Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Regulation, Revenue, and Reluctance: Selling to OEMs in Cyber

Transcript

Regulation, Revenue, and Reluctance: Selling to OEMs in Cyber · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_02: Welcome to a special episode of the Cybersecurity Go to Market podcast.
• 0:47
  SPEAKER_02: We're recording this at the 2025 RSA conference in San Francisco.
• 0:53
  SPEAKER_02: And right now we're with Robbie Robbins, the VP Business Development and Partners at NetRise.
• 0:59
  SPEAKER_02: Robbie, welcome to the podcast.
• 1:01
  SPEAKER_00: Thank you, Andrew.
• 1:02
  SPEAKER_00: I'm glad to be here.
• 1:03
  SPEAKER_02: Now you had to come a long way for this uh this conference, right?
• 1:06
  SPEAKER_00: Yeah, I had a uh a tough commute over the Bay Bridge this morning, which was uh a little bit longer than it normally is because of uh all the enthusiasm around uh RSA today.
• 1:15
  SPEAKER_02: The bridges were packed, is that what you're telling me?
• 1:17
  SPEAKER_02: Even more than usual.
• 1:20
  SPEAKER_02: Well, I'm kind of jealous because I'm not someone that sleeps well in other beds except my one at home.
• 1:24
  SPEAKER_02: So the fact that you get to go home at night and uh and have that experience, I'm very jealous.
• 1:29
  SPEAKER_00: Yeah, if only it was a little longer sleep.
• 1:31
  SPEAKER_00: But uh Yeah.
• 1:32
  SPEAKER_02: Well, uh this is the second time someone from NetRise has been on the podcast.
• 1:37
  SPEAKER_02: I interviewed Tom, your CEO two years ago, actually, this month, April 2023.
• 1:45
  SPEAKER_02: And that was early on in the growth of NetRise.
• 1:49
  SPEAKER_02: So I was interested to get his perspective then.
• 1:50
  SPEAKER_02: And I'm kind of interested, interested in how things have changed.
• 1:53
  SPEAKER_02: I remember talking to Tom at the time, and you know, he was thinking about you know the the plan, the ICP.
• 2:00
  SPEAKER_02: You know, we talked about whether it was gonna be in the enterprise, enterprise buyers, whether it's gonna be OEMs buying.
• 2:05
  SPEAKER_02: And I'm sure you learn a lot along the way.
• 2:07
  SPEAKER_02: Now, you're in the company uh a whole month now, so we're gonna challenge you to be a product expert and all the rest of it and know the ins and outs of it, but uh we'll see how the conversation goes.
• 2:16
  SPEAKER_02: I'll do my best.
• 2:17
  SPEAKER_02: So let's talk about where the company's focusing them for 2025.
• 2:21
  SPEAKER_02: Where where is the ICP that you're you're thinking is where the the rich vein is for NetRise?
• 2:27
  SPEAKER_00: Yeah, kind of taking a broad stroke, right?
• 2:29
  SPEAKER_00: So we kind of look at our market in kind of three areas.
• 2:32
  SPEAKER_00: Uh, one is the equipment manufacturers, the people are creating uh products, uh, enterprises, people that are consuming those are using the products.
• 2:40
  SPEAKER_00: And then there's a kind of a horizontal layer of service providers, uh folks that are providing services to both the device makers or equipment makers and the enterprises.
• 2:50
  SPEAKER_02: And when I talked to Tom, the product was primarily a firmware discovery assessment product.
• 2:58
  SPEAKER_02: How's that evolved over that?
• 2:59
  SPEAKER_00: That's right.
• 3:00
  SPEAKER_00: That's uh kind of where we've come from.
• 3:01
  SPEAKER_00: Our roots was around uh binary composition analysis of looking at a firmware, uh, reverse engineering it and finding vulnerabilities.
• 3:09
  SPEAKER_00: Since 2023, we've actually expanded our capabilities quite a bit.
• 3:13
  SPEAKER_00: So instead of just firmware, we're now looking at compiled code, operating systems, containers, VMs.
• 3:21
  SPEAKER_00: Uh it's a very broad uh solution offering as far as the types of uh files that we will analyze and evaluate.
• 3:29
  SPEAKER_02: And on the OEM side makes sense, right?
• 3:31
  SPEAKER_02: We want to go to the OEMs who actually have their firmware, which we're looking at in other things as well.
• 3:37
  SPEAKER_02: What's their appetite for really tackling this?
• 3:40
  SPEAKER_02: Like is it kind of like they they're interested but not sort of motivated, or are they all in going, no, we need to know this stuff so we can go fix it?
• 3:46
  SPEAKER_00: Aaron Powell That's a great question, right?
• 3:47
  SPEAKER_00: They're very reluctant to actually fix the problems unless there's a monetary uh penalty, so to speak, or a customer driving them to do it.
• 3:55
  SPEAKER_00: So uh from the equipment manufacturers, often they're very reactive, um, you know, only fixing something once there is a product security incident that's been uh released, or somebody goes public with a dis the disclosure about a problem in their equipment.
• 4:09
  SPEAKER_02: I seem to remember that we were talking with Tom that we understood the motivations, right?
• 4:14
  SPEAKER_02: At the end of the day, they're manufacturers of um software or hardware.
• 4:19
  SPEAKER_02: That's right.
• 4:19
  SPEAKER_02: Uh they're not security companies, so they have a very different lens they look through.
• 4:24
  SPEAKER_02: But it's interesting the pressure.
• 4:25
  SPEAKER_02: I'm wondering uh what about legislation?
• 4:27
  SPEAKER_02: What's changed in the last couple of years, three years about that that's maybe driving a little bit different behavior?
• 4:31
  SPEAKER_00: Yeah, that's actually a great point, right?
• 4:33
  SPEAKER_00: There's um a couple inflection points, and one of them is the regulations that are really kind of driving uh enterprises, government agencies to really look at uh kind of what's inside, what they're fielding in their enterprises, right?
• 4:46
  SPEAKER_00: So uh the executive order 14028 that required a software bill of materials for anything running in the federal government, for example.
• 4:54
  SPEAKER_00: Uh you know, there's the Cyber Resilience Act in Europe, which requires some level of transparency of software and equipment that's being fielded.
• 5:02
  SPEAKER_00: So there's a number of uh um these global regulations that are really kind of raising the bar as far as equipment that's being uh deployed in uh critical infrastructure.
• 5:11
  SPEAKER_00: Trevor Burrus, Jr.
• 5:12
  SPEAKER_02: Is there teeth behind the legislation?
• 5:14
  SPEAKER_02: Absolutely.
• 5:14
  SPEAKER_02: That's what happens.
• 5:15
  SPEAKER_00: You know, there's uh uh a fair amount of pressure from enterprises that they push back to the manufacturers to actually fix the problems before they fix it.
• 5:24
  SPEAKER_00: So most of what happens is uh, you know, kind of um it's not financially punitive.
• 5:30
  SPEAKER_00: It's rather kind of reputation or brand damage that the equipment manufacturers will face as far as um, you know, procurement officers uh, you know, kind of holding purchase orders or uh potential purchases hostage until they actually fix some of the problems.
• 5:45
  SPEAKER_02: Aaron Powell There isn't like the the GDPR 4 percent of worldwide revenue fines if you don't do anything like that, is there?
• 5:50
  SPEAKER_00: Aaron Powell I haven't seen that yet.
• 5:51
  SPEAKER_00: But uh there's certainly in the executive order a a fair amount of uh kind of punitive requirements to before you can field something in the uh federal government, you actually have to have a software of materials, right?
• 6:02
  SPEAKER_00: So just uh that requirement is uh pretty significant as far as the equipment manufacturers producing uh a manifest of what's inside.
• 6:11
  SPEAKER_00: So that's where NetRise is right now.
• 6:13
  SPEAKER_02: Now you just joined a month ago.
• 6:15
  SPEAKER_02: You're heading up uh BD and partners.
• 6:17
  SPEAKER_02: Why did you join NetRise?
• 6:19
  SPEAKER_00: Yeah, I mean that's uh you know, kind of one of the topics you mentioned was really around the timing, right?
• 6:24
  SPEAKER_00: I found that the the timing is right to actually uh surface and solve this problem.
• 6:30
  SPEAKER_00: Uh another big reason why I joined is kind of the the technology, right?
• 6:33
  SPEAKER_00: I mentioned the multiple parts of the attack surface that NetRise will uh approach or uh solve.
• 6:39
  SPEAKER_00: Um and kind of the third component is really around the team, right?
• 6:42
  SPEAKER_00: We've got a group of former cyber operators that kind of understand this from an offensive security point of view.
• 6:48
  SPEAKER_00: So uh the timing, the technology, and the team are kind of the things that really compelled me to sign on and uh help lead the BD and uh partner effort.
• 6:57
  SPEAKER_00: And what are you looking to achieve in that role in 2025?
• 6:59
  SPEAKER_00: Yeah, so it's um something that you know we're trying to build a brand and brand awareness around something that people aren't really thinking about and looking for, right?
• 7:07
  SPEAKER_00: So we've got a couple of key uh things that we're focused on.
• 7:10
  SPEAKER_00: And one of them is really building that awareness through uh kind of an inbound uh uh sales motion of trying to drive people to our inbound motions.
• 7:19
  SPEAKER_00: Kind of the second is our outbound of our team really looking to uh find buyers and people that are concerned about this problem.
• 7:26
  SPEAKER_00: And the third is really around how do we build an ecosystem and a partner, a community that can help us with that brand awareness uh um initiative.
• 7:34
  SPEAKER_00: Yeah, you mentioned partners earlier on.
• 7:36
  SPEAKER_02: Um who is a partner then?
• 7:38
  SPEAKER_02: Who's an ideal partner of the market?
• 7:39
  SPEAKER_00: Yeah, so we've got a couple kind of categories of partners, right?
• 7:42
  SPEAKER_00: There's the typical value-added resellers, distributors, which is a big part of our go-to-motion market, uh go to market motion, excuse me.
• 7:50
  SPEAKER_00: Uh kind of another is around kind of managed service providers, people that are taking our technology, wrapping their services around it, and offering it as a managed service.
• 7:58
  SPEAKER_00: And kind of the third uh bucket, if you will, is around our technology ecosystem partners, people that are looking to extend their value by using our capabilities to solve more of the problem than just uh S-BOM, for example.
• 8:10
  SPEAKER_02: Trevor Burrus, Jr.: Where's the biggest opportunity of those three?
• 8:12
  SPEAKER_00: In my opinion, it's with the technology ecosystem partners that really allow us to get uh a broader audience and people that could uh you know leverage the net rise data set, which uh uh we're looking at basically the compiled code, um, deconstructing it, you know, finding all the components inside the code and the subcomponents and the dependencies.
• 8:34
  SPEAKER_00: So it's a very rich data set that I think will be very valuable for the technology partners and our uh targets.
• 8:40
  SPEAKER_00: Aaron Powell Who's an example of a technology partner?
• 8:42
  SPEAKER_00: Trevor Burrus, Jr.
• 8:42
  SPEAKER_00: Well, you think about um kind of risk scoring or people that are doing uh like a security scorecard or a bit site that are providing value to the uh C-level executives or kind of their risk posture.
• 8:54
  SPEAKER_00: So wouldn't it be useful to understand what kind of the equipment in my enterprise and what the risk uh um to the enterprise is of maybe fielding something that has bad code or implants or something along the lines of uh insecure software?
• 9:08
  SPEAKER_02: Aaron Ross Powell And are they looking at uh NetRise as uh a revenue stream that they have an add-on to their product, or is it kind of built in and they're looking to compete better?
• 9:16
  SPEAKER_00: Aaron Powell The former.
• 9:17
  SPEAKER_00: It'll probably be a you know it depends on, you know, each one's gonna potentially be a unique snowflake, but I expect it to be kind of we help them accelerate revenue and look at another revenue stream uh with the net rise data sets.
• 9:29
  SPEAKER_02: Aaron Powell Now just recently you guys announced the run of funding, so congrats on that.
• 9:33
  SPEAKER_02: You also uh uh announced something called Zero Lens, which I I looked at and I I my my technical chops didn't stand up very well trying to understand it all.
• 9:43
  SPEAKER_02: So for a layman, I'm a simple guy from Scotland, right?
• 9:45
  SPEAKER_02: So you have to kind of break it down for me a little bit simply.
• 9:48
  SPEAKER_02: Well, what is Zero Lens all about?
• 9:49
  SPEAKER_00: Aaron Ross Powell So um you think about the data that we have, right?
• 9:53
  SPEAKER_00: We're basically uh deconstructing what's on a device.
• 9:56
  SPEAKER_00: Um Zero Lens basically allows the penetration tester, the offensive security operator, to really find weaknesses in the code and uh potentially find what is exploitable.
• 10:07
  SPEAKER_00: So if you put your uh penetration test or offensive security uh hat on, that information is very valuable.
• 10:14
  SPEAKER_00: So you can kind of whittle down what you want to focus on to what is, quote, exploitable or reachable in the environment.
• 10:20
  SPEAKER_00: Uh, we allow the offensive operator to do that quicker uh and faster and cheaper than they had done uh kind of the manual way.
• 10:27
  SPEAKER_00: And is that a big impact for them or is this a marginal just doing your job a little bit better?
• 10:32
  SPEAKER_00: Aaron Powell We believe it's gonna be a very big impact, right?
• 10:34
  SPEAKER_00: So uh you think about the number of CVEs or vulnerabilities that uh a typical device would have, maybe 10,000, 12,000.
• 10:43
  SPEAKER_00: Uh if you could whittle that down and only focus on the 200 that matter, that's really what zero lens is gonna allow you to do.
• 10:50
  SPEAKER_00: Uh those vulnerabilities that are uh uh CWEs or uh kind of categories of CVEs, uh that's where the offensive operator focuses their precious time on uh trying to uh understand what's exploitable and vulnerable.
• 11:05
  SPEAKER_02: And when I think about lens and a name, it's probably a visibility thing.
• 11:08
  SPEAKER_02: What happens on the remediation side with NetRice?
• 11:10
  SPEAKER_00: That's a great question.
• 11:11
  SPEAKER_00: So um we don't actually do the remediation, we simply inform a remediation process.
• 11:17
  SPEAKER_00: So uh a graph uh QL API from both the ingest and the uh XFIL have taken our data and put it into uh uh incident response workflow, for example.
• 11:27
  SPEAKER_00: So you think a JIRA or service now that kind of manages the um change management and remediation efforts?
• 11:33
  SPEAKER_00: Uh we're simply providing data to those workflows.
• 11:36
  SPEAKER_00: Okay.
• 11:37
  SPEAKER_02: Um you said something before about awareness, you know, using the partners for awareness.
• 11:42
  SPEAKER_02: Where is the market right now on awareness?
• 11:45
  SPEAKER_02: Are you doing a lot of evangelizing?
• 11:47
  SPEAKER_00: Yeah, well, I mean, um, so Andrew, I've been kind of focused on this problem for a fair number of years since 2018.
• 11:53
  SPEAKER_00: And uh in the early days, we were doing a lot of uh evangelizing and you know, events like this, uh, where we were trying to get uh the urgency risen, right?
• 12:03
  SPEAKER_00: So we're still doing a fair amount of awareness and kind of evangelizing.
• 12:07
  SPEAKER_00: Uh, however, it's significantly different than it was in 2018.
• 12:11
  SPEAKER_00: You know, the regulations that are driving the requirements.
• 12:14
  SPEAKER_00: So I would say we're still um trying to build a brand, a net rise brand uh to the partner ecosystem in the broader community.
• 12:21
  SPEAKER_00: So our evangelizing is less about the problem, but more about the partners that we want to uh sign on and bring along on the journey.
• 12:29
  SPEAKER_02: Are there any examples of good awareness things you've done or you've heard about happen with Tom that uh go, oh yeah, we need more of that sort of thing?
• 12:38
  SPEAKER_00: Yeah, so events like this, right?
• 12:40
  SPEAKER_00: So kind of one-to-many opportunities is where we spend a fair amount of time.
• 12:43
  SPEAKER_00: And Tom's done a great job of kind of building the brand and building the community.
• 12:48
  SPEAKER_00: Uh, I would say we need to do more of this.
• 12:50
  SPEAKER_00: Uh uh, we did a live cast on LinkedIn Live earlier today from the RSA show floor.
• 12:55
  SPEAKER_00: Um, so the more we can get uh kind of awareness and the kind of one-to-many evangelizing opportunities, that's where we'll spend a fair amount of time.
• 13:03
  SPEAKER_02: Now you're heading up uh BD and partners.
• 13:06
  SPEAKER_02: What about the rest of the this the go to market sales team?
• 13:09
  SPEAKER_02: Wait, what does that team look like?
• 13:11
  SPEAKER_02: Types of roles that you have?
• 13:12
  SPEAKER_00: Yeah, I mean we have um, you know, kind of direct sellers, folks that are kind of this uh indirect team that I mentioned.
• 13:18
  SPEAKER_00: We also have kind of the inbound uh motions that we're fielding kind of inbound and requests.
• 13:24
  SPEAKER_00: So typically they're kind of the same team.
• 13:26
  SPEAKER_00: They're just different hats that uh uh different members of the team play.
• 13:29
  SPEAKER_00: And the kind of partner uh focus is really kind of you know, kind of my charter of how do I build relationships with uh partners that have uh kind of an understanding of our solution and how we can solve their customers' problems.
• 13:42
  SPEAKER_02: Aaron Powell Is the direct selling team are they you call them specialists in this area, or they're just good salespeople who you've trained into working in the area?
• 13:50
  SPEAKER_00: Aaron Powell Our team, you know, that's part of the attraction for me, quite honestly, was the team our experts, right?
• 13:55
  SPEAKER_00: They kind of understand this problem area.
• 13:58
  SPEAKER_00: Uh we have a couple kind of key uh engineers from um this binary composition analysis uh uh background that uh it really makes them kind of experts in the field.
• 14:09
  SPEAKER_00: So you don't necessarily have to be an expert uh in the uh subject to be able to sell this and represent it, but uh our team is very much knowledgeable and I would consider them experts.
• 14:19
  SPEAKER_02: Change of pace.
• 14:20
  SPEAKER_02: Um AI and sales.
• 14:23
  SPEAKER_02: Uh a lot of buzz right now, what it could do, what it doesn't do now, tomorrow, next week.
• 14:28
  SPEAKER_02: What are you most excited about where AI might help with your partners and BD efforts this year?
• 14:33
  SPEAKER_00: I think uh for me personally, uh I'm still a little skeptical on AI, right?
• 14:37
  SPEAKER_00: I'm not writing my proposals with AI and uh generating all my LinkedIn posts and stuff.
• 14:42
  SPEAKER_00: I see really the value for me with uh artificial intelligence is really how do I automate some of my outbound work that I'm doing.
• 14:51
  SPEAKER_00: So I do a fair amount of uh automating my LinkedIn outreaches using AI that's helped me really scale my effort, right?
• 14:59
  SPEAKER_00: And to touch more partners and uh people in the community.
• 15:02
  SPEAKER_02: Seems like that that's a natural place for many to start, right?
• 15:04
  SPEAKER_00: It's safe, right?
• 15:06
  SPEAKER_00: Um and it's a little bit easier to audit than it would be just uh having uh uh you know Gemini write my proposals that hallucinates 30% of the time.
• 15:15
  SPEAKER_00: Or hallucinates a 30% discount.
• 15:17
  SPEAKER_02: That too.
• 15:18
  SPEAKER_02: Yeah, sorry, Tom.
• 15:19
  SPEAKER_02: It's a smaller deal size.
• 15:20
  SPEAKER_02: Uh it was AI that dropped our price for us.
• 15:23
  SPEAKER_02: Um, I think there's a lot of opportunity there, right, to to really change how we go to market with uh some of the new tools right there.
• 15:30
  SPEAKER_02: Well, Robbie, great to have you on the podcast.
• 15:32
  SPEAKER_02: Really appreciate you joining and a busy week for you all.
• 15:34
  SPEAKER_00: Well, thank you very much, Andrew, for the opportunity and uh and look forward to doing this again, maybe.
• 15:41
  SPEAKER_02: Here we are again for visionary or smoking crack.
• 15:44
  SPEAKER_02: Why don't you introduce yourself?
• 15:45
  SPEAKER_02: Uh you got Jake Alasco, Valence Security uh Global Channels.
• 15:49
  SPEAKER_02: Jake, I'm gonna throw out some bold predictions at you right now about sales and cybersecurity sales.
• 15:56
  SPEAKER_02: You tell me, am I a deep thinking, insightful visionary?
• 16:00
  SPEAKER_02: Or did I inhale a little bit deeply walking through the tenderloin this morning on the way to this meeting?
• 16:05
  SPEAKER_02: You ready to go?
• 16:06
  SPEAKER_02: I'm ready.
• 16:07
  SPEAKER_02: First one by 2030, so just in five years' time, 80% of cybersecurity purchases under 100K will happen without a human seller or a human buyer, just AI agents doing their thing.
• 16:21
  SPEAKER_02: Is that visionary or is it smoking correct?
• 16:24
  SPEAKER_02: Scarily, it could be visionary.
• 16:26
  SPEAKER_02: Ooh.
• 16:26
  SPEAKER_02: What gives you hope that it might be?
• 16:28
  SPEAKER_02: Or what gives you fear that it might be?
• 16:30
  SPEAKER_01: I think uh hope that it won't be is uh job security.
• 16:34
  SPEAKER_01: Um but I think you know, just with all of the stuff that's kind of like coming up on the AI side, there's a really real, you know, between marketplaces, AI, and coming together, there's a real, there's a real chance that happens.
• 16:47
  SPEAKER_02: All right.
• 16:48
  SPEAKER_02: Number two, in five years' time, more CISOs will report to the CFO than those that report to the CIO or CEO.
• 16:57
  SPEAKER_02: And sales will be a finance first, security second uh motion.
• 17:02
  SPEAKER_02: Is that visionary or is it smoking correp?
• 17:05
  SPEAKER_01: Whew, hard hitters, Andrew.
• 17:07
  SPEAKER_01: Uh that could be a little visionary too.
• 17:09
  SPEAKER_01: I think we are seeing a trend of some of that uh security organization going into the finance org.
• 17:15
  SPEAKER_01: And we've certainly seen in some larger uh prospects and customers.
• 17:19
  SPEAKER_01: So I think probably go again visionary.
• 17:21
  SPEAKER_01: More visionary than smoking correct, but maybe a little bit unsure.
• 17:24
  SPEAKER_01: But could be a bit a mix of both.
• 17:27
  SPEAKER_02: All right, third one.
• 17:28
  SPEAKER_02: In 10 years' time, both the RSA conference and black hat will be dead, completely gone.
• 17:35
  SPEAKER_01: Is that visionary or smoking crack?
• 17:37
  SPEAKER_01: Smoking crack.
• 17:38
  SPEAKER_01: I think they're they're here to stay.
• 17:40
  SPEAKER_01: Why'd you say that?
• 17:41
  SPEAKER_01: You know, there's 50,000 plus people at these events, right?
• 17:44
  SPEAKER_01: Uh, I think it's such an important part of the industry and how we do things.
• 17:49
  SPEAKER_01: Uh, I wouldn't I would never want to see it go away.
• 17:51
  SPEAKER_01: So maybe it's wishfully, wishfully smoke and crack.
• 17:55
  SPEAKER_01: All right.
• 17:55
  SPEAKER_02: Uh recently Google announced they were acquiring Wiz, and some people in the industry called it G Wiz.
• 18:03
  SPEAKER_02: So, prediction for you.
• 18:05
  SPEAKER_02: Within 12 months, the OT security company called Insane Cyber will buy another OT security company that's called Sanctuary, and the combined company name will be changed to Insane Asylum.
• 18:18
  SPEAKER_02: Is that visionary or smoking crack?
• 18:20
  SPEAKER_02: It's visionary.
• 18:21
  SPEAKER_02: Just do it.
• 18:22
  SPEAKER_02: Just do it.
• 18:23
  SPEAKER_02: It makes so much sense.
• 18:24
  SPEAKER_02: It's fantastic.
• 18:25
  SPEAKER_02: All right, well, Jake, thanks for joining us.
• 18:27
  SPEAKER_02: Thanks for having me.