Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 145: Snehal Antani, CEO at Horizon3, talks about telling the right stories and setting up the right pitch for customers

Transcript

145: Snehal Antani, CEO at Horizon3, talks about telling the right stories and setting up the right pitch for customers · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_02: Sometimes companies starve when the founders experience the problems they're trying to solve and are just compelled to go and solve them.
• 0:40
  SPEAKER_02: Find out in this episode how Teal Entani, the CEO at Horizon 3, did it as he came out of the special operations community and started his company to solve a compelling problem in cybersecurity.
• 1:02
  SPEAKER_02: Welcome to the Sales Bluebird podcast, which exists because at B2B startups, it's hard to get consistent direction and scale the sales team.
• 1:10
  SPEAKER_02: Sales Bluebird provides you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or 10 about building great cybersecurity companies.
• 1:19
  SPEAKER_02: I am your host, Andrew Monahan.
• 1:21
  SPEAKER_02: Our guest today is Snahal Antani, CEO at Horizon3.ai.
• 1:26
  SPEAKER_02: Snahal, welcome to Sales Bluebird.
• 1:28
  SPEAKER_02: Thanks for being here.
• 1:29
  SPEAKER_02: I'm happy to be here.
• 1:30
  SPEAKER_02: It's well, we're here at RSA to set the scene for everyone.
• 1:33
  SPEAKER_02: We're sitting in the in the atrium at the Marriott Marquise, which many people will know, surrounded by God knows how many people doing their meetings as well.
• 1:40
  SPEAKER_02: So it's fun to be here in person again after a couple of years off.
• 1:43
  SPEAKER_00: Yeah, for sure.
• 1:44
  SPEAKER_00: Seeing a lot of old friends.
• 1:45
  SPEAKER_00: I've been caught up with them a long time.
• 1:46
  SPEAKER_02: Yeah, yeah.
• 1:46
  SPEAKER_02: It makes for fun during the day and even more fun in the evening, right?
• 1:50
  SPEAKER_02: Hence why I'm an octave lower.
• 1:52
  SPEAKER_02: So let's start off with getting to know the real you.
• 1:55
  SPEAKER_02: I've got 15 questions on a list here.
• 1:58
  SPEAKER_02: Do you want to pick out a number between one and 15?
• 2:00
  SPEAKER_02: And I'll hit you up with the question.
• 2:02
  SPEAKER_02: 12.
• 2:02
  SPEAKER_02: 12 is what's one great sales book that you've really enjoyed in the past or enjoying right now?
• 2:08
  SPEAKER_00: Awesome.
• 2:09
  SPEAKER_00: Uh, I think sales book and more business strategy book written by Robert Green titled 33 Strategies for War.
• 2:15
  SPEAKER_00: And what's a really interesting dimension of that book is he talks about 33 stories throughout history and war tactics, but in a business context.
• 2:24
  SPEAKER_00: So, for example, what made Napoleon especially effective in his early campaigns was that there was only two layers of management really between him and any one of his shooters on the team.
• 2:36
  SPEAKER_00: Or any one of his captains, sorry.
• 2:37
  SPEAKER_00: So he and his captains would all sit together up front, study the terrain together, get on the same page, understand commanders, and understand they have to take that hill to win.
• 2:46
  SPEAKER_00: And by getting everyone on the same page up front, when they're on the battlefield, they could empower those captains to make just-in-time decisions.
• 2:54
  SPEAKER_00: The reason why they're able to destroy the Prussians and others is because Napoleon's army could make better decisions faster in the moment because those closest to the problem were empowered.
• 3:04
  SPEAKER_02: So they understood the overall thinking, but knew when it's the old thing, you know, the plan only survives first contact with the enemy.
• 3:11
  SPEAKER_00: That's exactly right.
• 3:12
  SPEAKER_00: And so these captains would know hey, those guys are struggling to take the hill, and we know that hill is very crucial.
• 3:17
  SPEAKER_00: And they didn't need to go up the chain of command to get approval.
• 3:20
  SPEAKER_00: They could just adapt in the moment.
• 3:22
  SPEAKER_00: And so the book is amazing because it's 33 stories around different tactics and techniques.
• 3:28
  SPEAKER_00: And it takes me forever to read.
• 3:29
  SPEAKER_00: I reread this book every couple of years because every paragraph triggers two or three stories from my past.
• 3:35
  SPEAKER_00: And I actually have to write them down to remember, and then I'll read the next paragraph and it'll trigger another story from my past experience or whatever else.
• 3:42
  SPEAKER_00: So 33 Strategies of War written by Robert Green.
• 3:45
  SPEAKER_02: What a great book.
• 3:46
  SPEAKER_02: All right.
• 3:46
  SPEAKER_02: Next number is one in 15.
• 3:48
  SPEAKER_02: Let's do seven.
• 3:50
  SPEAKER_02: Seven.
• 3:51
  SPEAKER_02: One great airport that you've been through that you've actually enjoyed.
• 3:55
  SPEAKER_00: A great airport that I've uh that I've been through.
• 3:58
  SPEAKER_00: So you fly through Singapore Airport and you've got that massive waterfall, and you've got, you know, Singapore is a city in a garden.
• 4:05
  SPEAKER_00: The airport's the garden.
• 4:07
  SPEAKER_00: And it's just this amazing experience.
• 4:09
  SPEAKER_00: You kind of like not want to leave, and you want a longer layover, which is very unusual for a traveler.
• 4:14
  SPEAKER_02: It has everything, right?
• 4:15
  SPEAKER_02: It's like a little city in itself.
• 4:16
  SPEAKER_02: Absolutely, yeah.
• 4:18
  SPEAKER_02: Yep, that's exactly right.
• 4:20
  SPEAKER_02: In my mind, going back to the day, they kind of pioneered that let's not make an airport a completely shitty experience.
• 4:26
  SPEAKER_02: Yeah.
• 4:26
  SPEAKER_02: We actually thought about how could this be a good place to go?
• 4:28
  SPEAKER_02: Because I think they wanted to attract incoming flights and be the center in Southeast Asia, right?
• 4:32
  SPEAKER_01: Yep.
• 4:32
  SPEAKER_02: Yeah, very thoughtful.
• 4:33
  SPEAKER_02: Like last one between one and 15.
• 4:35
  SPEAKER_02: 13.
• 4:36
  SPEAKER_02: 13.
• 4:36
  SPEAKER_02: So they say home is where the heart is.
• 4:38
  SPEAKER_00: Where is home for you?
• 4:41
  SPEAKER_00: Oh, that's a great question.
• 4:42
  SPEAKER_00: So I've moved around a lot.
• 4:43
  SPEAKER_00: I grew up near Boston, ended up at school in the Midwest, and then eventually moved out here to California.
• 4:48
  SPEAKER_00: And so I have no real physical location that is home.
• 4:52
  SPEAKER_00: But uh, so I'll describe home as where do I not feel alone?
• 4:55
  SPEAKER_00: So there are two places where I don't feel alone.
• 4:57
  SPEAKER_00: Obviously, with wherever my family is.
• 4:59
  SPEAKER_00: But honestly, also I spend I left industry and spent some time in the special operations community.
• 5:04
  SPEAKER_00: And in any environment where I see my brothers and sisters from that world and I get to hang out with them, feels like home.
• 5:11
  SPEAKER_00: It feels like a reunion to me.
• 5:12
  SPEAKER_02: So is it true?
• 5:13
  SPEAKER_02: One of the things I've heard is people join the special operations for the thrill or the excitement, but they stay because of the community, the brotherhood about it all.
• 5:21
  SPEAKER_02: Is that something you experienced?
• 5:22
  SPEAKER_00: Yeah, I would say it's less the thrill and excitement because these aren't necessarily adventure seekers, but more for purpose and impact.
• 5:27
  SPEAKER_00: And yeah, you know, when you enter that community, and for me, you know, I was not a shooter, I didn't have military experience growing up.
• 5:33
  SPEAKER_00: I binge watched Tropic Thunder and Jack Ryan.
• 5:36
  SPEAKER_00: Like that's how I mentally prepared for that world.
• 5:38
  SPEAKER_00: And I left industry as an accomplished executive at Splunk and took a break and joined the special operations community.
• 5:45
  SPEAKER_00: And, you know, when I first joined, I never felt so alone because I knew nothing about that world.
• 5:49
  SPEAKER_00: But I wanted to solve problems that mattered and that really made a difference.
• 5:53
  SPEAKER_00: And I grew more as a leader personally and professionally in those four years than in anything else I'd done.
• 5:58
  SPEAKER_00: And then when I left, I had never felt so alone because of the people where you're shoulder to shoulder solving problems all over the world, but especially, you know, in the US and the rear supporting those around the world, you have this spawn and this trust and relationship.
• 6:13
  SPEAKER_00: Because the thing about special ops is two pieces.
• 6:15
  SPEAKER_00: One, what makes those people special is not that they can run fast or swim far, but that they are learn it-alls that can solve any problem as a team under pressure.
• 6:23
  SPEAKER_00: And number two is that just because you're in the command today doesn't mean you'll be here tomorrow.
• 6:29
  SPEAKER_00: You've got to earn a right to be on that team every single day.
• 6:33
  SPEAKER_00: And so what it does is create this demand for excellence for yourself and your teammates and a natural environment where you are empowered and trusted to solve a problem because you are closest to it and you've earned the right to be empowered.
• 6:45
  SPEAKER_02: What a fascinating journey you must have been on there for those uh two, three years, then learning all that and being embraced by that community, right?
• 6:51
  SPEAKER_00: Yeah, it was um so I grew more personally and professionally.
• 6:54
  SPEAKER_00: I viewed it honestly as a PhD program in leadership.
• 6:57
  SPEAKER_00: And a lot of those lessons I apply now, even on the startup side.
• 7:00
  SPEAKER_02: Talking about startups, let's go to Horizon 3.ai.
• 7:03
  SPEAKER_02: What can you tell us right now about what stage of the journey you're on in terms of size or number of people, things like that?
• 7:09
  SPEAKER_00: Yeah, so I'll give you a little bit of context and history.
• 7:11
  SPEAKER_00: Uh so one, this is an idea and a problem I've been thinking about for 10 years.
• 7:14
  SPEAKER_00: And the struggle I had when I was a CIO at GE Capital, and then I was a CTO at Splunk in my time in the Department of Defense, is I had no idea I was secure until the bad guys showed up.
• 7:23
  SPEAKER_00: And by then it's too late.
• 7:25
  SPEAKER_00: Am I logging the right data?
• 7:26
  SPEAKER_00: Am I fixing the right vulnerabilities and so on?
• 7:29
  SPEAKER_00: And how do I proactively verify my security controls before they show up?
• 7:34
  SPEAKER_00: And how do I build that muscle memory and train like guy fight and make sure I'm fixing problems that matter?
• 7:39
  SPEAKER_00: And so January of 2020 is when we really started writing code.
• 7:43
  SPEAKER_00: And my co-founder was my deputy CTO within the special operations community.
• 7:46
  SPEAKER_00: So he and I had already done some really high-end work together.
• 7:50
  SPEAKER_00: A third of the company, we're at 110 people now, a third of the company come from that special operations national security community because, once again, that learn it all culture that can solve any problem as a team under pressure, critical in the national security world, absolutely foundational to the startup world.
• 8:06
  SPEAKER_00: And so that became the core of my culture.
• 8:08
  SPEAKER_02: So let me let me jump in.
• 8:09
  SPEAKER_02: So before uh Horizon 3, people would do what, vulnerability assessments and then have external firms and come do pen testing to try and answer those questions, right?
• 8:19
  SPEAKER_00: Yeah, so the way I tried to solve this on my own before I started the company is I would run vulnerability scanners.
• 8:24
  SPEAKER_00: But the problem is being vulnerable doesn't mean I'm exploitable.
• 8:27
  SPEAKER_00: And I might find 100,000 CVEs, of which maybe five or ten are actually critical to solve.
• 8:33
  SPEAKER_00: And attackers have adapted.
• 8:36
  SPEAKER_00: Less than 2% of breaches use CVEs.
• 8:38
  SPEAKER_00: Most of the time, attackers just log in with credentials that they've harvested.
• 8:42
  SPEAKER_00: And they chain that together with misconfigurations and dangerous product defaults, none of which vulnerability scanners can find.
• 8:48
  SPEAKER_00: And then how do you chain them together?
• 8:50
  SPEAKER_00: So a low plus a low could equal a high.
• 8:52
  SPEAKER_00: Then I layered consultants, pen test consultants.
• 8:55
  SPEAKER_00: But if you have a hundred thousand hosts in your environment, that pen test consultant is only gonna be able to test a thousand, maybe two thousand hosts.
• 9:02
  SPEAKER_00: Well, what about everything else?
• 9:03
  SPEAKER_00: It's just sampling at that point, right?
• 9:05
  SPEAKER_00: And then this automated security testing category breach attack simulation came out, which I believe is complete snake oil.
• 9:12
  SPEAKER_00: I was a huge customer of some of these Baz tools, but I spent more time writing my own attack scripts for which we had no skills and talent than actually testing my environment.
• 9:21
  SPEAKER_00: Because think of like automated driving cars.
• 9:24
  SPEAKER_00: You know, if you have an automated car, you're gonna say back up 12 feet, turn right, drive forward 100 feet, turn left, and hit go.
• 9:31
  SPEAKER_00: And then the car will do is exactly what it's told.
• 9:33
  SPEAKER_00: And it'll hit a pedestrian along the way because you never coded it to avoid the pedestrian.
• 9:37
  SPEAKER_00: Autonomous driving is hear your point A, get to point B, figure it out with next best actions.
• 9:44
  SPEAKER_00: So my automated security testing experience with Snake Oil, and so I said was I need to make this autonomous, just like the attackers.
• 9:51
  SPEAKER_00: How do I give an IT admin or network engineer the power of a 20-year pen testing veteran in three clicks with no agents to install, no credentials to add, no custom scripts to write, and no consultants or professional services to hire?
• 10:04
  SPEAKER_00: And that became the starting point of my design process for building out Horizon 3.
• 10:10
  SPEAKER_02: And how did you start getting traction with that?
• 10:13
  SPEAKER_02: When did you know we've got enough to start testing it with some design partners, early adopters?
• 10:18
  SPEAKER_00: Yeah, so July of 2019 is when um I committed I'm gonna start the company.
• 10:23
  SPEAKER_00: And I texted Tony, my co-founder, said, Hey man, when you retire from the Air Force, let's go do this.
• 10:27
  SPEAKER_00: He's like, Yep, all in.
• 10:29
  SPEAKER_00: The first prototype in uh late 2019 was run an Nmap scan, pipe that data to Neo4J, and then auto-execute a Metasploit module.
• 10:38
  SPEAKER_00: And he ran it against his house and he found a sound card that had a default web server running with default credentials that he had no idea existed.
• 10:46
  SPEAKER_00: And he owned his environment.
• 10:48
  SPEAKER_00: And he goes, This is awesome.
• 10:50
  SPEAKER_00: I had no idea this was there, and he was pretty good about securing his home.
• 10:53
  SPEAKER_00: Early on when I started the company, it was all about telling the story and getting early validation that the concept was legitimate.
• 11:00
  SPEAKER_00: So, in you know, all through the fall of 19 and early before we even wrote a line of code, a real code, it was pitch after pitch after pitch.
• 11:07
  SPEAKER_00: Hey, what do you think about this?
• 11:08
  SPEAKER_00: Give me some feedback here.
• 11:09
  SPEAKER_00: And what I cared about was not the validation of the idea, but the challenge questions that were being asked by people in my network.
• 11:17
  SPEAKER_00: And this is why building a network is so important.
• 11:19
  SPEAKER_00: So I had trusted friends, colleagues, and skeptics that gave me phenomenal challenge questions that I could understand.
• 11:25
  SPEAKER_02: So they come back with you, well, what about this and what about that?
• 11:28
  SPEAKER_02: And how would you handle it?
• 11:28
  SPEAKER_02: And then you'd like to.
• 11:29
  SPEAKER_02: If you hadn't thought about it, you have to think about it, right?
• 11:31
  SPEAKER_00: That's exactly right.
• 11:32
  SPEAKER_00: So that gave me basically the stories I wanted to tell the market at our GA.
• 11:37
  SPEAKER_00: So, you know, there's the Bezos story of how he would write the press release for the product before he launched it.
• 11:43
  SPEAKER_00: So we took a similar approach.
• 11:44
  SPEAKER_00: This is the story I want to tell at GA when we launched the product nine months from now.
• 11:50
  SPEAKER_00: What does that look like?
• 11:51
  SPEAKER_00: And that became the engineering requirements.
• 11:53
  SPEAKER_00: And then what I did at RSA 2020, when six of us in the company, is we built a really basic demo video that I could show on my phone.
• 11:59
  SPEAKER_00: And I showed it to as many people as possible, once again, to get challenge questions and get feedback.
• 12:05
  SPEAKER_00: We did our alpha on time, our bait on time, then we GA'd the product in September of 2020 and early commercial validation.
• 12:12
  SPEAKER_00: So it took us about a year to build the product.
• 12:14
  SPEAKER_00: And um, and what was amazing about that year is constantly pitching the story along the way and course correcting as appropriate.
• 12:21
  SPEAKER_00: And then on the startup side for go to market, my first go-to-market hire was customer success.
• 12:27
  SPEAKER_00: A person that could be the fast feedback loop of engaging early adopters and customers and giving that feedback to engineering.
• 12:35
  SPEAKER_00: So that person had to have credibility to talk to a customer.
• 12:39
  SPEAKER_00: So I hired a guy named Bonnie Canote.
• 12:41
  SPEAKER_00: He was the deputy CIO at Transcom in the Department of Defense.
• 12:44
  SPEAKER_00: He commanded the 67th Cyber Operations Group, which was the hacker unit for the Air Force.
• 12:49
  SPEAKER_00: He was a practitioner, he was a user, he understood offense and defense, and he had the rapport and the demeanor to build credibility with customers.
• 12:57
  SPEAKER_00: So he became the product face and he got that feedback and he had the credibility with the engineering team as well.
• 13:03
  SPEAKER_00: And then the next hire was a very strong sales engineer that could also sell and do like the follow-up.
• 13:09
  SPEAKER_00: So I would be the pitch man.
• 13:11
  SPEAKER_00: Tom Palmieri was a very experienced network engineer, sales engineer type.
• 13:15
  SPEAKER_00: He would follow through and get the deal closed.
• 13:17
  SPEAKER_00: And then Monty was the fast feedback loop to engineering.
• 13:20
  SPEAKER_00: And that's how we were able to iterate the product as quickly as we did.
• 13:22
  SPEAKER_02: And in those days, was it friends and family you were selling to?
• 13:25
  SPEAKER_02: So that's how you got in there?
• 13:26
  SPEAKER_02: Actually, no.
• 13:27
  SPEAKER_00: So I very intentionally did not sell to friends and family because you don't get any validation from friends and family.
• 13:33
  SPEAKER_00: So we figure out like what is the ideal customer profile?
• 13:36
  SPEAKER_00: And I said, what I want to do is focus early on on logo velocity, get as many logos as I can.
• 13:42
  SPEAKER_00: So who is gonna have the fastest sales cycle and the most pain I can help with?
• 13:46
  SPEAKER_00: So commercial US mid-market customers and the smaller Fortune 2000s tend to have the fastest sales cycles and they tend to be barely treading water because our product, most of our users now, two years later, are not security people.
• 14:00
  SPEAKER_00: They're IT admins and network engineers that become security superheroes in three clicks.
• 14:05
  SPEAKER_00: And what you look for are companies where the IT team and the security team are the same person, and you give them superpowers and you help them do their jobs better.
• 14:14
  SPEAKER_00: So we focused on that, and we had a six to eight week sales cycle for the first nine months after we launched the product.
• 14:21
  SPEAKER_02: And was it the IT person that bought or was it the CFO at these mid-market companies that bought?
• 14:25
  SPEAKER_00: It was the uh usually it was like the VP of IT who was also the VP of security.
• 14:30
  SPEAKER_00: Okay, yeah.
• 14:30
  SPEAKER_00: Because it was a small, small team.
• 14:32
  SPEAKER_00: So they were doing both jobs.
• 14:33
  SPEAKER_00: But our user persona was the fixer.
• 14:36
  SPEAKER_00: So how do I give the blue team red team superpowers?
• 14:39
  SPEAKER_00: Which is a very inverse approach that others took, which was how do I make the red team even better?
• 14:45
  SPEAKER_00: But when you look at the user base, there's less than 5,000 people in the United States that have their offensive security certification as an ethical hacker.
• 14:53
  SPEAKER_00: Less than 5,000.
• 14:54
  SPEAKER_00: So catering to that community, which is gonna be very demanding and very opinionated, that's not a very large group.
• 15:00
  SPEAKER_00: But look at the number of people with a CISSP.
• 15:03
  SPEAKER_00: There's a hundred thousand or more.
• 15:05
  SPEAKER_00: Going after them and helping them understand the attacker's perspective was then give me a much larger user base to initially target.
• 15:12
  SPEAKER_02: And they're working at companies which are being asked more and more to do security things, compliance things, to do business with other companies.
• 15:20
  SPEAKER_02: And now they're the expectations on them to do this properly.
• 15:22
  SPEAKER_02: Right.
• 15:23
  SPEAKER_02: With other people to do it.
• 15:24
  SPEAKER_00: Yeah, and back to when I was a CIO, the hardest part of my job as a CIO was deciding what not to fix in security because I had way too much stuff on my plate.
• 15:34
  SPEAKER_00: I didn't have enough experts to fix.
• 15:36
  SPEAKER_00: And if I chose not to fix something that became exploited later, I was gonna get fired.
• 15:41
  SPEAKER_00: Yeah.
• 15:41
  SPEAKER_00: So that was a very stressful process.
• 15:43
  SPEAKER_00: Yeah, yeah.
• 15:43
  SPEAKER_00: So what we focused on were those barely treading water and helping them decide what not to do and helping them decide where to focus instead.
• 15:51
  SPEAKER_02: So going off to mid-market from a go-to-market standpoint, I like the attractiveness of the speed and you know, ease of doing business with them, but hard to get to, right?
• 16:00
  SPEAKER_02: This is the biggest challenge.
• 16:01
  SPEAKER_02: Go choose the larger companies because it's more manageable.
• 16:04
  SPEAKER_02: How are you thinking about you know the scale you need to go after mid-market properly?
• 16:08
  SPEAKER_00: Yeah, so the other key thing is uh, you know, this is a sales go-to-market podcast, is early stage startups.
• 16:13
  SPEAKER_00: The goal of sales is to decide who not to sell to.
• 16:17
  SPEAKER_00: So we had all the big companies that wanted to use us as well.
• 16:20
  SPEAKER_00: And we said no, hold off.
• 16:21
  SPEAKER_00: Because that's a 12-week, 12-month sales cycle.
• 16:24
  SPEAKER_00: It's gonna burn a ton of my resources internally.
• 16:26
  SPEAKER_00: I didn't have a lot.
• 16:27
  SPEAKER_00: So we said, what is that repeatable sales motion?
• 16:30
  SPEAKER_00: Because also early on, it's product market fit is about a commercial validation, repeatable sales motion, and the founder no longer has to be involved in the sales process.
• 16:38
  SPEAKER_01: Right.
• 16:39
  SPEAKER_00: And so what we focused on was six to eight week sales cycle, get as many logos as we could, get the story down, and get the buying behavior down.
• 16:47
  SPEAKER_00: So, what is your aha moment as a security vendor, as a product company?
• 16:52
  SPEAKER_00: For us, it was a customer or prospect runs a pen test themselves, they fix all the problems that were found, and then they rerun the pen test to verify the problem has been fixed.
• 17:01
  SPEAKER_00: Find, fix, verify.
• 17:03
  SPEAKER_00: When our prospects hit that find, fix, verify, aha, and the entire user experience was optimized around it, we had a hundred percent technical win rate.
• 17:12
  SPEAKER_01: Wow.
• 17:12
  SPEAKER_00: 100%.
• 17:13
  SPEAKER_00: And then the only reason why the deal would not close right away is budget or something like the gift wrapping.
• 17:18
  SPEAKER_00: And so what you focus on is that aha moment, repeatable sales motion, and then get that down to be formulated.
• 17:25
  SPEAKER_00: And I'll pause there because I'll talk about then how we scaled that up and then how we entered the channel business and distributors.
• 17:31
  SPEAKER_02: I was gonna ask, how many customers did you have before you stepped back from being the pitch man, as you called it?
• 17:35
  SPEAKER_02: Yeah, and actually hard ahead of sales to do that.
• 17:37
  SPEAKER_00: So on our first five quarters of sales, we did over a hundred customers in our first five quarters of sales, which is unheard of in cybersecurity.
• 17:46
  SPEAKER_00: And in fact, like most people don't disclose that.
• 17:48
  SPEAKER_00: I'm crazy proud of it.
• 17:49
  SPEAKER_00: And we did most of those hundred customers with only three sales reps.
• 17:53
  SPEAKER_00: One SDE, two quarter carriers.
• 17:54
  SPEAKER_00: That's it.
• 17:55
  SPEAKER_00: That was it?
• 17:55
  SPEAKER_00: Yeah.
• 17:55
  SPEAKER_00: And what that forced us to do, and right around customer like 40, I stopped pitching.
• 18:01
  SPEAKER_00: I was no longer involved.
• 18:03
  SPEAKER_00: And the team was just executing.
• 18:05
  SPEAKER_02: And did they pick up biosmosis, how you were doing things?
• 18:08
  SPEAKER_02: Were you intentional about it?
• 18:09
  SPEAKER_02: Here's the playbook, let's run the dot, you know, let's work on it together.
• 18:13
  SPEAKER_00: Yeah, there's an excellent question.
• 18:14
  SPEAKER_00: There's three components to it.
• 18:16
  SPEAKER_00: The first component was I was very good at recording myself pitching it.
• 18:20
  SPEAKER_00: So I would do internal, like 10-minute videos on here's how I pitched it, here's how I handled this challenge question.
• 18:26
  SPEAKER_00: I build a single slide that I would talk to.
• 18:27
  SPEAKER_00: And what that helped, because it was recorded, we basically created like an internal Snay tube, if you will, which was an internal channel of all the recordings of these various ways to pitch the product.
• 18:38
  SPEAKER_00: And so the existing reps and the new people that would come in could listen through it.
• 18:42
  SPEAKER_00: We then evolved that in our employee onboarding process that says everybody in the company must be capable of demoing the product.
• 18:49
  SPEAKER_00: Doesn't matter if you're in finance, HR, or sales or engineering, you have to be able to do it.
• 18:54
  SPEAKER_00: So that was kind of the first thing.
• 18:55
  SPEAKER_00: The second thing was writing it down because some people learn by listening, other people learn by reading.
• 19:00
  SPEAKER_00: So the burden was on me to tell the stories effectively as I wrote it down.
• 19:04
  SPEAKER_00: And then the third was a cadence of continuous improvement.
• 19:07
  SPEAKER_00: Hey, we've hired amazing folks.
• 19:08
  SPEAKER_00: What are you seeing?
• 19:09
  SPEAKER_00: What are you seeing?
• 19:10
  SPEAKER_00: How are you pitching it?
• 19:11
  SPEAKER_00: And then this feedback loop of educating everybody.
• 19:14
  SPEAKER_00: So if I had a first mover for a new story, everyone else had to be a fast follower to it.
• 19:19
  SPEAKER_02: And what would you say to a founder who's not so naturally thinking about, you know, building the videos you were talking about, building the story you're talking about, and they've got so much going on, right?
• 19:29
  SPEAKER_02: How do they kind of get out of that and realize this is actually kind of important?
• 19:33
  SPEAKER_00: Yeah.
• 19:34
  SPEAKER_00: So I will tell you it is the most important thing.
• 19:37
  SPEAKER_00: Because as a founder, if you are not the best storyteller in the company, there's a reason why 80% of startups fail, right?
• 19:44
  SPEAKER_00: And oftentimes because the founder is not the best storyteller in the company.
• 19:48
  SPEAKER_00: You have to work at it and be that best storyteller.
• 19:51
  SPEAKER_00: And if you're not good, I was a terrible speaker.
• 19:53
  SPEAKER_00: And the best way to practice how to speak is learn how to tell jokes.
• 19:57
  SPEAKER_01: Okay.
• 19:58
  SPEAKER_00: Because think about a joke.
• 19:59
  SPEAKER_00: You've got 30 to 90 seconds, max.
• 20:01
  SPEAKER_00: You have to pause for effect, the tone of your voice, the delivery, the punchline.
• 20:06
  SPEAKER_00: If you're good at telling jokes, you'll be great at pitching your product.
• 20:10
  SPEAKER_00: You just got to suck it up and learn how to do it.
• 20:13
  SPEAKER_02: And so you were saying that uh you got to 40 customers and then you start stepping back, 100 customers in five quarters.
• 20:19
  SPEAKER_02: When did your first head of sales come in?
• 20:21
  SPEAKER_00: I hired Bob Critty as our chief revenue officer, and he was the former head of sales at Sentinel One.
• 20:26
  SPEAKER_00: So he'd done this before.
• 20:27
  SPEAKER_00: And what I what's great about the Sentinel One business model is it's 95% channel.
• 20:31
  SPEAKER_00: And I'm gonna talk about this transition to channel in a moment.
• 20:33
  SPEAKER_00: So I brought Bob in because he's a great coach and he understands channel sales.
• 20:38
  SPEAKER_00: Uh, and he started in October.
• 20:40
  SPEAKER_00: So he started around customer 50.
• 20:43
  SPEAKER_01: Okay.
• 20:43
  SPEAKER_00: Right.
• 20:44
  SPEAKER_00: And the hard part, so one amazing, amazing talent on the team, but the last mile of sales for mid-market is very expensive because you have to have uh relationships, especially in security testing.
• 20:56
  SPEAKER_00: You know, there's a trust and relationship that has to get built up.
• 20:59
  SPEAKER_00: And you're not gonna do that with a small sales team.
• 21:02
  SPEAKER_00: Now we were able to get some commercial validation.
• 21:04
  SPEAKER_00: So you go through this process of building out your channel partner, your distributors, your IT service providers, your local last mile consultants.
• 21:12
  SPEAKER_00: We built an entire business model that is channel first, marketplace second, direct sales third.
• 21:18
  SPEAKER_00: And we did that from the onset was the vision.
• 21:21
  SPEAKER_00: And so, yeah, we we got a bunch of customers ourselves, but you can't start using partners and channel until you know what to say.
• 21:28
  SPEAKER_00: Right.
• 21:29
  SPEAKER_00: So you had to master the storytelling and the enablement first, then systematically transition that mid-market to your partners and distributors so that your small team can move upstream to start to sell to enterprise.
• 21:42
  SPEAKER_01: Okay.
• 21:42
  SPEAKER_00: And then once we get the enterprise motion down, because it's a little bit different, we will transition that to partners and distributors.
• 21:49
  SPEAKER_00: And then my small team will focus on strategic accounts.
• 21:51
  SPEAKER_00: When you said marketplace, what do you mean by that?
• 21:53
  SPEAKER_00: AWS marketplace, Azure Marketplace, the self-service purchasing behavior.
• 21:57
  SPEAKER_00: Cut it, cut it.
• 21:57
  SPEAKER_00: So the idea is that let you channel through distributors and last mile providers that have local in-market knowledge and local in-market relationships, enable them to bring more value to their customers.
• 22:08
  SPEAKER_00: Now, this is the challenge with other companies I worked at.
• 22:11
  SPEAKER_00: They weren't channel and partner friendly.
• 22:13
  SPEAKER_00: And these partners don't want to just point and click through your wizard to install your product.
• 22:17
  SPEAKER_00: They want to use your product to build a strategic relationship.
• 22:20
  SPEAKER_00: So you have to design that from the onset, which is what we did.
• 22:24
  SPEAKER_00: In fact, probably 40% of our revenue this year will come from partners buying our product for their own business.
• 22:32
  SPEAKER_00: Models.
• 22:32
  SPEAKER_00: So take a pen test consulting shop.
• 22:34
  SPEAKER_00: You know, that's a human-based effort.
• 22:36
  SPEAKER_00: But if they buy our product, they'll increase the profit margins of their business.
• 22:41
  SPEAKER_02: So that will give them scale without adding more heads.
• 22:44
  SPEAKER_00: Exactly.
• 22:44
  SPEAKER_00: And they get incentives because if they show, they usually do one and nuns, they'll show the pen test report, it says powered by Horizon 3.
• 22:51
  SPEAKER_00: They get incentives to resell the license to that partner, to the customer they just sold to.
• 22:57
  SPEAKER_00: So they'll make money off of that.
• 22:58
  SPEAKER_00: They'll auto-generate the statement of work, or we auto-generate the statement of work for every problem that we found.
• 23:04
  SPEAKER_00: And they'll separately leave behind a quote for fix actions for all the problems that we're going to shoot.
• 23:09
  SPEAKER_00: So for one dollar of revenue I make off of a partner, they generate$10 to$20 of high margin revenue for themselves.
• 23:17
  SPEAKER_02: So is it the boutique pen test firms that's the main channel?
• 23:21
  SPEAKER_02: Or you think about the CWs and the optics of the world as well?
• 23:24
  SPEAKER_00: Yeah, so there's a couple of layers.
• 23:25
  SPEAKER_00: It's a great question.
• 23:26
  SPEAKER_00: So actually think of um IT service providers that make money installing Splunk, right?
• 23:32
  SPEAKER_00: How do you know that you installed Splunk correctly at the end of your engagement?
• 23:35
  SPEAKER_00: You don't, you gotta wait for the bad guys to show up.
• 23:37
  SPEAKER_00: So they buy my license, we call it a consulting plus license, and they'll run a pen test against their Splunk deployment or CrowdStrike deployment or whatever, and then use our results to prove that the security installation was done correctly and that the tools configured right.
• 23:52
  SPEAKER_00: And they're just straight up IT service providers.
• 23:54
  SPEAKER_00: And that's follow-on revenue.
• 23:55
  SPEAKER_00: And then they'll do the fixed action reports and follow-on revenue.
• 23:58
  SPEAKER_00: Separately, you've got pen test consulting shops where a six-week consulting engagement is now cut down to four days or less at way higher margins.
• 24:07
  SPEAKER_00: And then you've got MSSPs where they've they're already doing the defensive work and they use us as an upsell to do purple teaming as a service and generate new revenue.
• 24:17
  SPEAKER_00: So those are the primary channel partners.
• 24:19
  SPEAKER_00: And then from there, we work with strategic distributors like Karasoft that has their own sub ecosystem of IT service providers, Pentest consulting shops, and MSSPs.
• 24:29
  SPEAKER_02: And does it require internally a different sort of channel manager working with the smaller firms as opposed to the traditional the octave channel manager?
• 24:37
  SPEAKER_00: It is very different because a larger and we we work at the larger VARs as well.
• 24:41
  SPEAKER_00: The larger VARs is about sales coordination.
• 24:45
  SPEAKER_00: It's about looking at prospect lists, enablement.
• 24:49
  SPEAKER_00: You treat them as a sales team, basically.
• 24:51
  SPEAKER_00: So you're you're basically hiring a sales executive type to work with them, whereas with the MSPs and others, it's more of a sales engineering type that's helping them under the covers at a more technical level.
• 25:03
  SPEAKER_00: So it is different.
• 25:03
  SPEAKER_00: One is, you know, managing a series of accounts, the other one is enabling partner success.
• 25:09
  SPEAKER_02: Got it.
• 25:09
  SPEAKER_02: And then when you're looking at 2022 and into 23, what do you see as the big milestones in the sales team as you're growing it?
• 25:17
  SPEAKER_00: So it's systematically moving upstream.
• 25:20
  SPEAKER_00: And in doing so, transitioning the smaller accounts to the partner ecosystem.
• 25:25
  SPEAKER_00: And this is very hard to do.
• 25:27
  SPEAKER_00: So it's got to be well orchestrated.
• 25:29
  SPEAKER_00: So step one is build up partners in key markets that you care about.
• 25:34
  SPEAKER_00: And I tend to focus on said the smaller last mile partners that have built deep, meaningful, multi-year relationships with their accounts, and also because they're more motivated to move faster.
• 25:46
  SPEAKER_00: Whereas I don't know, I work closely with WWT and C DW and others at Splunk.
• 25:49
  SPEAKER_00: They're amazing, but they're huge, and they have 50, 100, 200 products on their list.
• 25:55
  SPEAKER_00: The smaller shops have like three.
• 25:57
  SPEAKER_00: And so I get way more buy-in and conviction.
• 26:00
  SPEAKER_00: And the reason why that's important is in cybersecurity, there is so much hype in marketing.
• 26:05
  SPEAKER_00: Marketing doesn't sell in cyber anymore.
• 26:07
  SPEAKER_00: People like relationships sell in cyber.
• 26:09
  SPEAKER_00: And what you want is uh relationship-based selling and evangelism.
• 26:14
  SPEAKER_00: So what we focus on is cultivating champions that love the product, love the culture, love the company, love the brand, that have horizon three tattoos that want to tell all of their friends how awesome we are.
• 26:26
  SPEAKER_02: So that's an interesting concept.
• 26:28
  SPEAKER_02: So you know, I look at RSA this year, and you know, there's there's fewer vendors here than usual, but there's still somewhere around 500 to 700 vendors officially on the floor, and probably a few hundred with meeting rooms around as well.
• 26:38
  SPEAKER_02: So rather than try and compete with that noise, you're actually kind of taking part, but building a real community behind it that's going to evangelize for you.
• 26:47
  SPEAKER_02: So you're not trying to just compete with the who's got the biggest booth and who's got the flashiest t-shirts, right?
• 26:52
  SPEAKER_00: That's exactly right.
• 26:53
  SPEAKER_00: That doesn't win anymore.
• 26:54
  SPEAKER_00: That's there's just too much noise.
• 26:56
  SPEAKER_00: It doesn't matter who gave out the coolest sweat, right?
• 26:59
  SPEAKER_00: It's who is authentic, a practitioner that can connect with your pain because they've been in your shoes that is there to help you, right?
• 27:07
  SPEAKER_00: One of the cool things we added to the product is there is a button in the product that when you click on it, you can schedule time with customer success in our virtual CISO team.
• 27:16
  SPEAKER_00: There's no throttle, there's no limits, and I don't charge for it.
• 27:19
  SPEAKER_00: It's almost like a gym membership.
• 27:20
  SPEAKER_00: Some people go once a year, some people go five times a day.
• 27:24
  SPEAKER_00: Right.
• 27:24
  SPEAKER_00: But there's this comfort in knowing that anytime you want, it doesn't have to do with my product.
• 27:29
  SPEAKER_00: If you have a security question, there's a subject matter expert you can schedule 30 minutes with anytime you want, as much as you want, to talk through and rift.
• 27:38
  SPEAKER_00: And that person is a person that has had your job before.
• 27:41
  SPEAKER_00: That's awesome.
• 27:42
  SPEAKER_00: And what that creates is a level of trust and enthusiasm and championing that cuts through the noise.
• 27:48
  SPEAKER_00: And then those folks tell all their friends how amazing customer support is.
• 27:53
  SPEAKER_00: In the current security market, I think you win through three things the quality of your documentation, the quality of your customer support, and the champions that advocate as a result of both.
• 28:05
  SPEAKER_00: And our entire marketing strategy is built around those three things.
• 28:08
  SPEAKER_02: Well, that's a great point to finish on.
• 28:10
  SPEAKER_02: Really enjoyed the conversation, wish you every success for this year and beyond.
• 28:13
  SPEAKER_02: If someone wants to continue the conversation with you, and you're probably hiring in sales as well, how does someone get a hold of you to do that?
• 28:19
  SPEAKER_00: So, Horizon 3.ai, the website, find me on LinkedIn.
• 28:22
  SPEAKER_00: I'm very easy to find on LinkedIn.
• 28:23
  SPEAKER_00: I'm very active on LinkedIn.
• 28:25
  SPEAKER_00: I do a lot to share my lessons learned as a CIO, as a person in national security, as a leader, as a founder.
• 28:32
  SPEAKER_00: And I've made lots of mistakes along the way.
• 28:34
  SPEAKER_00: And I'm very open and transparent about here's the lessons I learned solving these kinds of problems.
• 28:39
  SPEAKER_00: I'm pretty good about uh answering messages when people have ping me as well.
• 28:42
  SPEAKER_00: As long as I don't think you're like, you know, Russian intelligence operative, we're good to go.
• 28:46
  SPEAKER_00: But um, very easy to find.
• 28:48
  SPEAKER_00: LinkedIn's by far probably the best.
• 28:50
  SPEAKER_00: Okay.
• 28:50
  SPEAKER_00: So on LinkedIn and just Snahall Antani.
• 28:52
  SPEAKER_00: Yep, Snahal Antani.
• 28:54
  SPEAKER_00: You can, or just look up Horizon 3.
• 28:56
  SPEAKER_00: You can copy and paste my name if you can't spell it, and then you'll find me there.
• 28:59
  SPEAKER_02: That's awesome.
• 28:59
  SPEAKER_02: Well, great to chat this morning.
• 29:00
  SPEAKER_00: Likewise, thank you.
• 29:02
  SPEAKER_02: This was a very interesting interview for me to do.
• 29:05
  SPEAKER_02: I learned a lot from Snahal, how he talked about Horizon 3 and what they're doing.
• 29:10
  SPEAKER_02: I just find it very compelling.
• 29:11
  SPEAKER_02: Lots of takeaways from the discussion, two to talk about right now, though.
• 29:16
  SPEAKER_02: The first one for me was how he took some of the ethos from the special operations community and took it to his startup.
• 29:24
  SPEAKER_02: So the idea of taking people who are learn it-alls rather than know-it-alls, who are constantly learning and want to get better and try new things.
• 29:32
  SPEAKER_02: And secondly, the idea that every day they have to earn the right to be on the team is not a given, right?
• 29:38
  SPEAKER_02: They have to prove their leadership.
• 29:39
  SPEAKER_02: They have to keep delivering on what they're doing.
• 29:42
  SPEAKER_02: It was interesting how he talked about how he brought that whole kind of thinking towards how he's doing things at Horizon 3.
• 29:48
  SPEAKER_02: And then the second thing was for me is how he talked about what Horizon 3 does.
• 29:55
  SPEAKER_02: And I encourage you to go back and listen to the start of the interview.
• 29:58
  SPEAKER_02: I asked him the question, you know, what stage are you at in your development?
• 30:01
  SPEAKER_02: And he started out by saying, well, this is kind of, you know, how we got going, and then he talked some more about it.
• 30:06
  SPEAKER_02: So I encourage you to go back a bit.
• 30:08
  SPEAKER_02: He did two or three things I thought were really good.
• 30:10
  SPEAKER_02: One was that everything he talked about at the start was around the problem, right?
• 30:14
  SPEAKER_02: He talked about how he experienced this problem when he was leading cybersecurity.
• 30:20
  SPEAKER_02: These were what he was finding.
• 30:21
  SPEAKER_02: These are the situations he was in.
• 30:23
  SPEAKER_02: And he talked very interestingly and compelling.
• 30:26
  SPEAKER_02: I think using some of his emotional words, you know, he was frustrated, he was feeling vulnerable, he couldn't tell, you know, things until it was too late, things like that.
• 30:33
  SPEAKER_02: And he did a good job throughout of evangelizing the problem rather than necessarily evangelizing Horizon 3 to begin with.
• 30:42
  SPEAKER_02: I think that's an important takeaway from this.
• 30:44
  SPEAKER_02: The second part of what he was doing when describing what Horizon 3 does is he was not afraid to make a very bold, memorable statement about competitive or other ways of achieving this, right?
• 30:57
  SPEAKER_02: So he said when he talked about the automated testing technologies, the bad technology, he didn't say they were ineffective or not that good.
• 31:04
  SPEAKER_02: He flat eyes said, I believe they are snake oil, right?
• 31:08
  SPEAKER_02: And he knew this because he'd been using them.
• 31:10
  SPEAKER_02: He talked, I was a heavy user of these tools.
• 31:12
  SPEAKER_02: I believe they're snake oil.
• 31:14
  SPEAKER_02: That was a very bold statement to make.
• 31:16
  SPEAKER_02: Something that, you know, if if you were at all thinking or suspecting the same thing, you're gonna be on the journey with them, right?
• 31:23
  SPEAKER_02: You're gonna go, yeah, you know, you're right.
• 31:25
  SPEAKER_02: You know, that's right, is what you're gonna be thinking.
• 31:27
  SPEAKER_02: If you believe that bass tools are the absolute most amazing thing in the world, you'll probably never buy Horizon 3 anyway.
• 31:33
  SPEAKER_02: You might be repelled by what he said, right?
• 31:35
  SPEAKER_02: But he's probably not too concerned about that because you're you're gonna be a harder person to convert to his way of thinking.
• 31:40
  SPEAKER_02: So I think it was really strong how he did that.
• 31:42
  SPEAKER_02: And the final thing he did was to make it more real, he used an analogy that anyone should be able to understand.
• 31:49
  SPEAKER_02: He talked about the difference between driving cars and self-driving cars.
• 31:53
  SPEAKER_02: And how what Horizon 3 does is more on the self-driving side as opposed to the drive-it-yourself side.
• 31:59
  SPEAKER_02: So three little tools he used in there orienting around the problem, evangelizing the problem.
• 32:04
  SPEAKER_02: The second one is being bold about saying this way, this other way is wrong.
• 32:09
  SPEAKER_02: And the third one is making it more real and understandable by using an analogy.
• 32:13
  SPEAKER_02: And if you're intrigued by my summary right there, go back to the bit of the interview towards the start when he does talk about what they do, and you'll see that.
• 32:22
  SPEAKER_02: And maybe that's why you were drawn in as well if you were, as he was talking about uh Horizon 3.
• 32:27
  SPEAKER_02: So uh enjoyed the interview.
• 32:28
  SPEAKER_02: I wish Horizon 3 and stay all the best for the rest of the year into 2023.