Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 134: Greg Fitzgerald, Co-Founder and President of Sevco Security, talks the importance of understanding the problem the customer has

Transcript

134: Greg Fitzgerald, Co-Founder and President of Sevco Security, talks the importance of understanding the problem the customer has · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: You can't manage what you don't know about it, is a concept that has been around for a while, but Sevco Security has been selected for the innovation sandbox at RSA this year because of the unique way they tackle security asset management.
• 0:46
  SPEAKER_00: Find out what they're doing different in this episode with Greg Fitzgerald, their co-founder and president.
• 1:02
  SPEAKER_00: Welcome to the Sales Bluebird Podcast, which exists because at B2B startups, it's hard to get consistent traction and scale the sales team.
• 1:11
  SPEAKER_00: Sales Bluebird gives you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or ten about selling and building startups.
• 1:20
  SPEAKER_00: I am your host, Andrew Monahan.
• 1:22
  SPEAKER_00: Our guest today is Greg Fitzgerald, who's this co-founder and president at Sevco Security.
• 1:27
  SPEAKER_00: Greg, welcome to Sales Bluebird.
• 1:29
  SPEAKER_01: Thank you, Andrew.
• 1:30
  SPEAKER_01: So glad to be here.
• 1:31
  SPEAKER_00: Yeah, it's gonna be fun.
• 1:32
  SPEAKER_00: You know, Sevco got nominated for the RSA Conference Innovation Sandbox, which by definition means you're doing innovative things, and I'm keen to understand what that is and what's going on in your world.
• 1:43
  SPEAKER_00: But Greg, before we get to the business side, let's learn more about you.
• 1:46
  SPEAKER_00: I've got 15 questions on my list right here.
• 1:49
  SPEAKER_00: I'm gonna ask you to randomly pick three numbers and I'll ask you the question that corresponds to those numbers.
• 1:55
  SPEAKER_01: Fantastic.
• 1:56
  SPEAKER_01: I'll go number one just because you always start at one.
• 2:00
  SPEAKER_01: I'll go number seven because uh it's a lucky number, and I'll go 15 because that's my daughter's age.
• 2:07
  unknown: Okay.
• 2:07
  SPEAKER_00: I have a daughter who's 15 as well, so that's perfect.
• 2:09
  SPEAKER_00: So number one, dive bar or cocktail bar.
• 2:12
  SPEAKER_01: Oh, I like the dive bar.
• 2:15
  SPEAKER_01: I'm a down home kind of country boy, and I think I like the dive bar.
• 2:19
  SPEAKER_01: Just kicking back, taking it easy, hopefully having some chips and stuff and just being able to throw them on the floor and not worry about anything.
• 2:25
  SPEAKER_00: Less pretense, more relaxing, it sounds like.
• 2:28
  SPEAKER_01: Yes, yes.
• 2:29
  SPEAKER_00: Number seven, you said?
• 2:31
  SPEAKER_02: Yes.
• 2:32
  SPEAKER_00: One great airport you've been to in the world.
• 2:35
  SPEAKER_01: You know, it's a great question because I've traveled two million miles, over two million miles, my kind of my career here, where I love the Long Beach, California airport.
• 2:45
  SPEAKER_01: It's so easy to get in and out of.
• 2:48
  SPEAKER_01: And you can get to LAX without an issue, you can get to Orange County without issue.
• 2:51
  SPEAKER_01: And that was actually the airport that I used more so than than the Orange County airport, even when I was uh growing silence from the earliest of days and living in Texas, traveling back and forth.
• 3:01
  SPEAKER_01: And that's just a fantastic airport.
• 3:02
  SPEAKER_00: And Long Beach was one of the main airports for jet blue for a while, is that right?
• 3:06
  SPEAKER_01: That is correct.
• 3:07
  SPEAKER_01: And as a matter of fact, when COVID hit, they moved out and Southwest moved in.
• 3:11
  SPEAKER_01: And so for me, it makes it even better.
• 3:13
  SPEAKER_01: I like Southwest a ton just for the flexibility out of Texas because it's a Texas airline.
• 3:17
  SPEAKER_00: Yeah.
• 3:18
  SPEAKER_00: I don't think I've ever flown Long Beach.
• 3:20
  SPEAKER_00: Uh John Wayne, Orange Kanthy was always an easy one as well.
• 3:23
  SPEAKER_00: Just you know, you could be through the whole thing in like five minutes if you were she timed it right.
• 3:27
  SPEAKER_00: It was it was good.
• 3:28
  SPEAKER_02: That's correct.
• 3:29
  SPEAKER_00: 15, actually, similar vein, window or aisle.
• 3:32
  SPEAKER_02: Oh, I'm an aisle guy.
• 3:33
  SPEAKER_00: Why is that?
• 3:35
  SPEAKER_02: Maybe it's my small bladder, but I gotta get up.
• 3:38
  SPEAKER_02: I gotta walk around.
• 3:39
  SPEAKER_02: So I need the aisle.
• 3:41
  SPEAKER_00: Uh, fair enough.
• 3:42
  SPEAKER_00: I think I'm the same with the aisle as well.
• 3:44
  SPEAKER_00: Something about the flexibility.
• 3:46
  SPEAKER_00: Although night flights, I prefer the window because I've got something to lean my heavy head on at times.
• 3:50
  SPEAKER_02: That makes sense.
• 3:51
  SPEAKER_00: And speaking of heavy heads, it's not heavy because I've got lots of brains in there.
• 3:55
  SPEAKER_00: So, Greg, I'm a very simple sales guy from Scotland where simple people.
• 4:00
  SPEAKER_00: Explain what Sevco does in words that I will understand.
• 4:03
  SPEAKER_01: I love that.
• 4:04
  SPEAKER_01: We started Sevco to literally help organizations find the assets, the users, and the applications that they just don't know about.
• 4:12
  SPEAKER_01: The concept is you can't protect what you don't know.
• 4:15
  SPEAKER_01: And in today's world, it's gotten so dynamic where everything's internet connected and users are not just employees, but contractors and supply chains.
• 4:25
  SPEAKER_01: And then the applications are both on-premise and cloud and a hybrid thereof that it's just become physically impossible for the security and the IT personnel to keep up with that dynamic change of every single one of those things on a continuous basis.
• 4:39
  SPEAKER_01: And so we simplified that here at CECO.
• 4:41
  SPEAKER_00: And that's software, hardware, everything in the world of cybersecurity.
• 4:46
  SPEAKER_01: That's correct.
• 4:47
  SPEAKER_01: So the way we look at it is the fundamentals are frankly broken, right?
• 4:51
  SPEAKER_01: Every framework of security and IT, whether it's ISO or MITRE or NIST or CIS controls, they always say, and the first two, three things they need to do, know your devices and know your software, right?
• 5:04
  SPEAKER_01: And then there's also users.
• 5:06
  SPEAKER_01: And yet we as an industry in the cybersecurity space have always jumped over and said, well, I just need to protect this and I need to protect that.
• 5:13
  SPEAKER_01: Well, that's awesome.
• 5:14
  SPEAKER_01: But the problem is not what we're protecting.
• 5:17
  SPEAKER_01: The hackers and attackers and all the bad things are happening to the things that aren't protected or aren't being protected properly or updated.
• 5:24
  SPEAKER_01: And so a lot of the times in the discovery and instant response of what's happening, they realize we didn't even know about it.
• 5:29
  SPEAKER_01: It wasn't even in our inventory list, or it was overlooked, right?
• 5:32
  SPEAKER_01: Or it was something that somebody obscure had that didn't seem to be a threat for us, right?
• 5:37
  SPEAKER_01: And so when we decide that, we said, that's the challenge with today.
• 5:41
  SPEAKER_01: So with the fact that there still remains a huge human resource problem of just general volume of personnel and IT and security in general.
• 5:49
  SPEAKER_01: Second is a skill level, is that, you know, not anybody that has subsequent knowledge is usually put at a higher value of managing the postures and the policies.
• 5:59
  SPEAKER_01: And so we're hurting on the skills understanding of the complexity of all that.
• 6:03
  SPEAKER_01: And then the third is just being able to keep up with it all.
• 6:05
  SPEAKER_01: So we created a way to not be intrusive to an organization and yet provide immediate value.
• 6:12
  SPEAKER_01: And to your point, we're so honored to be selected for the RSA Innovation Sandbox finalist, knowing that there's only 10 companies.
• 6:19
  SPEAKER_01: But more importantly, for those in the audience that don't know how that's done, over 800 companies applied.
• 6:26
  SPEAKER_01: And not only did you apply, but you had to do a video, a three-minute video, and fill out, in essence, a dissertation of an application.
• 6:32
  SPEAKER_01: And then the judges had to filter all of those and to see which ones stood out the most.
• 6:39
  SPEAKER_01: So, unlike other awards, it can be like, oh, that was fractional, or you had some sort of influence.
• 6:43
  SPEAKER_01: The judge, we knew nobody in the judge category.
• 6:46
  SPEAKER_01: And they took us at what we presented as our value.
• 6:49
  SPEAKER_01: And so it's a huge honor to be collected and selected for this particular uh set of innovators.
• 6:55
  SPEAKER_00: Well, yeah, it's awesome.
• 6:56
  SPEAKER_00: I had no idea as many as that submitted every year.
• 6:59
  SPEAKER_00: That's quite impressive.
• 7:00
  SPEAKER_00: And I'd hate to be the judges having to sift through all those and somehow pick 10 because there's some awesome companies out there doing some pretty amazing things.
• 7:06
  SPEAKER_00: So congrats on getting through to the final.
• 7:09
  SPEAKER_00: That's a big step forward.
• 7:10
  SPEAKER_00: It does put a bit of pressure, though, to explain what is the big innovation that SEFCO is bringing.
• 7:15
  SPEAKER_00: I mean, the idea of finding what you have is obviously not a groundbreaking in itself.
• 7:19
  SPEAKER_00: People who try to do that for years, I'm wondering what you're bringing to the market that is a little bit different, that's going to make a difference for your customers.
• 7:26
  SPEAKER_01: Great.
• 7:26
  SPEAKER_01: Good question.
• 7:27
  SPEAKER_01: Because what we're doing is not sexy, right?
• 7:29
  SPEAKER_01: And it's a fundamental requirement for any cybersecurity posture or IT kind of blueprint of their organization.
• 7:36
  SPEAKER_01: And people have tried this.
• 7:37
  SPEAKER_01: That's a great statement.
• 7:38
  SPEAKER_01: We love that.
• 7:39
  SPEAKER_01: So I think there's a couple of things.
• 7:40
  SPEAKER_01: One, we've combined an architecture that is cloud native.
• 7:44
  SPEAKER_01: Okay.
• 7:44
  SPEAKER_01: And anything in the past, realistically, when I say the past, like anything before about two, three years ago, had a physical element.
• 7:51
  SPEAKER_01: It was an appliance or a piece of software or something that had to be installed, an intrusive, an agent or a scanner.
• 7:57
  SPEAKER_01: Okay.
• 7:58
  SPEAKER_01: So we went 100% cloud native.
• 8:00
  SPEAKER_01: We don't use any of that.
• 8:01
  SPEAKER_01: The second thing is it was always one-sided, either behind the firewall and on premise, or only out in the cloud, right?
• 8:09
  SPEAKER_01: And being from outside the firewall, like you see with attack surface management products.
• 8:13
  SPEAKER_01: And so there was nothing that was comprehensive bringing both of those worlds together.
• 8:17
  SPEAKER_01: And so we've been able to do that.
• 8:19
  SPEAKER_01: The other piece is the experience and depth of understanding correlation.
• 8:25
  SPEAKER_01: So our entire team has actually built this product four times.
• 8:30
  SPEAKER_01: And I say that in a sense of they were in the Air Force or military, they built it once.
• 8:35
  SPEAKER_01: They came from our combined sort uh collections of silence and Carbon Black, where we were as the early employees and growth employees there.
• 8:43
  SPEAKER_01: Then many of us were all together at a company called JASC, which was a next gen SIM that got bought by Sumo Logic.
• 8:49
  SPEAKER_01: And so what we finally found was we're just really good at understanding how a variety of data sources get adjoined and basically brought together, aggregated, and then correlated, but not in the correlation of sense of a threat, like a sim, but rather in the ability to understand how to deduplicate, deconflict, parse, normalize, and visualize and even export data from anything that's in an organization.
• 9:17
  SPEAKER_01: So that magic is what's really crucial because, in going back to your point, of people tried this in the past, the challenge is both an architectural element, but also a perspective of how one looks at bringing all these attributes of users, devices, and applications together at the same time.
• 9:33
  SPEAKER_01: And so that's kind of the magic sauce and the technology because it goes into, of course, your what's now nomenclature of AI and ML, great.
• 9:41
  SPEAKER_01: That just facilitates the human understanding.
• 9:44
  SPEAKER_01: But there's the we use Venn diagrams as our anchor visualization that shows how various databases of anything, an endpoint, active directory, patch management, network monitor, you know, you kind of you name it your router, switch hub, firewall, all of those elements have data relative to various things about a device or a user or an application.
• 10:09
  SPEAKER_01: But not one of those is the single source of truth.
• 10:12
  SPEAKER_01: Not one of those is 100% accurate.
• 10:15
  SPEAKER_01: And so our magic is being able to create that single source of truth so that now good decisions can be made on really good data.
• 10:24
  SPEAKER_00: So then, Greg, in the absence of Sefco, then people are challenged with trying to make sense of disparate data from different tools.
• 10:32
  SPEAKER_00: Is that what I'm sensing you're saying?
• 10:33
  SPEAKER_02: That is 100% correct.
• 10:35
  SPEAKER_00: Okay.
• 10:35
  SPEAKER_00: So that they're in a world of getting data, but turning it into intelligence is one of the challenges that you probably solve for them, it sounds like.
• 10:42
  SPEAKER_02: We really do.
• 10:43
  SPEAKER_00: To your point at the start about shortage in people and shortage in skills, that must hit home pretty hard where people are saying, well, I can't get many more people with the skills that I need to get to try and figure all this out manually.
• 10:54
  SPEAKER_01: That's correct.
• 10:55
  SPEAKER_01: And people have.
• 10:56
  SPEAKER_01: So uh the point is in the past, we either have people, organizations that we talk to, either they don't think it's a problem, which is unfortunate, or they've been trying to do it manually.
• 11:05
  SPEAKER_01: When I'm there's two ways they've done it manually.
• 11:06
  SPEAKER_01: Either they built their own solution because nothing existed as a commercially viable or supported product that they've had to build it.
• 11:13
  SPEAKER_01: You find that heavily in financial organizations and kind of oil and gas, because it's so necessary, but they had to build it themselves.
• 11:21
  SPEAKER_01: And then the other side is it's a manual effort where we talk to many other organizations like, yeah, yeah, yeah, I'll pull down for my endpoint and I'll combine it with my active directory.
• 11:29
  SPEAKER_01: And I might look at my patch.
• 11:31
  SPEAKER_01: Well, that's a very manual process, which is not real time.
• 11:34
  SPEAKER_01: By the time they pull the Excel spreadsheets, they're already out of date, right?
• 11:37
  SPEAKER_01: They're already, then you got this manual process of trying to correlate different spreadsheets and pivot tables and everything else, and it's like a disaster.
• 11:45
  SPEAKER_01: So there's human error that's inevitably going to be there.
• 11:47
  SPEAKER_01: And then it just takes literally days to weeks to even months to get what they're trying to do.
• 11:52
  SPEAKER_01: So that's been the second two routes of manually doing it.
• 11:55
  SPEAKER_01: And then there's others that have just relied on single database sources.
• 11:59
  SPEAKER_01: For example, hey, my patch management does this, or most importantly, it actually has been vulnerability management.
• 12:04
  SPEAKER_01: Oh, yeah, I've got that and it does it.
• 12:06
  SPEAKER_01: But the problem that we see, again, to your point, is that multiple data sources or just one, again, fails to continuously understand what's happening real time.
• 12:16
  SPEAKER_01: I mean, like not hours or days, but like within the same hour, everything is changing because there's always devices coming on the network and off the network.
• 12:22
  SPEAKER_01: And so therefore, that dynamicism is really needing to be understood.
• 12:26
  SPEAKER_01: The second thing is that telemetry.
• 12:28
  SPEAKER_01: So the telemetry, meaning the association of a device and a user in an application, and if you think about it, it depends on who you are in an organization, is really where your perspective wants to go, right?
• 12:40
  SPEAKER_01: So an IT guy might be like, yeah, I want to know about the device.
• 12:43
  SPEAKER_01: But an application manager may want to know, I want to know about the applications that they're using.
• 12:47
  SPEAKER_01: You might have somebody as an identity access manager is like, I want to know about the user.
• 12:51
  SPEAKER_01: So they need to pivot off of the exact same data, but have different perspectives.
• 12:55
  SPEAKER_01: And that has been our ace in the whole in being able to provide that kind of intelligence is exactly what you said.
• 13:00
  SPEAKER_00: With these different use cases, then who's the buyer?
• 13:03
  SPEAKER_01: Great question.
• 13:04
  SPEAKER_01: We come in from the security side.
• 13:06
  SPEAKER_01: So here's why the security personnel find this as an absolute must to protect the organization, both proactively in terms of a tight security posture, but also reactively and instant response and risk management.
• 13:19
  SPEAKER_01: The IT side signs it important, but typically feels like they've had it covered.
• 13:24
  SPEAKER_01: And in truth, they have had tools.
• 13:26
  SPEAKER_01: You've got, you know, ServiceNow, you've got Avanti, you've had BMC Software, you have classic asset management tools.
• 13:33
  SPEAKER_01: But those tools, just like we see in all modern approaches for security, are outdated.
• 13:39
  SPEAKER_01: And they cannot really fix the problem realistically because they have all this inertia as publicly held companies.
• 13:44
  SPEAKER_01: They also have all an enormous amount of tech debt.
• 13:47
  SPEAKER_01: And therefore, they can just keep doing what they're doing, which again is incomplete.
• 13:52
  SPEAKER_01: It's not real time, and frankly, it's laborious, like both physically and financially.
• 13:57
  SPEAKER_01: It's taxing.
• 13:58
  SPEAKER_01: And why stick with that?
• 13:59
  SPEAKER_01: So the IT guys, when we say, look, we can make this challenge much easier for you.
• 14:03
  SPEAKER_01: We can even supplement what you've got.
• 14:04
  SPEAKER_01: You don't have to replace.
• 14:05
  SPEAKER_01: We're not in a rip and replace type technology.
• 14:08
  SPEAKER_01: We are one that supplements service now, and we supplement what they already have because there are elements of those.
• 14:13
  SPEAKER_01: They collect different attributes than we do.
• 14:15
  SPEAKER_01: So the magic is we will ingest their data, we'll augment it, enhance it, and then we'll even give it all back to them.
• 14:21
  SPEAKER_01: So now they have something cleaner, like a pure database.
• 14:24
  SPEAKER_01: Same thing happens on the SIM side.
• 14:26
  SPEAKER_01: We extract information out of like Splunk and log rhythm and log logic and other SIM tools, and then we'll augment it, enhance it, and we'll give it back to them.
• 14:34
  SPEAKER_01: So they again, they're taking threat data and that side on the security side in a much more comprehensive way.
• 14:40
  SPEAKER_01: And on the asset side, they get a much more comprehensive way.
• 14:43
  SPEAKER_01: In both cases, it enhances the workflows.
• 14:46
  SPEAKER_01: So what we love is we just fit right into their workflows, they're right into their ticketing systems, right into how the people manage that.
• 14:53
  SPEAKER_01: But to your point, it's actually intelligence.
• 14:55
  SPEAKER_01: We actually call our platform the SEVCO Asset Intelligence platform.
• 15:00
  SPEAKER_00: Yeah, that makes sense.
• 15:01
  SPEAKER_00: I mean, ServiceNow is a maybe unfairly, I think of them as a workflow company.
• 15:05
  SPEAKER_00: Um, and they need that rich data to be able to do many of the things that they offer their customers, right?
• 15:11
  SPEAKER_00: There's definitely a need for some alternative sources to flesh it out.
• 15:14
  SPEAKER_00: How do you know if a prospect is a good prospect for you?
• 15:19
  SPEAKER_01: That's a very good question.
• 15:20
  SPEAKER_01: We've for some of us been to trial and error, but we actually sell up and down the spectrum.
• 15:25
  SPEAKER_01: We found, I mean, we have little healthcare companies, 300 people, that are like, this is fantastic.
• 15:29
  SPEAKER_01: Then we have multinational Fortune 500s, we got like five of them right now, that are challenged with a different problem of diversity, meaning just they're fragmented, right?
• 15:39
  SPEAKER_01: They got, you know, 60 countries they're in, they've got 150,000 employees, and they have a very hard time keeping their arms around it.
• 15:47
  SPEAKER_01: So part of it comes to use case.
• 15:49
  SPEAKER_01: And I think like in the smaller companies, we found there's certain elements of that human, like I'd love to automate this.
• 15:55
  SPEAKER_01: Like, if you got a push button that I can do this, that's not intrusive to my organization, that's fantastic because I'm one person and I'm trying to do security and IT.
• 16:02
  SPEAKER_01: So we solve that.
• 16:03
  SPEAKER_01: The ones that are the larger organizations, they typically have teams and plenty of money.
• 16:07
  SPEAKER_01: So their challenge is a little different.
• 16:08
  SPEAKER_01: They're like, I've got 80 different tools and systems in my network.
• 16:12
  SPEAKER_01: Can you fit into that and can you work with all those?
• 16:14
  SPEAKER_01: And the answer is yes.
• 16:16
  SPEAKER_01: And by the way, we're not intrusive because you don't have to go through this process of like agent deployment for a year.
• 16:21
  SPEAKER_01: You know, you don't have to do scanning and intrusive on all the networks.
• 16:24
  SPEAKER_01: We believe our fundamental belief is you already have enough tools.
• 16:27
  SPEAKER_01: You already have enough systems.
• 16:29
  SPEAKER_01: Let's just make the best use of them.
• 16:30
  SPEAKER_01: So, kind of that's a long-winded answer for how do you identify customers that we've actually found that it's really a mindset, it's a maturity.
• 16:37
  SPEAKER_01: Like, how do they think about security in their organization and how confident are they that they actually know what they don't know?
• 16:44
  SPEAKER_01: So it's interesting.
• 16:45
  SPEAKER_01: One of our first qualifying questions is definitely, do you even see this as a problem?
• 16:49
  SPEAKER_01: Because if they're like, no, I got this covered.
• 16:50
  SPEAKER_01: We know they don't because it's one of those same things like endpoint.
• 16:53
  SPEAKER_01: Like, if you don't, if you think you've never been attacked, you're way off base, right?
• 16:57
  SPEAKER_01: Because everybody's been attacked.
• 16:59
  SPEAKER_01: So it's the same thing as like they do that, we just move on, right?
• 17:01
  SPEAKER_01: They're not mature enough yet.
• 17:03
  SPEAKER_01: And so that's one of the first questions.
• 17:05
  SPEAKER_01: Then we go down into the other one, which is what are you doing about it today?
• 17:07
  SPEAKER_01: And that's when we get to discover have they built their own?
• 17:10
  SPEAKER_01: Are they using individual data source tools?
• 17:12
  SPEAKER_01: Uh, are they manually trying to do it ad hoc?
• 17:15
  SPEAKER_01: And that helps us qualify also a maturity level.
• 17:18
  SPEAKER_01: And then which kind of the decision tree is if they've already built it, it's more like, do you want to keep doing that?
• 17:22
  SPEAKER_01: Because if you are, that's fine.
• 17:23
  SPEAKER_01: And we can either discuss about augmenting what you've got or replacing what you got, right?
• 17:27
  SPEAKER_01: Or no, I don't want to do this anymore.
• 17:28
  SPEAKER_01: I need a commercially viable product.
• 17:29
  SPEAKER_01: So we get to go down another path.
• 17:31
  SPEAKER_01: So as we go down the qualification, we understand those.
• 17:33
  SPEAKER_00: Yeah, you'd really dig in to see how many view it.
• 17:35
  SPEAKER_01: Like there's no industry that doesn't need it.
• 17:37
  SPEAKER_01: That's what's fascinating.
• 17:38
  SPEAKER_01: Like we now sell into every industry and almost equitably.
• 17:42
  SPEAKER_01: Like almost almost say, you know, there's not one that has been significantly heavier than another.
• 17:46
  SPEAKER_01: And we are even selling heavily into MSSPs.
• 17:50
  SPEAKER_01: So if you think about that, they are needing and actually requiring in a service level agreement, typically, managing their customers.
• 17:57
  SPEAKER_01: So typically in that environment, the customer doesn't know.
• 18:00
  SPEAKER_01: So therefore, the MSSP doesn't know.
• 18:03
  SPEAKER_01: The communication between those companies is not always current and consistent.
• 18:07
  SPEAKER_01: So what Sevco provides is a single dashboard and a single view so that both entities know exactly what's going on real time about their organization.
• 18:16
  SPEAKER_01: And it's a huge advantage for both the end user customer as well as the MSSP in providing a high quality of service.
• 18:22
  SPEAKER_00: And I bet the MSSP likes that you're cloud native, for one, right?
• 18:25
  SPEAKER_00: Fits in their model really nicely.
• 18:27
  SPEAKER_01: It does because, again, as you know, that model is great because it also not only again, some manage massive organizations and many are managing hundreds to thousands of small organizations, and they don't have the people either.
• 18:38
  SPEAKER_01: So having this in an automated way from one central point that's not intrusive to be able to absorb all that is hugely profound for them.
• 18:45
  SPEAKER_01: And they could do this in an audit.
• 18:47
  SPEAKER_01: A lot of what they get to do in the MSSP space in particular is you know, let's do an assessment.
• 18:52
  SPEAKER_01: Let's make sure that we're both on the same page, we understand where we sit, and now we can work on proving and closing gaps.
• 18:58
  SPEAKER_01: And so that's a key value added.
• 19:00
  SPEAKER_01: So we're gonna close gaps.
• 19:01
  SPEAKER_01: We're gonna just keep tightening the gaps and be understood real time when there's an exposure.
• 19:06
  SPEAKER_01: Exposure could be, you know, a device came online and it doesn't have the proper security protection, or something came online and we're not even sure what it is, and we need to investigate that.
• 19:15
  SPEAKER_01: So a lot of those things come in real time and it makes it much more manageable.
• 19:18
  SPEAKER_00: So let's talk about the selling motions then, Greg.
• 19:21
  SPEAKER_00: So when did you bring on your first seller?
• 19:23
  SPEAKER_00: And where in the maturity of Sevco was that?
• 19:28
  SPEAKER_01: We were a year, basically a year after we started, we had a very solid version one, but very solid and stable product.
• 19:37
  SPEAKER_01: Myself and my co-founder, CEO, JJ Guy, were basically the sales force, right?
• 19:41
  SPEAKER_01: As an early stage, it does.
• 19:43
  SPEAKER_01: And then we hired a person we had known who was really solid at positioning and prospecting, especially in the mid-market space, which seemed to be the ideal space for us to enter, again, relative to the value prop, that there's not enough people, not enough skill, and they need to get a hold on this.
• 19:59
  SPEAKER_01: And so that's one person started and it really gave us focus and it gave us iteration of the message, right?
• 20:07
  SPEAKER_01: Like he tried this and it didn't work.
• 20:09
  SPEAKER_01: He tried that, and it might not be as accurate.
• 20:11
  SPEAKER_01: And that iteration of the message helped us fine-tune the value proposition into that one thing.
• 20:16
  SPEAKER_01: Like, what do you do?
• 20:18
  SPEAKER_01: Right?
• 20:18
  SPEAKER_01: I'm not five, I want one.
• 20:20
  SPEAKER_01: And then I earn my rights so that I can continue to talk and see if there's value.
• 20:25
  SPEAKER_01: One guy was about a year in with a V1 product.
• 20:28
  SPEAKER_00: So I love that.
• 20:29
  SPEAKER_00: And I think it's underrated the ability to really learn from positioning because uh start your guessing a little bit, right?
• 20:35
  SPEAKER_00: You get an idea of what you think it should be, but until you actually go talk to a real live prospect, you don't really know what hits home and what doesn't hit home.
• 20:42
  SPEAKER_01: That's right.
• 20:42
  SPEAKER_01: We did a lot of research before we even started.
• 20:44
  SPEAKER_01: We talked to 60 operators, like CIOs, CISOs, security operators, security architects, to even qualify that there was a big enough problem here and to help us provide the higher level, you know, 50,000 foot architecture of what they would like to see.
• 20:58
  SPEAKER_01: But that still wasn't exactly, you know, selling, right?
• 21:01
  SPEAKER_01: Until we had a product we could visualize and we could install and it could actually run with confidence.
• 21:06
  SPEAKER_01: We waited until that point to really pull on true sales.
• 21:10
  SPEAKER_00: It's so different when you don't have CEO or founder in your title to go out there and be a seller, right?
• 21:15
  SPEAKER_01: Yeah.
• 21:15
  SPEAKER_01: You got to have a lot of passion and frankly fearlessness, right?
• 21:19
  SPEAKER_01: Because you got to understand it and be like, I'm laying it out there and I am perceived as a sales rep, right?
• 21:25
  SPEAKER_01: Like you said, I'm not the founder, I'm not the architect.
• 21:27
  SPEAKER_01: But you know, I think finding the right person is really key who's kind of just dogged persistence, willing to have the door slapped in their face and be like, yep, and I missed, you know, missed the message or whatever it is, and just know that that's okay.
• 21:40
  SPEAKER_01: Like we will work it out.
• 21:41
  SPEAKER_01: And what we've done since then is that we've been methodical in almost like a queuing theory, right?
• 21:46
  SPEAKER_01: Of what's the capacity this person can handle before we added another.
• 21:50
  SPEAKER_01: And then we also have been very methodical in where in the United States.
• 21:54
  SPEAKER_01: So we primarily sell in the United States.
• 21:56
  SPEAKER_01: We don't have anybody outside the United States either as an employee or uh focus on selling.
• 22:00
  SPEAKER_01: However, we have had outbound international people call in and be like, I'd like that.
• 22:04
  SPEAKER_01: And we have sold internationally significantly.
• 22:06
  SPEAKER_01: It's just we're a cloud-based product, it makes it much easier.
• 22:09
  SPEAKER_01: But the point being is we've selled the sales motion where we've focused on this kind of a mid market accounts primarily.
• 22:15
  SPEAKER_01: Then we've added a couple of sales guys that are very much strong in the enterprise class sales.
• 22:19
  SPEAKER_01: So something that's in our case, we kind of break it down to kind of 10,000, 15,000 employees and below.
• 22:25
  SPEAKER_01: And we go by employee count, by the way, not dollar volume, but we go employee count, and then we go above that as more enterprise class.
• 22:32
  SPEAKER_01: And then we have the MSSP motion.
• 22:33
  SPEAKER_01: So those are three motions that we're working on now.
• 22:36
  SPEAKER_00: And is it MSSP your main channel, or do you do a traditional security channel as well?
• 22:41
  SPEAKER_01: Great question.
• 22:41
  SPEAKER_01: We are primarily MSSP as a channel orientation.
• 22:46
  SPEAKER_01: We're still, you know, we're still earning our stripes with the resellers, right?
• 22:49
  SPEAKER_01: They've got not necessarily they they necessarily have a solution today, but like in all channel operations, they want to be confident before they represent a product.
• 22:58
  SPEAKER_01: And so we're going in individually with certain channel partner sales reps, and we're kind of winning in the kind of grassroots effort, right?
• 23:04
  SPEAKER_01: Earning our stripes and getting the confidence.
• 23:06
  SPEAKER_01: And frankly, that's what I've done for 27 years.
• 23:08
  SPEAKER_01: I'm a huge channel fan.
• 23:10
  SPEAKER_01: We are technically 100% channel committed, meaning not only is our product multi-tenanted and designed for the channel itself, but we're priced that way.
• 23:18
  SPEAKER_01: We have the whole attitude, which is really the most important thing.
• 23:21
  SPEAKER_01: We find a deal, we'll throw it over the fence.
• 23:23
  SPEAKER_01: We don't need to take it direct.
• 23:24
  SPEAKER_01: I personally don't want to take it direct.
• 23:26
  SPEAKER_01: As any small company, you have to carry the flag, right?
• 23:29
  SPEAKER_01: You got to be like that product marketing expert that can be the subject matter and represent it.
• 23:33
  SPEAKER_01: But it doesn't mean we have to take it ourselves from a financial perspective.
• 23:36
  SPEAKER_01: We're willing to share the wealth, right?
• 23:38
  SPEAKER_01: And that's how we scale.
• 23:39
  SPEAKER_01: And that's where we get believers and expand the aperture of opportunity.
• 23:43
  SPEAKER_00: I'm just saying that in a slightly different lens, though.
• 23:45
  SPEAKER_00: You had a background in marketing at cybersecurity companies.
• 23:48
  SPEAKER_00: You know, right now, who knows what the right number is, but 3,000 vendors and cybersecurity, there's a lot of people trying to reach the same people.
• 23:55
  SPEAKER_00: And no wonder that everyone's buried or just not taking calls or answering emails or doing anything with vendors when you think about CISOs and you know Cisso minus ones inside these organizations.
• 24:05
  SPEAKER_00: What role does a marketing team have of trying to make a splash or trying to do something different as opposed to just saying, well, let's do some sequences and let's do some white papers and things like that?
• 24:15
  SPEAKER_01: You're asking the magic question, and not that I have the right answer, but I have one that works for us.
• 24:20
  SPEAKER_01: The typical Fitzgerald model of marketing has been take a widget and make it known, right?
• 24:25
  SPEAKER_01: That's if I summer it down, Greg Fitzgerald is a market maker because I'll take something and all of a sudden people are like, oh my gosh.
• 24:31
  SPEAKER_01: And it's usually done in a spectacular way in some way, shape, or form.
• 24:35
  SPEAKER_01: Very expensive, usually.
• 24:36
  SPEAKER_01: Don't try to be, but just you know.
• 24:37
  SPEAKER_00: It worked at silence.
• 24:39
  SPEAKER_01: Yes, it did.
• 24:39
  SPEAKER_01: Yeah, it did work at silence.
• 24:41
  SPEAKER_01: But funny enough, we were methodical, we kind of grew uh conservatively in the sense of not going over our skis.
• 24:47
  SPEAKER_01: And then when the time was right where we knew the product worked, we had enough volume of customer base and testimonial, then we realized when we studied where we were in terms of growth, our only problem was overall awareness.
• 24:59
  SPEAKER_01: And that was like, now we got to go hit it hard.
• 25:01
  SPEAKER_01: But before that, and I think you're hitting a very apropos question here relative to so many vendors, and uh being I'm part of the problem as a marketer, where we pretty much will say whatever the hell we have to say to get the attention.
• 25:14
  SPEAKER_01: And we're not telling the absolute truth about our product, our capabilities, and it drives me bonkers.
• 25:21
  SPEAKER_01: So buyers are much more skeptical than they've ever been.
• 25:24
  SPEAKER_01: So now in today's world in 2022, I think it is so much about being authentic.
• 25:29
  SPEAKER_01: Like just say what you do and be honest about what you don't do.
• 25:33
  SPEAKER_01: Because once you get in there and they find out you don't do it, your integrity is shot, right?
• 25:38
  SPEAKER_01: And your competitors are gonna take that and rub it in your face, right?
• 25:42
  SPEAKER_01: And the customers are gonna be like, yeah, and they talk.
• 25:44
  SPEAKER_01: So when you're a small company or a large company, when you're a small company, you cannot afford negative talk.
• 25:50
  SPEAKER_01: So do what you say you do.
• 25:51
  SPEAKER_01: Don't lean too far over your skis and be authentic.
• 25:55
  SPEAKER_01: So for marketing, it's like the content has to be relative to testimony and true use cases, like you said before, like here are all the five use cases.
• 26:03
  SPEAKER_01: And someone says, Well, do you do this?
• 26:05
  SPEAKER_01: Instead of saying, Yeah, we do it and try to figure it out, be like, let's talk about that.
• 26:09
  SPEAKER_01: We don't do it flat out, but we might be able to do it.
• 26:13
  SPEAKER_01: Like work with the customer to realize you're not there yet.
• 26:16
  SPEAKER_01: It's surprising how we have found so many of the prospects we talked to when we were totally just frank with them, they're like, no problem.
• 26:22
  SPEAKER_01: At least you were honest.
• 26:23
  SPEAKER_01: You know what?
• 26:23
  SPEAKER_01: We'll work with you.
• 26:24
  SPEAKER_01: We'll be a design partner, right?
• 26:25
  SPEAKER_01: We'll be a development side for you.
• 26:27
  SPEAKER_01: And we're like, this is fantastic.
• 26:28
  SPEAKER_01: Because, you know, from a salesperson, you're like, I don't want to lose a deal, right?
• 26:31
  SPEAKER_01: I'm gonna promise it.
• 26:32
  SPEAKER_00: I don't know how much plate.
• 26:33
  SPEAKER_00: I can't be saying no to people.
• 26:35
  SPEAKER_01: Yeah.
• 26:36
  SPEAKER_01: Like, but that wasn't our culture.
• 26:37
  SPEAKER_01: We're like, we're willing to take that hit, right?
• 26:39
  SPEAKER_01: Personally, we just know that if we grow methodically, conscientiously, honestly, we'll get there.
• 26:44
  SPEAKER_01: Now, I say that with a tongue in cheek that there's a point in visibility and awareness that we're gonna have to start doing a little more, being recognized.
• 26:51
  SPEAKER_01: Uh, not quite sure how that's gonna unfold.
• 26:53
  SPEAKER_01: I have usually been like advertising and billboards or some big splash at RSA or trying to do some sort of big event that highlights it.
• 27:02
  SPEAKER_01: I think map marketing has actually changed in today's world.
• 27:05
  SPEAKER_01: And rather it's more about who's your ecosystem?
• 27:08
  SPEAKER_01: Who do you partner with?
• 27:09
  SPEAKER_01: Not just like reseller and channel, but like who's your technology partners, you know, because customers aren't buying just one product, best of breed, right?
• 27:15
  SPEAKER_01: They're buying stuff that has to integrate and work with other technologies.
• 27:19
  SPEAKER_01: And so we at Sevco are taking attack to really honor that and recognize that it's always a solution.
• 27:25
  SPEAKER_01: It's not take this and like push those guys aside.
• 27:28
  SPEAKER_01: You know, it's like, hey, yeah, and it might not be us first.
• 27:31
  SPEAKER_01: We just went some sales efforts recently and I kind of deferred, like, don't start with us.
• 27:36
  SPEAKER_01: You need to start with them.
• 27:37
  SPEAKER_01: Well, interesting because you're giving up share wallet, right?
• 27:40
  SPEAKER_01: Like they may not have any money to buy us, but it was the right thing to do for the customer.
• 27:44
  SPEAKER_01: And the customer's like, yeah, I'm gonna start over there first, and then I'll come back to you.
• 27:47
  SPEAKER_01: So it may be a deal in a year, two years, which is okay by us in the sense that the ecosystem is much more important now than it ever has been.
• 27:54
  SPEAKER_00: Sure.
• 27:55
  SPEAKER_00: Do you remember the first customer you won?
• 27:57
  SPEAKER_01: Here?
• 27:57
  SPEAKER_00: Yeah.
• 27:58
  SPEAKER_01: Oh, yeah.
• 27:59
  SPEAKER_01: The first customer we had was an MSSP that saw the value like from the beginning, and it was great because we all, all of us at the same time, like had our eyeballs wide open to the realities and the deficiencies of the product at the time.
• 28:12
  SPEAKER_01: But that per that entity has stayed with us for two and a half years now and it's been fantastic.
• 28:17
  SPEAKER_00: That's awesome.
• 28:18
  SPEAKER_00: Well, listen, I imagine you're doing a ton of hiring.
• 28:20
  SPEAKER_00: Uh, if someone wants to find out what's going on, careers page on Sevco, is that the way to go?
• 28:25
  SPEAKER_01: We don't have a careers page.
• 28:26
  SPEAKER_01: We just don't have one yet.
• 28:28
  SPEAKER_01: Been focused on selling, but please send information to hello at sevco.io or hello at sevco security.com.
• 28:36
  SPEAKER_01: You can find us both on sevco.io or sevco security.com and look for us.
• 28:41
  SPEAKER_01: We're obviously going to be at RSA with Booth.
• 28:44
  SPEAKER_01: Uh, we'll be at Black Hat as it comes up.
• 28:46
  SPEAKER_01: And, you know, we'll starting to get out there a lot more relative to, you know, events and trade shows and places where people who have an interest in us, we'd love to talk to you.
• 28:54
  SPEAKER_01: We are growing.
• 28:55
  SPEAKER_01: We're a fantastic organization and culture, most importantly.
• 28:58
  SPEAKER_01: And we seem to be in pretty hot space.
• 29:00
  SPEAKER_01: So we'll see where we go.
• 29:01
  SPEAKER_00: Well, it's such a cool time in the company's growth, you know, getting these accolades starting to come in, the customer base is growing.
• 29:08
  SPEAKER_00: It must be a really cool time to be there.
• 29:09
  SPEAKER_00: So congrats on all the success so far.
• 29:11
  SPEAKER_00: And good luck with the innovation sandbox presentation and contest coming up at RSA.
• 29:16
  SPEAKER_00: Hope to see you on the floor at some point when we're there.
• 29:18
  SPEAKER_01: Thank you so much, Andrew.
• 29:19
  SPEAKER_01: You've been kind to have me on with your show today.
• 29:22
  SPEAKER_00: Well, that was a fun episode with Greg.
• 29:24
  SPEAKER_00: He's someone I could listen to for quite a while.
• 29:26
  SPEAKER_00: He's obviously very dynamic and also thoughtful about how he tackles the questions and also the problems of joining a company in the cybersecurity space.
• 29:33
  SPEAKER_00: Some takeaways from me.
• 29:34
  SPEAKER_00: The first one was that he started off by saying they're helping to tackle one of the biggest problems in cybersecurity, which is the talent and skills shortage, right?
• 29:44
  SPEAKER_00: So they're attaching themselves to one of the biggest problems that many, many organizations are facing right now.
• 29:50
  SPEAKER_00: So I thought that was really, really useful to hear that.
• 29:52
  SPEAKER_00: Secondly, uh part of their uniqueness is around how they do correlation of many attributes across many types of systems.
• 30:00
  SPEAKER_00: It's not just a security correlation such as a sim would do, but taking many different things and bringing them into the SEVCO world to be able to then make calls, which then, of course, the business impact is going to be helping their team be more effective, like I said before.
• 30:15
  SPEAKER_00: And the third thing that was kind of interesting for me was even though, as an asset management tool, they service multiple different use cases that will help and make an impact for multiple different teams in the organization, it's still security for Sevco that is the primary buyer where they're getting the most success.
• 30:31
  SPEAKER_00: So those security use cases are still super, super powerful, even though the others will get some benefits by having the tool as well.
• 30:38
  SPEAKER_00: So that was my conversation with Greg Fitzgerald, the co founder and president at Sevco Security.
• 30:42
  SPEAKER_00: And I wish them best of luck at the sandbox competition at RSA.