyone and everyone.
• 11:37
  SPEAKER_00: They're they're so good at keeping the laser focus on on the people that you tell them to.
• 11:42
  SPEAKER_01: Yeah, yeah.
• 11:42
  SPEAKER_01: No, that's a good point.
• 11:44
  SPEAKER_01: And you know, at startups, I think uh the uh there is it's good to have that you know curiosity on the sales team side.
• 11:52
  SPEAKER_01: So um, and what I found is, you know, yes, you need to go do that exploration, but let's do it in an educated way, right?
• 12:03
  SPEAKER_00: So, Sri, let's get to know a little bit more about you.
• 12:06
  SPEAKER_00: Uh believe it or not, I have a list of 49 questions here.
• 12:11
  SPEAKER_00: The good news is that we're not gonna ask you 49 questions, I'm gonna ask you three, and we're gonna use a really powerful AI-driven encryption protected algorithm to choose three completely random questions here.
• 12:26
  SPEAKER_00: And uh, I'm gonna use a little tool here.
• 12:28
  SPEAKER_00: You're gonna hear a noise, it's gonna be spinning the wheel, and whatever numbers it lends on are the questions I'm gonna ask.
• 12:34
  SPEAKER_00: You ready to go?
• 12:35
  SPEAKER_01: Yeah, let's go for it, Andrew.
• 12:36
  SPEAKER_01: Sounds really fancy right there.
• 12:43
  SPEAKER_00: All right, so the first one is number 21.
• 12:47
  SPEAKER_00: How did you make money as a kid?
• 12:49
  SPEAKER_01: Ah, good one.
• 12:51
  SPEAKER_01: Uh, my first job as a kid was a paper boy in Toronto.
• 12:55
  SPEAKER_01: I grew up in Toronto, Canada, and uh man, it was a fun job.
• 12:59
  SPEAKER_01: I got to meet my neighbors, so some great memories from that.
• 13:03
  SPEAKER_00: Now, when you were delivering papers, did you have to collect the money as well?
• 13:05
  SPEAKER_00: Was that part of the job, or do you just have to deliver them?
• 13:08
  SPEAKER_01: Uh sometimes I had to.
• 13:09
  SPEAKER_01: If the payments were overdue, that was part of my duties.
• 13:13
  SPEAKER_01: But most of the time I had to just deliver the papers.
• 13:16
  SPEAKER_01: Yeah.
• 13:17
  SPEAKER_00: So you at at age, whatever, very young, you were the henchman who showed up to demand the money.
• 13:21
  SPEAKER_01: Was that the and yeah, and sometimes we may not be, you know, uh an easy conversation, but you know, folks are usually polite uh when they know they're overdue.
• 13:30
  SPEAKER_01: Uh so but it was it was a good lesson, you know, in terms of um, you know, not just like you know how you make some money, but how you deal with different people of different backgrounds and you know how to be polite and be firm when you had to go remind folks that they were overdue with their payment.
• 13:47
  SPEAKER_00: Well, let's spin the wheel again for question number two.
• 13:55
  SPEAKER_00: All right, question number 19 this time.
• 14:00
  SPEAKER_00: Sri, what's an embarrassing or memorable moment in your work life that you want to share with us?
• 14:07
  SPEAKER_01: Um maybe a memorable moment early on.
• 14:10
  SPEAKER_01: You know, look, I got into cybersecurity 25 years ago, yeah, in you know, early 2000s uh at Cisco, and one of my uh memorable moments was I helped uh uh one of the sales teams at Cisco cracked into uh Wake Forest University.
• 14:26
  SPEAKER_01: Uh Cisco was trying to get into that account, and I had no idea how important that uh customer was, but I was simply helping, doing uh my best from the product side, from the headquarters side, working with the sales team.
• 14:40
  SPEAKER_01: And when they won the account, they nominated me uh for a breakfast event with John Chambers, and then I came to find out his daughter's actually been to that college and he he was tracking the entire account.
• 14:54
  SPEAKER_01: So uh it was it turned out to be a memorable moment in a positive way.
• 14:58
  SPEAKER_00: Do you remember what a big takeaway you had from having breakfast with him?
• 15:01
  SPEAKER_01: The big takeaway.
• 15:02
  SPEAKER_01: Oh, I mean, uh, man, doesn't matter whether you're running uh a 1450 company or a small startup, be humble as a leader.
• 15:11
  SPEAKER_01: Uh Don Chambers was one of those folks.
• 15:13
  SPEAKER_01: Uh doesn't matter who you were, he ran into you in the air elevator or you know, a customer meeting or whatnot.
• 15:20
  SPEAKER_01: Uh, he was a great individual as a leader.
• 15:23
  SPEAKER_00: It's good to hear people that you look up to are actually like that in real life.
• 15:26
  SPEAKER_00: So uh thanks for confirming that for me.
• 15:28
  SPEAKER_00: Let's do the last one.
• 15:29
  SPEAKER_00: I'll spin the wheel again.
• 15:35
  SPEAKER_00: All right, number 48, Shri.
• 15:38
  SPEAKER_00: What is the story behind you getting your first job in cybersecurity?
• 15:43
  SPEAKER_01: Ah, good one.
• 15:43
  SPEAKER_01: Yeah.
• 15:44
  SPEAKER_01: So as I mentioned earlier, uh Andrew, so back in this was 25 years ago, I was working early 2000 at uh Cisco for the uh the desktop, enterprise networking group, actually.
• 15:56
  SPEAKER_01: And we had integrated Wi-Fi into enterprise networking portfolio.
• 16:01
  SPEAKER_01: And if you remember back then, Wi-Fi security was broken.
• 16:05
  SPEAKER_01: You know, Web uh was a basic security that was broken.
• 16:09
  SPEAKER_01: A lot of enterprise customers were nervous.
• 16:11
  SPEAKER_01: Uh, they needed somebody from the the desktop business unit, uh, desktop switching, the Wi-Fi business unit to work with the security team to come up with, you know, uh good sort of architecture options for the enterprise to adopt.
• 16:26
  SPEAKER_01: So that's how I got into security.
• 16:28
  SPEAKER_01: I started working with the security business unit at Cisco and uh uh yeah, never looked back.
• 16:34
  SPEAKER_01: Uh that's you know, getting in from the product side in a more of a technical evangelist type of a function.
• 16:40
  SPEAKER_01: And uh it's been a fun ride.
• 16:42
  SPEAKER_00: That's awesome.
• 16:42
  SPEAKER_00: What a great way to get into it, right?
• 16:47
  SPEAKER_00: So for Cyber Donut then, we want to say have we had some creep?
• 16:51
  SPEAKER_00: All right.
• 16:52
  SPEAKER_00: Are we suddenly in more than two or three focus areas on the ICP side?
• 16:57
  SPEAKER_00: And if we are, we probably need to have a discussion about how we bring it back to the ones where we think we can win and uh win more effectively.
• 17:04
  SPEAKER_00: So let's move on to the messaging and positioning.
• 17:08
  SPEAKER_00: This is something I think that you know some people might look at and go, well, it's all a little bit fluffy, or you know, positioning and things like that.
• 17:16
  SPEAKER_00: Where does this play, though, in terms of this importance for thinking about marketing investments and programs?
• 17:22
  SPEAKER_01: Yeah, so um, you know, this is where like I think about brand, right?
• 17:27
  SPEAKER_01: You know, developing a strong brand for the company is important from early on.
• 17:31
  SPEAKER_01: Now you're gonna continue to evolve in terms of what your you know key uh key messaging, your positioning and overall value prop is, and that's okay as you learn in the market.
• 17:43
  SPEAKER_01: Um, but I think you know, having you know a more concise story in terms of what your capabilities are, right?
• 17:50
  SPEAKER_01: And being able to talk to your buyers is important.
• 17:53
  SPEAKER_01: I think if you come across uh you know too broad, too generic, uh you're gonna get lost in the noise, right?
• 18:01
  SPEAKER_01: So, you know, again, you know, we're at a couple of thousand vendors now in the cybersecurity industry.
• 18:06
  SPEAKER_01: If everybody sounds like the same, buyer is not gonna distinguish.
• 18:10
  SPEAKER_01: Okay, why do I need to engage with you?
• 18:12
  SPEAKER_01: It's as I have tools, you know, security controls X, Y, and Z already.
• 18:17
  SPEAKER_01: So you do need to be you know more focused in terms of like what problems you're solving, right?
• 18:23
  SPEAKER_01: Uh and you know, uh what's the overall value you can bring to your key target buyers in your messaging?
• 18:30
  SPEAKER_01: A website is one of the important decisions, uh important investments where you have to make early on.
• 18:36
  SPEAKER_01: Uh and and you know, really do a good job at that because you know, as as you're starting to do your outreach in different channels, you know, your your your potential interested buyers are going to come to your website to kind of validate because there's not gonna be other places they can validate you.
• 18:52
  SPEAKER_01: So they will initially come and try to make sense of, okay, you know, what does this company actually do?
• 18:57
  SPEAKER_01: What capability do they actually bring to market?
• 19:00
  SPEAKER_00: Aaron Powell You know, a few years ago, I used to run uh new heart training at one of the bigger companies in the in the industry.
• 19:07
  SPEAKER_00: And I used to do this exercise where I'd asked them to write the value prop for the company that we were at.
• 19:13
  SPEAKER_00: And they were very different viewpoints on what a value prop is.
• 19:18
  SPEAKER_00: Uh never mind what it actually should be for that company, right?
• 19:21
  SPEAKER_00: If someone's like, well, what's the three line, three-word slogan?
• 19:24
  SPEAKER_00: And some of you were you know two minutes deep into a long solilique way about where they fit in the market.
• 19:29
  SPEAKER_00: What what should it sound like?
• 19:31
  SPEAKER_00: I don't know if you can do it for where you are, Sage, you know, exage if if you're the CMO.
• 19:35
  SPEAKER_00: What is what's a good value prop structure or what's a good example that you could show us?
• 19:41
  SPEAKER_01: Yeah, great question.
• 19:42
  SPEAKER_01: Um maybe I'll go back to my shape security and provide that example.
• 19:46
  SPEAKER_01: Uh early on, uh when uh you know the founders and the team had launched Shape Security, there was a great messaging they had used about fighting, you know, AI, the bad AI with good AI.
• 19:59
  SPEAKER_01: Great messaging from a brand perspective, you know.
• 20:02
  SPEAKER_01: Uh and they were one of the companies who had operationalized, you know, how AI can be used by the good guys, right, to protect against, you know, uh a different type of adversaries, right?
• 20:13
  SPEAKER_01: The problem with that was uh it's good from a brand perspective to get media attention and get the market excited.
• 20:20
  SPEAKER_01: But when you start talking to the buyers, uh usually the conversations start to kind of derail.
• 20:25
  SPEAKER_01: What exactly do you do, right, in terms of protecting against bad AI?
• 20:30
  SPEAKER_01: Like what are the specific security controls?
• 20:32
  SPEAKER_00: So it's too, it was too vague, right?
• 20:34
  SPEAKER_00: That that sounds to me like it's too vague just to say that.
• 20:37
  SPEAKER_01: Yeah, exactly.
• 20:38
  SPEAKER_01: So now what we did there is what we realized the biggest value add we were bringing with the you know the bot prevention, bot uh protection technology is you know, we were really providing advanced, one of the strong use cases initially is we were providing advanced, you know, website security, right?
• 20:56
  SPEAKER_01: You know, advanced website protection.
• 20:59
  SPEAKER_01: So when we kind of pivoted to that as a central theme over a valley proposition and started talking about how we can protect from account takeover attacks, right?
• 21:11
  SPEAKER_01: And we can protect from you know, even like uh website scraping that could be an issue for certain types of companies in certain verticals.
• 21:19
  SPEAKER_01: So then it's you know, that's there's an example where your value proposition is more focused in terms of how your technology can be applied to solve problems in terms of the target audience you're going after.
• 21:32
  SPEAKER_01: Then you know the education started to become a lot easier, whether it was educating in a first meeting through a pitch tag or through the website, right?
• 21:41
  SPEAKER_01: Uh in terms of offering relevant content, right?
• 21:44
  SPEAKER_01: In terms of use cases, right?
• 21:46
  SPEAKER_01: In terms of case studies and stuff like that.
• 21:49
  SPEAKER_01: Then you know you start to unlock that potential uh in terms of engaging with more and more interested in our buyers.
• 21:55
  SPEAKER_00: Aaron Powell Another area alongside that in my mind, anyway, is thinking about differentiation.
• 22:01
  SPEAKER_00: Um I think that you know there's what 4,000 vendors right now in cybersecurity, not including resellers and MSSPs and things like that.
• 22:09
  SPEAKER_00: You know, there's a there's a very credit market and trying to figure out how do we describe what we do one-on-one in front of a prospect so that they it's interesting, compelling, and they remember it, right?
• 22:19
  SPEAKER_00: No buzzwords, things like that.
• 22:21
  SPEAKER_00: And it's kind of funny.
• 22:22
  SPEAKER_00: I I I I'd work with uh companies uh on this stuff.
• 22:26
  SPEAKER_00: Um I actually was with a exec team yesterday and the day before, they spent four hours batting around.
• 22:32
  SPEAKER_00: And what their differentiation really is and what it should be and how to describe it, things like that.
• 22:36
  SPEAKER_00: And this company's been around for about five to eight years already.
• 22:39
  SPEAKER_00: So it wasn't like they were just getting going.
• 22:43
  SPEAKER_00: Where does differentiation fit in terms of overall messaging and how we should be thinking about it, both from the marketing side, but also from the sales side?
• 22:52
  SPEAKER_00: Yeah, great question, Andrew.
• 22:53
  SPEAKER_01: And I think, you know, I think about it more like the funnel, right?
• 22:57
  SPEAKER_01: You know, the early stages of the funnel, um, I think you're you're trying to educate the audience, right?
• 23:03
  SPEAKER_01: Like, you know, in terms of just building awareness, like what problems are you solving, right?
• 23:09
  SPEAKER_01: Uh, and talking about it in terms of the end user's language, right?
• 23:14
  SPEAKER_01: In terms of specific problems they're dealing with and what are potential solutions.
• 23:19
  SPEAKER_01: Um differentiation is important there, but not as much in terms of trying to get them to, you know, uh, you know, trying to get them to kind of you know engage with you, right?
• 23:30
  SPEAKER_01: In terms of, okay, where can I engage this company in terms of what problems can they help me solve.
• 23:35
  SPEAKER_01: When when you start to move down the funnel a little bit, like middle part of the funnel, right?
• 23:40
  SPEAKER_01: As you engage more and more potential interested buyers, what you're saying totally makes sense is differentiation is key because you know, when when buyers you know move into consideration phase, there's a lot of ways to solve specific problems, right?
• 23:55
  SPEAKER_01: That's where you have to make the case in terms of you know, what are the differentiated capabilities that you're bringing to market that's going to be really materialistic to them, right?
• 24:04
  SPEAKER_01: Whether it's you know more capabilities or you're solving the problem in a different way, right?
• 24:10
  SPEAKER_01: Uh that can accelerate time to value, you know, for the end users, or whether you're saving money, right?
• 24:15
  SPEAKER_01: Whatever those differentiators are, I think that's when you start to talk to your interested buyers to kind of solidify their interest so that you could kind of further move that conversation.
• 24:27
  SPEAKER_00: Yeah, it's uh it's always an interesting discussion leading a workshop around differentiation because you know you got different views.
• 24:33
  SPEAKER_00: You got you got the views of people who are at the coalface on the sales side, going, you know, yeah, you might like that to be different, but it's not.
• 24:41
  SPEAKER_00: And then you've got the visionary, well, this should be different in this way.
• 24:44
  SPEAKER_00: And it gets into a lot of interesting conversations usually when you when we go through that.
• 24:49
  SPEAKER_00: Um so that's the messaging positioning.
• 24:52
  SPEAKER_00: Now let's talk about where the program meets the road.
• 24:55
  SPEAKER_00: We've got some money this year.
• 24:56
  SPEAKER_00: Uh we need to figure out where we're gonna invest it for the biggest impact.
• 25:00
  SPEAKER_00: Um, I almost feel like there's a a bit of a tension with, you know, you say to the CEO, the CFO, I'm gonna invest in brand or I'm gonna invest in in PG or something like that.
• 25:11
  SPEAKER_00: And they kind of go, well, brand sounds fuzzy.
• 25:13
  SPEAKER_00: PG, let's get some pipeline, right?
• 25:16
  SPEAKER_00: Uh how do you how do you navigate that conversation with people?
• 25:20
  SPEAKER_01: Yeah, so I think um first of all, pipeline generation without investing in brand won't succeed, you know.
• 25:28
  SPEAKER_01: Uh while the stage that you know that you're in, you know, leading to 10 million in ARR, pipeline generation does matter a lot.
• 25:36
  SPEAKER_01: So majority of the investment is going to go towards that.
• 25:39
  SPEAKER_01: But if you complete a star of your quote unquote brand investments, then you're not going to succeed.
• 25:45
  SPEAKER_01: So we talked about the website, right?
• 25:47
  SPEAKER_01: So the brand investment doesn't have to be as you know highly expensive, but you know, making sure, again, your website is properly invested in with fit content, right?
• 25:59
  SPEAKER_01: You know, uh that's for the different sort of phases, right?
• 26:02
  SPEAKER_01: As I mentioned earlier, that's key.
• 26:05
  SPEAKER_01: Um, and then you know, there may be some other brand investments you may want to do, uh, but don't don't totally starve it and then just put everything into your pipeline generation because you're not going to help yourself.
• 26:16
  SPEAKER_01: Uh, specific to pipeline generation uh investments, don't peanut butter either, right?
• 26:22
  SPEAKER_01: Because I think in the security industry there is um a temptation to you know go after some large uh conferences, you know.
• 26:30
  SPEAKER_01: Uh and you may want to spend a lot of money in these large conferences, but what is the ROI going to be?
• 26:35
  SPEAKER_01: Right.
• 26:36
  SPEAKER_01: Um, so you really need to think through for pipeline generation investment, you know, back to mapping back to your ICP.
• 26:43
  SPEAKER_01: How can you get to your key buyers, right?
• 26:47
  SPEAKER_01: In those key industries, and how can you produce meaningful, you know, uh uh qualified leads for your sellers that can convert to pipeline?
• 26:57
  SPEAKER_00: You know, uh it's interesting as you connect the pipeline generation to the brand.
• 27:02
  SPEAKER_00: Like you know, recently, of course, we've had Wiz who are known for their branding, their experience, you know, all the things that you would think usually might be fluffy, but they became known for it, right?
• 27:13
  SPEAKER_00: And probably right now is a bunch of uh people scratching their heads going, how can we more at Wiz?
• 27:18
  SPEAKER_00: Uh just recently, though, in the last few weeks, uh interestingly enough, Sublime Security.
• 27:24
  SPEAKER_00: So Colin Jones was the first CRO at Wiz.
• 27:28
  SPEAKER_00: He's now the thing the president at Sublime.
• 27:30
  SPEAKER_00: And if you look at what they're doing with the brand, it's very powerful, right?
• 27:34
  SPEAKER_00: They you know, they've all got the same LinkedIn backgrounds that patches up to the colors on the website, and it's just all the way through.
• 27:41
  SPEAKER_00: It really feels like they put a lot of effort into making sure that it's aligned properly.
• 27:46
  SPEAKER_01: Because you know, purchasing, if you think about it, as much as there's a lot of logic is involved and a lot of you know uh structured way to decide who are you going to, you know, buy, there's emotions are involved as well.
• 27:59
  SPEAKER_01: Like cybersecurity is a business where you know buying cybersecurity, you know, security controls, it's kind of like you're buying insurance policies, you know.
• 28:08
  SPEAKER_01: So who are you going to trust?
• 28:09
  SPEAKER_01: So emotions are involved.
• 28:11
  SPEAKER_01: And I couldn't agree more.
• 28:12
  SPEAKER_01: I think being able we make sure the buyers, you know, uh can you know sort of relate to you and they can, you know, giving giving that you know uh impression or g you know, enabling them to be able to trust you is really key.
• 28:28
  SPEAKER_01: And you can't do that without thinking through what are you know some you know important investments you gotta do on the brand side, right?
• 28:35
  SPEAKER_00: Aaron Powell Yeah, I really feel like you you gotta do each element of this very well to have a chance of standing out in the first place, you know, because it is so noisy.
• 28:44
  SPEAKER_00: So just what you're saying about events, I just did a quick search, Sharie.
• 28:47
  SPEAKER_00: So you know, I I people always have this impression that RSA, for example, you know, good conference and all the rest of it, but everyone's there is what you hear, right?
• 28:54
  SPEAKER_00: There's a lot of people there, we've got to be there.
• 28:56
  SPEAKER_00: If we're not there, people might notice and things like that.
• 28:59
  SPEAKER_00: I just did a quick search.
• 29:00
  SPEAKER_00: So there's 4,000 vendors in cybersecurity.
• 29:03
  SPEAKER_00: There's only 382 right now who are signed up for a booth at RSA.
• 29:08
  SPEAKER_00: So less than 10% of the vendors are actually gonna be at RSA with a booth.
• 29:13
  SPEAKER_00: Now, there's gonna be people doing meetings around anyway, but they don't actually have a booth.
• 29:17
  SPEAKER_00: So I thought that's kind of interesting to say that most of the industry doesn't actually spend money on a booth at RSA.
• 29:23
  SPEAKER_01: Yeah, and I think um, you know, it's not just RSA, there's black ad, there's other conferences, right?
• 29:29
  SPEAKER_01: So those are tough decisions, I think.
• 29:31
  SPEAKER_01: You know, in this particular scenario, the cyber donut scenario, the march up to 10 million ARR, like uh if you got limited overall funding, uh, then you know, investing in a large conference uh, you know, could uh cost you an arm and a leg.
• 29:47
  SPEAKER_01: And, you know, we're competing for attention with hundreds of other vendors.
• 29:51
  SPEAKER_01: And, you know, it may be good for your brand in some way to be there, but will it really result in not a qualified uh pipeline, right?
• 29:59
  SPEAKER_01: Uh so that is that is type that is a type of tough decision you need to wrestle with.
• 30:04
  SPEAKER_01: Uh what I can tell you, you know, I've done, you can participate in these large conferences because you know you can submit for papers, right?
• 30:11
  SPEAKER_01: Uh that's free of charge, right?
• 30:13
  SPEAKER_01: And you know, they have other uh, you know, sort of programs they highlight, like RSA has their uh sandbox, right?
• 30:21
  SPEAKER_01: Innovation sandbox and other programs they highlight upcoming technologies and innovation.
• 30:26
  SPEAKER_01: So I think you engage in that.
• 30:28
  SPEAKER_01: And uh you can also be creative in terms of some events you can do outside of the conference, some auxiliary event.
• 30:36
  SPEAKER_01: Um, you know, when I was at J Security, uh one of my team had proposed a bunch of options for RSA.
• 30:43
  SPEAKER_01: This was seven, uh, nine years, eight or nine years back, sorry.
• 30:47
  SPEAKER_01: And uh, you know, one of the auxiliary events they had proposed was to work with, you know, this uh this company that ran an experience uh in a sailing experience experience on a yacht.
• 31:00
  SPEAKER_01: And uh this yacht is actually a retired yacht from uh you know Larry Elizabeth's Oracle Team USA, uh, one of the cup winning yachts.
• 31:09
  SPEAKER_01: And uh you get to have uh the guy who was the manager for Larry Alison as a skipper for the yacht.
• 31:15
  SPEAKER_01: And you know, I was like, I'm like, why not?
• 31:18
  SPEAKER_01: Let's give it a try.
• 31:21
  SPEAKER_01: Whether the weather is gonna be predictable or not.
• 31:24
  SPEAKER_01: And I mean, who knows how many CISOs would be interested in.
• 31:27
  SPEAKER_01: And uh sort of Andrew, we we packed up a yacht with, you know, I don't know, close to 20 CISOs having a great experience, uh, learning from the former manager of Larry License uh team USA.
• 31:39
  SPEAKER_01: And so those are the things that you got to challenge yourself.
• 31:42
  SPEAKER_01: Like, what can you do, you know, outside of the kind of the normal boundaries where you can be creative and you know get the excitement and help generate the qualified pipeline.
• 31:51
  SPEAKER_00: Yeah, it's funny you mentioned that.
• 31:53
  SPEAKER_00: So uh last year I went to RSA, RSA.
• 31:56
  SPEAKER_00: And my thing about RSA is that I want to meet people and I want to meet CROs and CMOs and people like that, and I want to network a bit, but they don't necessarily want to meet me because I'm not gonna pay, I'm not paying them money, I'm taking money from them, right?
• 32:08
  SPEAKER_00: So their priority is to meet with prospects, not necessarily meet with someone like me.
• 32:12
  SPEAKER_00: So I was thinking like, how do I stand out?
• 32:14
  SPEAKER_00: How do I do something that they might actually attend?
• 32:16
  SPEAKER_00: So uh I actually did cyber CROs and a cyber truck.
• 32:21
  SPEAKER_00: I and this is this is a year ago, so slightly different kind of you know thoughts about cyber trucks back then.
• 32:26
  SPEAKER_00: It was more novel.
• 32:27
  SPEAKER_00: But uh I had it, I rented it for two days, I spent about$3,000 total, and it had 20 meetings with uh 20 CROs over two days, right?
• 32:37
  SPEAKER_00: And it's like, well, there, right?
• 32:39
  SPEAKER_00: That's if if I if I did it in a in a in a mini or something like that, it wouldn't have got the same effect.
• 32:44
  SPEAKER_00: If I said, let's just meet in the coffee shop, it wouldn't have the same effect.
• 32:47
  SPEAKER_00: But just having the cyber truck was the was the hook.
• 32:50
  SPEAKER_00: And it was a lot of fun, it really was.
• 32:52
  SPEAKER_01: Yeah, true experience.
• 32:53
  SPEAKER_01: I'll give you one more example on the events, you know, Andrew.
• 32:56
  SPEAKER_01: Uh this is a it's a tough thing to wrestle with for a lot of early to mid-stage startups.
• 33:02
  SPEAKER_01: And um, you know, uh uh one of the things you can do is you can you know back to the ICP, right?
• 33:08
  SPEAKER_01: Figuring out which industries you're gonna go target.
• 33:11
  SPEAKER_01: Like at Zage Security, early on when I came in, we were targeting the oil and gas industry, right?
• 33:17
  SPEAKER_01: So one of our key industries.
• 33:18
  SPEAKER_01: So as I did more research on that with my team and talking to my sales team uh and Zage, what I found out is uh there's an institution called American Uh Petroleum Institute.
• 33:29
  SPEAKER_01: Uh I don't know if you heard of heard of them, ATI.
• 33:33
  SPEAKER_01: Uh they were founded more than 100 years ago to define spec for oil and gas pipelines, how to transfer oil and gas.
• 33:41
  SPEAKER_00: And along the way.
• 33:42
  SPEAKER_00: Sri, I've got to tell you, when you say the American Petroleum Institute, all I think about is maybe Texas oilmen with their hats on, you know, drinking bourbon and talking about oil flows or something, not talking about cybersecurity.
• 33:53
  SPEAKER_00: So I'm interested to know what you're gonna say.
• 33:56
  SPEAKER_01: Exactly.
• 33:56
  SPEAKER_01: You know, so well, credit to this uh, you know, organization, American Petroleum Institute.
• 34:02
  SPEAKER_01: They've established many working groups, right?
• 34:05
  SPEAKER_01: So uh it's a nonprofit organization.
• 34:08
  SPEAKER_01: They've established very many working groups, and one of them is cybersecurity.
• 34:12
  SPEAKER_01: It became more and more important to them, you know, a couple of decades ago as oil and gas pipelines and you know, uh whether it's even drilling sites, right?
• 34:23
  SPEAKER_01: Everything is interconnected now, right?
• 34:25
  SPEAKER_01: We call it upstream, midstream, downstream.
• 34:28
  SPEAKER_01: When you look at oil and gas, everything is you know uh interconnected.
• 34:31
  SPEAKER_01: So they started the cybersecurity practice uh a couple of decades ago, and it's grown and grown.
• 34:37
  SPEAKER_01: And they do an annual event in Houston, uh API oil and gas cybersecurity summit.
• 34:42
  SPEAKER_01: It's attended by security architects to managers, directors, to CISOs who are in the oil and gas industry.
• 34:48
  SPEAKER_01: So that's the type of research you got to do and challenge yourself and figure out, okay, you have a limited amount of dollars.
• 34:55
  SPEAKER_01: How will you go, you know, how are you gonna go invest, right, in pipeline generation that can be, you know, really materialist to help grow the business?
• 35:03
  SPEAKER_00: That's great, though.
• 35:04
  SPEAKER_00: I mean, I think there's the anchor uh events, you know, there's the ones that people kind of do, the ISACs and then the Gartner and things like that.
• 35:13
  SPEAKER_00: But that's really interesting.
• 35:14
  SPEAKER_00: So, what are the either vertical or maybe regional little specialist ones that aren't obvious or aren't well known, where you might get uh for your dollar anyway, a much bigger impact for your dollar, even though it won't necessarily be as big, let's say, as an as an RSA or Black Hat.
• 35:29
  SPEAKER_01: Exactly.
• 35:30
  SPEAKER_01: And one last thing I would add is, and I've learned this the hard way in pipeline generation, you know, uh having a business development, a BDR function is key, right?
• 35:41
  SPEAKER_01: And I think uh early on, you know, you may not be able to fund the heads, right, if the company is small enough.
• 35:48
  SPEAKER_01: Uh you're at the stage where you know you need to hire key salespeople, right?
• 35:53
  SPEAKER_01: You need to fund pipeline generation activities.
• 35:56
  SPEAKER_01: You may not be able to hire a BDR inside a business development team.
• 36:00
  SPEAKER_01: You could work with an out, you know, an outsourced one.
• 36:03
  SPEAKER_01: And this could be a separate topic itself, you know.
• 36:06
  SPEAKER_01: Uh, but but uh I think you know uh it's it's okay to do that early on.
• 36:11
  SPEAKER_01: You know, you allocate part of your pipeline generation dollars towards an outsourced BDR firm.
• 36:17
  SPEAKER_01: And you know, I think there is a point in that journey as you approach 10 million ARR, uh, you will want to switch to an inside team.
• 36:26
  SPEAKER_01: It becomes, you know, I think it's a transition you can work through.
• 36:29
  SPEAKER_01: Uh, but you know, having a BDR team, uh, right, a business development team is key because it can be just about, you know, from a marketing perspective, generating, you know, qualified leads and then as your salespeople get busy, as you know, Andrew, not every lead is gonna get followed up.
• 36:47
  SPEAKER_01: So having that BDR function becomes also critical in your journey.
• 36:51
  SPEAKER_00: Would you use the BDR function to help with events as well, rather than just generate you know meetings for salespeople?
• 36:57
  SPEAKER_01: Well, yeah, absolutely.
• 36:59
  SPEAKER_01: You could staff uh you know BDRs at your events.
• 37:02
  SPEAKER_01: Uh they do a really good job.
• 37:05
  SPEAKER_01: Um uh why not?
• 37:06
  SPEAKER_01: Yeah, yeah.
• 37:07
  SPEAKER_01: I mean, they're they're essentially uh the you know, a typical profile of a BDR is you're early on in your career as an account executive, right?
• 37:15
  SPEAKER_01: Uh now you may be you know doing it for a while as well.
• 37:19
  SPEAKER_01: There are a lot of you know BDRs who have kind of stayed the course and they just like doing that.
• 37:24
  SPEAKER_01: Uh, but regardless, um, you know, I think uh they're very capable, you know, to go to an event, help your you know, team engage with prospects.
• 37:32
  SPEAKER_00: So Sri, we have to wrap up here, but I'm gonna put you on the spot.
• 37:35
  SPEAKER_00: Is there one one thing, one program, one uh activity that you think right now for the for the spend, uh the return on spend is really good right now that perhaps other people haven't caught on to yet or aren't thinking about?
• 37:52
  SPEAKER_01: Yeah, I don't know if there is like one spectacular spend, you know, Andrew.
• 37:56
  SPEAKER_01: There's like there's no silver bullet, unfortunately, because cybersecurity, as we talked about, have become a hotly contested market, you know.
• 38:04
  SPEAKER_01: Uh, but uh I think the one thing, again, I'll go back to Hammer on is uh it's it's really being you know honest yourself and really you know sort of uh having those tough conversations to figure out you know what is the right ICP, you know, and mapping that to your key investments.
• 38:24
  SPEAKER_01: If you're not honest to yourself, what is your right ICP, where are you gonna be able to win?
• 38:29
  SPEAKER_01: Uh it's it's it's it's not going to progress the company.
• 38:33
  SPEAKER_00: Aaron Powell That's that's very good.
• 38:35
  SPEAKER_00: It's funny, one of the exercises I do with uh my clients is a constraints exercise, right?
• 38:41
  SPEAKER_00: And it's not, I say to the salespeople, if if you could only work five accounts this year, even though your territory's got 150, if you could only work five accounts and that's all you get paid on, which five would you pick and why?
• 38:51
  SPEAKER_00: No, it's not because that's what what I want to give them.
• 38:53
  SPEAKER_00: I just want them to think through about why they would pick certain ones over others and get some clarity around where they should spend their time.
• 39:00
  SPEAKER_00: I think maybe it's the same sort of thing on the ICP side, right?
• 39:03
  SPEAKER_00: If we only pick two, what would that look like?
• 39:05
  SPEAKER_00: If if this whole company depended, as it does for Cyber Donut, on two, let's say, uh profiles being the success, what two would they be?
• 39:15
  SPEAKER_00: Um I think these little constraints exercises just drive clarity in thinking, even though we're not saying that's all we're gonna do.
• 39:23
  SPEAKER_01: Yeah, couldn't I agree with you more, Andrew.
• 39:25
  SPEAKER_01: Yeah.
• 39:26
  SPEAKER_00: Well, Sri, uh thanks very much for joining us.
• 39:29
  SPEAKER_00: The the good folks at CyberDonut are very thankful for your uh good wisdom and advice.
• 39:35
  SPEAKER_00: Um if they if they had some swag, they would send it your way, I'm sure.
• 39:40
  SPEAKER_00: But all their money is going into programs that generate uh pipeline right now.
• 39:45
  SPEAKER_00: So uh but they will be actually very thankful for you joining us and appreciate you spending the time.
• 39:50
  SPEAKER_01: Absolutely.
• 39:50
  SPEAKER_01: Thank you, Andrew.
• 39:51
  SPEAKER_01: It's it's been my pleasure.