Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Why This CISO Buys From Cyber Startups First - Zach Lewis, CISO @ University of Health Sciences and Pharmacy

Transcript

Why This CISO Buys From Cyber Startups First - Zach Lewis, CISO @ University of Health Sciences and Pharmacy · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

0:32
SPEAKER_02: There are some buyers and some assessors out there that will take an unproven product from a startup and use it to protect their company in their security stack.
0:43
SPEAKER_02: And there's some that will even commit to doing a multi-year deal with companies with just a few employees and a little bit of funding.
0:51
SPEAKER_02: The trouble on the go-to-market side is we don't get to see exactly how that call gets made.
0:56
SPEAKER_02: You know, sometimes we get the answer, yeah, we'll take a look at your stuff.
1:00
SPEAKER_02: And sometimes even they might buy things as well.
1:03
SPEAKER_02: More often, though, we get silence.
1:05
SPEAKER_02: We get silence from our outreach and we never really hear what goes on behind the scenes.
1:10
SPEAKER_02: Zach Lewis has made that call many times.
1:14
SPEAKER_02: He's a CIO and the CISO at a university in St.
1:17
SPEAKER_02: Louis here in the US.
1:18
SPEAKER_02: He was the first customer at a DLP startup.
1:21
SPEAKER_02: He was inside the first 10 customers for a DSPN company.
1:25
SPEAKER_02: He was very early on an email product that disrupted the legacy players out there.
1:30
SPEAKER_02: And he was within the first few customers of an enterprise browser company.
1:34
SPEAKER_02: And by the way, in the episode, he names not only the companies, but exactly how he got involved with them and what he did.
1:40
SPEAKER_02: Three more things to watch out for in this episode.
1:43
SPEAKER_02: What Zach needs to hear and see from a startup for him to want to work with them early on.
1:50
SPEAKER_02: You know, Zach gets 10 to 20 LinkedIn pitches a day.
1:54
SPEAKER_02: And in seven years, he thinks he might have replied to as many as three of them.
1:58
SPEAKER_02: So he also talks about how to get in front of innovative systems like him.
2:03
SPEAKER_02: And he talks about what he has to switch off inside his own environment before he can say yes to you as a startup.
2:11
SPEAKER_02: Here's Zach.
2:21
SPEAKER_01: Well, Zach, welcome to the podcast.
2:23
SPEAKER_00: Andrew, thanks for having me.
2:24
SPEAKER_01: I'm happy to be here.
2:25
SPEAKER_01: This is a little bit different than my my normal uh podcast appearance.
2:29
SPEAKER_01: I'm glad we can dive into some some go-to-market stuff.
2:32
SPEAKER_02: Well, yeah, it's different for me too.
2:33
SPEAKER_02: This is the first time we've had a real live CEIO Anastiso on the call.
2:40
SPEAKER_02: So I'm exploring Ugram myself.
2:43
SPEAKER_02: Totally different conversation than usual.
2:45
SPEAKER_02: So this should be really interesting.
2:47
SPEAKER_02: Yeah, let's we'll try to keep it so.
2:49
SPEAKER_02: Let's dive in.
2:50
SPEAKER_02: Yeah.
2:50
SPEAKER_02: For start with challenges, gotta be interesting, right?
2:53
SPEAKER_02: First of all, though, the first thing we have to do is you have to spin the wheel.
2:57
SPEAKER_02: And to remind everyone, there's five categories.
3:00
SPEAKER_02: We got overrated or underrated, we got the cyber donut hot seat.
3:04
SPEAKER_02: The third one is it's personal, another one called visionary or smoking crack.
3:09
SPEAKER_02: And the final one is differentiation teardown.
3:13
SPEAKER_02: And we're gonna spin the wheel and just and I'll find out what questions I'll ask you at the end of the podcast.
3:18
SPEAKER_02: You ready to go?
3:19
SPEAKER_01: Do it.
3:25
SPEAKER_02: We are on visionary or smoking crack.
3:28
SPEAKER_02: One of my favorite ones.
3:29
SPEAKER_02: I first did this a black hat, uh no, uh RSA a couple of years ago, and got some interesting, interesting responses from people around this.
3:36
SPEAKER_02: So looking forward to that.
3:37
SPEAKER_02: But we'll do that towards the end, Zach.
3:38
SPEAKER_02: We won't do that right now.
3:39
SPEAKER_01: Okay, awesome.
3:41
SPEAKER_02: All right.
3:41
SPEAKER_02: So what I noticed about your background is just over a year ago, you started working with Glealot Venture Partners as a venture advisor.
3:50
SPEAKER_02: How did you get into that world?
3:52
SPEAKER_02: How did that how was that something that you wanted to do?
3:54
SPEAKER_01: Yeah, so the this uh so I'm in St.
3:56
SPEAKER_01: Louis and the cybersecurity community here is like really tight.
3:59
SPEAKER_01: And we almost go by, we could kind of call ourselves a cyber mafia, the St.
4:03
SPEAKER_01: Louis Cyber Mafia.
4:04
SPEAKER_01: And we're we're known all over the country for being really active in in startups and the VC stuff.
4:10
SPEAKER_01: So there's a a lot of my peers are very plugged into the VC network.
4:14
SPEAKER_01: And I mean, they know every startup coming out.
4:16
SPEAKER_01: They know, you know, if you're looking for a solution, they they they know a company either in stealth or just coming out of stealth that can kind of you know fix that that that problem for you.
4:25
SPEAKER_01: So I started meeting them, I got introduced to more companies.
4:28
SPEAKER_01: Eventually I started doing some design partnership with with a company in Stealth.
4:33
SPEAKER_01: Um, and then one of their VCs ended up being Gilot, and they they brought brought me in and been sort of advising in a limited capacity when I have time for them.
4:43
SPEAKER_01: But then with the VC, I was doing some design or with the uh startup I was doing some design partnership with.
4:48
SPEAKER_01: And and since then we've brought them on as the as a customer.
4:51
SPEAKER_01: We were their first customer, and uh they they came out of stealth, and we've been very happy.
4:55
SPEAKER_02: What's most of the work you do when you're advising?
4:57
SPEAKER_02: Is it advising on to the the CIO, the CEO and the CTO or some other part of it?
5:02
SPEAKER_01: Yeah, um, there's a there's a lot of different tiers.
5:04
SPEAKER_01: So for a lot of us, I mean advisors, we just come on, we get on calls, you know, a couple times a month and look at various stealth companies, various startups that uh they're getting ready to come out of stealth to see if is something they want to invest in, a product we might be interested in.
5:19
SPEAKER_01: Do we think the the product they're building is is sort of worth it, useful?
5:24
SPEAKER_01: And we might give rankings or or feedback to them on what's good.
5:28
SPEAKER_01: And then also if we think it it's worth investing in or worth providing something.
5:31
SPEAKER_01: Now there's another tier where they may need some cybersecurity expertise, some some IT expertise, and and one of the advisors may go on to become sort of like a virtual CISO or interim CISO or something.
5:43
SPEAKER_01: And a few people have gone on to become full-time CISOs there as well.
5:47
SPEAKER_01: So it really depends on on the need and and your availability and time and what you put into it.
5:52
SPEAKER_02: Are there any companies you could say I I was asked about and they've come out of stealth and they're now doing well?
5:57
SPEAKER_01: So uh the probably the most recent one was called Jazz DLP.
6:02
SPEAKER_01: I did some design partnership with them and and picked them up as a customer, and then they went on went on to win the RSA sandbox, startup sandbox, is the big winner of the year for the this year, and uh they're starting to pop up all over the place.
6:15
SPEAKER_01: So I've been pretty happy with them.
6:16
SPEAKER_01: They got a great product.
6:17
SPEAKER_02: Yeah, it was interesting.
6:18
SPEAKER_02: I I saw something today.
6:20
SPEAKER_02: Mike, who sends out the the venture or the industry investment newsletter every Monday, he did an analysis of all the start the sandbox winners.
6:31
SPEAKER_02: Well, all the ones are finalists and then who the winners were and saw what happened to them.
6:34
SPEAKER_02: And it's remarkable the success that the the finalists actually have over the years.
6:39
SPEAKER_01: Yeah, it it's pretty cool.
6:40
SPEAKER_01: I I know we've picked up, I mean, we've picked up so many startups at at the university where I'm at, but um a couple of those went on to become unicorns.
6:49
SPEAKER_01: And I was actually talking to one uh that we haven't we haven't picked up yet, but we we were in talks just last night, who was the first company in stealth to become a unicorn.
6:58
SPEAKER_01: And I was like, oh man, this like the market's filled with filled with money and filled with companies.
7:04
SPEAKER_01: So you got to try to find a good one.
7:05
SPEAKER_01: And that this is you know, eventually you go to like I was in Black Hat recently, and you know, there's hundreds of of these companies, and they all, you know, a lot of them sell the same thing, and you just think like, man, six months, this whole this whole group's gonna collapse down, and like one company will have like three or four of these, and it'll all be so you got to kind of pick the right one that you think is gonna stand the test of time.
7:23
SPEAKER_02: Yeah, that must be so hard to do.
7:25
SPEAKER_02: Yeah, it's Mike Pervet, who has the newsletter return on security.
7:28
SPEAKER_02: It's it's awesome.
7:29
SPEAKER_02: He's done, he's I don't know, he's up to episode or edition number 257 or something by now.
7:35
SPEAKER_02: So it's really impressive what he's built right there.
7:37
SPEAKER_02: Let's let's go back to you know, when you're talking to the startup for the first time, I'm really interested.
7:42
SPEAKER_02: You know, you they they come on, they they must tell you what they do.
7:46
SPEAKER_02: What tells you?
7:47
SPEAKER_02: What what are you looking for in the first half hour to try and figure out is this a company that I might actually want to, you know, work with, do some business with, might actually want to use their tool if it comes through?
7:57
SPEAKER_01: Yeah, so I I get approached a couple different ways.
8:00
SPEAKER_01: It can be it can be through the VC advisory stuff.
8:02
SPEAKER_01: It can also be just like cold call type type things that happen.
8:06
SPEAKER_01: I get a lot of outreach on LinkedIn and and and emails.
8:10
SPEAKER_01: I'm shocked, Zach.
8:11
SPEAKER_01: I'm totally shocked.
8:12
SPEAKER_01: I can't believe it.
8:13
SPEAKER_01: Nonstop, nonstop.
8:15
SPEAKER_01: And I think what I mean, what I'm looking for is is a problem.
8:18
SPEAKER_01: I got if I have a problem, I need it solved.
8:20
SPEAKER_01: And and frankly, not every not every startup obviously is going to be able to solve a problem that I have.
8:25
SPEAKER_01: They might solve someone else's problem, but it might not stick for me.
8:28
SPEAKER_01: So I have, you know, in my head or at any given time a few pain points.
8:32
SPEAKER_01: And if someone does the right sort of pitch or or fits into uh the right niche that I need something fixed in, you know, I'll I'll explore that conversation.
8:40
SPEAKER_01: We'll dive a little deeper and we'll see where things go.
8:42
SPEAKER_01: But you know, I'm not looking for, you know, I hey, I have this problem.
8:46
SPEAKER_01: Well, we can fix this part of it, or we can fix this section of it, or this tangent.
8:50
SPEAKER_01: No, I need the whole sort of thing fixed.
8:52
SPEAKER_01: So that's when I'll go and really dive in with some of them and see.
8:55
SPEAKER_01: And that's what's nice about startups too, is that they'll kind of customize things for you if you're an early customer.
9:01
SPEAKER_01: They they'll build and you can get what you sort of want.
9:03
SPEAKER_01: But yeah, look really looking at fixing a whole problem that I have and not just little parts of it.
9:08
SPEAKER_02: And I would imagine though, you know, as startups come through, they they probably don't solve the whole problem out of the gate, right?
9:13
SPEAKER_02: It must be really hard for them to do that because they wouldn't even be developing a product for a year or two, right?
9:17
SPEAKER_02: So how do you assess, you know, they got the right vision, are they going on the right track?
9:21
SPEAKER_02: How do you look at that?
9:22
SPEAKER_01: Yeah, a lot of conversations.
9:24
SPEAKER_01: So when I do like design partnership work, I'll I'll work with a company, they'll give me their most uh minimum viable product, their MVP, and we'll kind of look at what it does.
9:33
SPEAKER_01: And then I'll say, well, you know, can we get can we get reporting?
9:36
SPEAKER_01: Can it can it do this to the endpoint, the computer?
9:39
SPEAKER_01: Can it do, can it send emails?
9:41
SPEAKER_01: Can it, and you know, we just kind of work through the different feature sets that I, you know, I know I would like to see from my standpoint, what my team would like to see.
9:48
SPEAKER_01: They start building those in, and then we can just keep expanding sort of that scope of that project till it really encompasses like a whole problem.
9:54
SPEAKER_01: And we might sit down and you know, when they just have a rough outline and a PowerPoint of what a product might be, and we'll dive into some problem areas that that they're trying to solve.
10:03
SPEAKER_01: And we'll say for for DLP, for instance, I remember whiteboarding with them and being like, well, we have data, and so for those listening DLP's data loss prevention, we have data, and you know, sometimes people might take it and put it in a Google Drive or a Dropbox or something that's not approved by our organization.
10:20
SPEAKER_01: I need to know when that happens.
10:21
SPEAKER_01: I need to be able to stop that.
10:22
SPEAKER_01: But I also might just want to nudge people like here are those are three use cases right there that we need to build into the platform.
10:29
SPEAKER_01: How are we gonna notify the IT team or the security team that this is happening?
10:33
SPEAKER_01: How do we nudge?
10:34
SPEAKER_01: What should it say?
10:35
SPEAKER_01: Should we customize that nudge?
10:37
SPEAKER_01: What are all the platforms that you need to know about?
10:39
SPEAKER_01: And how are we gonna tie that data back in?
10:41
SPEAKER_01: What do we want to see on the dashboard?
10:43
SPEAKER_01: How does it look like?
10:43
SPEAKER_01: Let's draw that out and just really conversation after conversation after conversation as we build out that that technology really.
10:50
SPEAKER_02: And are you looking or how much are you looking at the team and how they engage with you as well, beyond just the product?
10:58
SPEAKER_01: Yeah.
10:58
SPEAKER_01: So usually early on, this you know, these companies have three, four people.
11:03
SPEAKER_01: So you meet the team pretty quickly and the whole team comes on, right?
11:07
SPEAKER_01: Yeah, the whole team's there.
11:09
SPEAKER_01: CEO, CTO, you know, everyone has a teeth tied on their developing something, and then they start bringing in more people.
11:15
SPEAKER_01: So I I want to see growth over that time period.
11:17
SPEAKER_01: These conversations are happening over weeks to months.
11:20
SPEAKER_01: So we need to see that team growing.
11:22
SPEAKER_01: They they might not have any customers yet.
11:24
SPEAKER_01: You know, we're still in design, we're still in stealth, but we need to see that team scaling some, the product coming along pretty quickly.
11:30
SPEAKER_01: And then when it's ready to go to market, like, all right, how many customers did we grab?
11:35
SPEAKER_01: All right, we got one in the first week, and we're we're at 10 by week, you know, two, you know, whatever that might be.
11:40
SPEAKER_01: And and make sure the team's still scaling with that.
11:43
SPEAKER_01: They're still doing development work, they're they're coming up with some of their own ideas, and we're just sort of playtesting those out in the environment.
11:49
SPEAKER_01: But we want to see growth and we want them to see scaling pretty, pretty quickly.
11:53
SPEAKER_02: Are there companies that based on your feedback, you feel like they've gone a different direction or they've decided not to do what they were going to do?
12:00
SPEAKER_01: I don't none none jump out.
12:02
SPEAKER_01: I mean, they all most companies have an idea of what they they want to do.
12:05
SPEAKER_01: And I think that idea changes over time based on the feedback they're getting from different design partners and and cut customers that they're talking to.
12:13
SPEAKER_01: The market moves very quickly right now, especially with everything in AI.
12:18
SPEAKER_01: And you have to be very nimble, very agile, and and be able to change that perspective.
12:22
SPEAKER_01: Because if you're you're you know pushing a product that you know the market's not interested in anymore, you don't have CISOs that are interested in anymore, it's not gonna sell.
12:31
SPEAKER_01: Again, going back to solving that problem, and you want to find a problem that a lot of people have.
12:35
SPEAKER_01: If I have it, there's probably others that have it, and and we need to sort of gauge how big of an issue that is.
12:41
SPEAKER_01: So right now we're seeing a lot of stuff, I mean, and a lot, a lot of stuff around AI and like shadow AI and people using it for everything.
12:49
SPEAKER_01: So, you know, you you kind of go and I think every almost every one out of probably two out of every three companies I see are doing something in that space to find your your shadow AI and put a stop to it because it is a problem for a lot of CISOs and a lot of organizations.
13:05
SPEAKER_01: So everyone's just running to that.
13:07
SPEAKER_02: Yeah, that must be challenging when everyone claims the same thing.
13:10
SPEAKER_02: We'll come back to that actually a little bit.
13:11
SPEAKER_02: So I'm actually kind of interested about the maybe not jazz itself, but but DLP, right?
13:16
SPEAKER_02: So when I think about DLP in this context, I would say two things I think about.
13:20
SPEAKER_02: One is a very old concept that people kind of got fed up with 10 years ago because it didn't work that well.
13:26
SPEAKER_02: It was pattern matching and not very accurate.
13:29
SPEAKER_02: And I don't know, there's a lot of black eyes, let's say, about people who tried to make DLP work.
13:33
SPEAKER_02: And then secondly, DLP, if you're actually doing the P and not just looking at the alerts, right, you can get in the way of business, right?
13:41
SPEAKER_02: You can stop things from happening.
13:42
SPEAKER_02: That's the whole idea of it.
13:44
SPEAKER_02: So, you know, accuracy and things like that become very important.
13:47
SPEAKER_02: So I'm trying to wonder, like, you know, your risk appetite, you're bringing them in and say, that's okay.
13:52
SPEAKER_02: We're gonna do that, even though it's a young company, it's okay for us to do that.
13:56
SPEAKER_02: I'm kind of fascinated by how you would decide that.
13:58
SPEAKER_01: Yeah, so I I historically, yes, legacy DLP and Jazz will be the first to tell you that it sucks.
14:03
SPEAKER_01: It always has sucked.
14:05
SPEAKER_01: And so the that they're doing things a little bit differently where there's a small agent it runs on a laptop, desktop, endpoint, whatever.
14:12
SPEAKER_01: And then um, it actually uses jazz uses AI to understand the context, the content, but also the intent of the user.
14:20
SPEAKER_01: Like, what are they trying to do?
14:21
SPEAKER_01: Is this malicious?
14:22
SPEAKER_01: Is this incompetence and an alert on it?
14:25
SPEAKER_01: And you can you can talk to the AI and you'd say, hey, I don't want to see, you know, we we might get alerts on people updating the resume.
14:31
SPEAKER_01: Well, hey, I don't I don't want to see that.
14:33
SPEAKER_01: That yeah, they might be job hunting, but I in security right now, I don't want to know that.
14:37
SPEAKER_01: So, hey, AI, don't don't show me any more alerts about people updating resumes and and we won't get any more.
14:43
SPEAKER_01: And that that turns out those alerts, or hey, I want to really pay attention to these few users.
14:48
SPEAKER_01: They're they're giving their notice and they deal with sensitive information.
14:51
SPEAKER_01: I want to make sure none of that leaves.
14:52
SPEAKER_01: So it'll give them a little bit more scrutiny or something like that.
14:55
SPEAKER_01: And we can do different sorts of scoping things by just talking to the AI and it goes out and provides that data back to us in in a real-time alert, which is pretty cool.
15:03
SPEAKER_01: I haven't seen anything like it.
15:05
SPEAKER_01: So that is really helping.
15:06
SPEAKER_01: And the prevention and then and then the prevention piece, well, since that agent is on the endpoint, if they go and say, Hey, I don't want anyone putting anything into Deep Seek, or I don't want you uploading any documents that have a restricted label on it to your personal Google Drive, that agent will stop hard stop that activity from happening.
15:26
SPEAKER_01: It will recognize what's going on, it can see the URLs, it can see the software in use, and it'll just hard stop it and pop up a message and say you're not allowed to do that.
15:33
SPEAKER_01: So it's it's been pretty successful for us.
15:36
SPEAKER_01: And and what I like about it is rolling it into an environment.
15:39
SPEAKER_01: And if people come back to you and you're like, hey, I can't do this, and it's like, well, well, yeah, well, what are you trying to do?
15:45
SPEAKER_01: There's a reason why that's blocked.
15:47
SPEAKER_01: So so far we haven't had any you know red flags where people have have pushed back too hard on being blocked on something and and not being able to do it.
15:54
SPEAKER_01: Either it happened and they're like, I shouldn't do that, and they they didn't want anyone else to know, so they kept quiet.
16:00
SPEAKER_01: We'll take it.
16:00
SPEAKER_02: Uh yeah.
16:01
SPEAKER_02: I mean, it sounds like they've really advanced the whole thinking around DLP over the years, which is which is awesome.
16:06
SPEAKER_02: I'm thinking, you know, there will be not just CISOs, but there will be organizations that don't have the appetite to work with early stage companies.
16:15
SPEAKER_02: It's just not something that they want to want to do.
16:18
SPEAKER_02: And if they do, maybe they might pick something except for DLP, something that's not a critical path, right?
16:23
SPEAKER_02: And say, let's test something there.
16:24
SPEAKER_02: So let's talk about that.
16:25
SPEAKER_02: So, you know, what is that about Zach Lewis that says, you know, I'm I'm I want to spend the time with these early stage companies.
16:31
SPEAKER_02: I'm willing to take on the risk that maybe some of them might not pan out or the their product might not work as well as it as it should, but you're willing to do that.
16:39
SPEAKER_01: Yeah, I I I think one of the first startup companies we brought on board was an email security startup.
16:46
SPEAKER_01: And and we were looking, there were there were a couple of players in the in the world at this point.
16:50
SPEAKER_01: I I call it advanced AI security, not not your traditional, we'll call them SEGs, so email gateways, like things like no no disrespect to any of these companies out here, but like your Barracudas, your Minecasts, your proof points.
17:03
SPEAKER_01: These are these are names, these are I'll call them legacy players.
17:06
SPEAKER_01: They've been around a long time.
17:07
SPEAKER_01: They're they're your traditional email security platforms.
17:10
SPEAKER_01: We were having some difficulty blocking different types of phishing emails.
17:13
SPEAKER_01: We're just getting a lot through, and we needed something that was advanced.
17:17
SPEAKER_01: And so there were a few big startups on on that had just come out making waves.
17:21
SPEAKER_01: We looked at those.
17:22
SPEAKER_01: It was cool.
17:23
SPEAKER_01: They were still they were startups, but they were like further along in their journey.
17:26
SPEAKER_01: So they were already pulling in quite a few customers and money.
17:29
SPEAKER_01: So the pricing was kind of going up.
17:30
SPEAKER_01: And I ended up running into a startup that did something very similar.
17:33
SPEAKER_01: They were very, very new out of stealth, and it also made their uh their platform was very, very cheap.
17:40
SPEAKER_01: Um, because they they were just trying to get customers.
17:42
SPEAKER_01: So we adopted, we were probably sub-10 customer for them.
17:45
SPEAKER_01: They they showed up proof of concept, which is is a great I do proof of concepts with all these.
17:50
SPEAKER_01: I do several proof of concepts with different startups, some really long, some short, depending on on what we're looking at.
17:56
SPEAKER_01: But we probably did one that lasted about a month.
17:58
SPEAKER_01: We virtually saw no phishing emails getting through.
18:01
SPEAKER_01: They threw out a great price point.
18:02
SPEAKER_01: So we adopted them and we ran with them for four years, and it was great.
18:07
SPEAKER_01: Best email security product I've ever seen.
18:09
SPEAKER_01: It was phenomenal.
18:10
SPEAKER_01: They actually just got bought by a much, much larger company.
18:12
SPEAKER_01: So we're gonna see how things shake out for them in the future now.
18:15
SPEAKER_01: But I mean, it it was phenomenal and we loved it.
18:18
SPEAKER_01: And so with the success of that one, we're like, all right, well, there's something there.
18:22
SPEAKER_01: Let's let's let's see what else is out there.
18:23
SPEAKER_01: What other needs do we have?
18:25
SPEAKER_01: So every time we go out and and try to find something that that fixes a problem for us, we we go to the startup community almost, I wouldn't say almost 100% exclusively, but but quite a quite a bit.
18:35
SPEAKER_01: So I mean, we picked up automated pen testing tools very early.
18:39
SPEAKER_01: We were sub-10 customer for TSPM called concentric AI.
18:44
SPEAKER_01: We were a very early customer of Island Enterprise Browser, just just loads of these startups that they come out and we're like, yes, this fixes a problem.
18:52
SPEAKER_01: Let's grab in and let's go.
18:54
SPEAKER_02: So the starting point for you is we do actually have a gap that we need to fill, right?
18:58
SPEAKER_02: And you like the idea that you can help them with the roadmap that's gonna help you with what you need, right?
19:05
SPEAKER_02: And also the price point, you mentioned that, you get a decent price, right?
19:08
SPEAKER_01: Yeah, I mean, education, we we don't have a ton of money, not a lot of budget.
19:12
SPEAKER_01: So if we can negotiate with a, you know, we we negotiate with a startup, we get a good price because they they're looking for customers.
19:18
SPEAKER_01: They need to show, you know, they can get customers and retain customers.
19:21
SPEAKER_01: If they have a good product, we've sussed it out over a POV, proof of concept, proof of value, and it's working really well.
19:27
SPEAKER_01: We'll we'll go in, we'll negotiate that price down to a good point since we're early.
19:30
SPEAKER_01: They want to give us a discount for being a good customer, and then we'll lock it in with a three year.
19:35
SPEAKER_01: I've I've done a five year on a couple startups just because we want to lock in that low pricing.
19:39
SPEAKER_01: We think we've got a good product, they're happy to have that long-term revenue that's gonna come in from us.
19:44
SPEAKER_01: So it's a it's a win-win for everybody.
19:47
SPEAKER_01: But yeah, and and that's I get great products that are gonna keep developing and get better.
19:52
SPEAKER_01: They're gonna serve me.
19:53
SPEAKER_01: I I can talk to them about issues I need, things I need fixed, and they'll build those features into it within a within a few weeks, typically.
19:59
SPEAKER_01: And then I my product just gets better and better over the years.
20:02
SPEAKER_02: And do you find yourself having to spend a lot more time though with these early stage companies?
20:06
SPEAKER_02: It's not like buying some software and then making it work and away you go, right?
20:10
SPEAKER_01: You know, thinking back to the email security one I touched, they they didn't have a ton of bells and whistles in the platform, and I didn't want a bunch of bells and whistles because I don't want to be in the these pieces of software all the time.
20:20
SPEAKER_01: So it was a very minimal product that worked.
20:24
SPEAKER_01: And I think the only time I ever got into that platform was when they reached out and wanted to have like a meeting to see how things were going, like once a quarter or something, and they'd be like, Oh yeah, let me log in there.
20:34
SPEAKER_01: I haven't been in there in three months.
20:36
SPEAKER_01: But it but it worked, and that's what that's what I'm looking for.
20:38
SPEAKER_01: So there's a couple products like our our DSPM concentric AI, that's data posture security management.
20:44
SPEAKER_01: So it's a way to sort of classify, categorize, label data, find where your data is, who's accessing it, what they're doing.
20:50
SPEAKER_01: We we do a lot of stuff around data at the university, and uh, I think that's a an important security pillar.
20:55
SPEAKER_01: So I throw a lot of budget towards it.
20:57
SPEAKER_01: But so with them, I meet with them every two weeks.
21:00
SPEAKER_01: And it's not so much that it's work, it's it's that they give me a partial employee, a partial FTE.
21:07
SPEAKER_01: So I meet with them and I say, hey, these are the things I'm trying to knock out in these next two weeks.
21:12
SPEAKER_01: I want to track all the data, you know, and marketing and HR, and I need to tag this and let's get rid of duplicates in this bucket.
21:19
SPEAKER_01: And they take notes, we work with me on a strategy, and then they go out and actually do the work.
21:23
SPEAKER_01: So my team doesn't have to.
21:25
SPEAKER_01: Um, and then in two weeks we meet back up and they're like, hey, we got this done, we got this done, we ran into this issue.
21:29
SPEAKER_01: Are you okay with it?
21:30
SPEAKER_01: I'm like, oh, okay.
21:31
SPEAKER_01: So we just meet like that regularly, but they're doing work for me.
21:34
SPEAKER_01: It's like having a remote team member, and I'm fine with that.
21:36
SPEAKER_01: That's awesome.
21:37
SPEAKER_01: We we can get in there and do stuff if we want, but that's that's one that's a little bit more touch and go.
21:42
SPEAKER_01: You know, Island was a lot of setup up front.
21:45
SPEAKER_01: We we were spent a lot of time in the platform at the beginning, just building out our our dashboards and our user interfaces and what people were going to see from the enterprise browser.
21:53
SPEAKER_01: We wanted that that transition since since that one touched a lot more end users.
21:58
SPEAKER_01: We needed to spend more time with it, make sure the end user understood, provided more training material, made it a really sort of seamless process because we were changing a lot of people's workflows.
22:08
SPEAKER_01: But now that it's in place, we hardly ever go into it because it's it's all customized, set up, and it and it's just running.
22:14
SPEAKER_01: So it depends.
22:15
SPEAKER_01: You know, automated pen testing tool.
22:17
SPEAKER_01: I I run pen tests every week.
22:19
SPEAKER_01: They're set on a schedule, but we still go in and we look at them.
22:21
SPEAKER_01: What are the results?
22:22
SPEAKER_01: What happened?
22:23
SPEAKER_01: Do we need to fix anything?
22:24
SPEAKER_01: So it depends on the platform that you bring in and and how much touch you have to do with them.
22:28
SPEAKER_02: So it sounds like you're gonna benefit out of doing it.
22:30
SPEAKER_02: I'm wondering though.
22:32
SPEAKER_02: Do you get pushback from other parts of the organization saying, do we really have to work with a startup to do this?
22:38
SPEAKER_02: You know, is this company gonna be around in six months or a year?
22:41
SPEAKER_01: Not not really.
22:42
SPEAKER_01: I I you know, at the beginning at the beginning of the first email security platform we brought in, I don't think anyone even really knew they were a startup, nor did they care.
22:50
SPEAKER_01: I I think this was pretty new for the rest of the organization.
22:53
SPEAKER_01: It's not something they they thought about, you know, like IT is just bringing solutions and and from a startup standpoint, a lot of security tools, the end user is not gonna even know really what we're what we're bringing in.
23:03
SPEAKER_01: I know our CFO and our COO and people I work with on acquisition stuff was either very interested in a good price.
23:10
SPEAKER_01: So if I can get them a good price and I tell them it's gonna work, they're kind of okay with that.
23:14
SPEAKER_01: Yeah, I've not had any real pushback from startups and the fact that they're startups.
23:19
SPEAKER_01: I I can't think of any where I've run into any problem.
23:22
SPEAKER_02: You mentioned AI security before.
23:24
SPEAKER_02: I know like every company does AI security right now, apparently.
23:27
SPEAKER_02: But I'm more I'm curious how your team, well, let me phrase it like this, right?
23:32
SPEAKER_02: There aren't incumbents, there aren't the the big companies already doing it and some companies coming in innovating a slightly different way, right?
23:38
SPEAKER_02: Everyone's neat to this right now.
23:40
SPEAKER_02: So how does your team evaluate, just give us an idea about how you look at it and go, okay, well, what do we do?
23:46
SPEAKER_02: We can go 25 different directions trying to do AI security, big topic, right?
23:51
SPEAKER_02: How do I how do you guys assess?
23:52
SPEAKER_02: Well, where do we start?
23:53
SPEAKER_02: How do we think about it?
23:54
SPEAKER_02: Where do we think the biggest threat is?
23:56
SPEAKER_02: What can you share with us around that?
23:57
SPEAKER_01: So we we tried to evaluate what our our end users are actually doing and like how AI savvy they are.
24:04
SPEAKER_01: What are they trying to do with AI really?
24:06
SPEAKER_01: So what what problem are we trying to solve for?
24:09
SPEAKER_01: Do we actually have a shadow AI problem?
24:12
SPEAKER_01: And if we do, is it is it a real problem?
24:15
SPEAKER_01: Are are people just using it to to chat with and get feedback?
24:19
SPEAKER_01: Are students, you know, putting questions in there and getting answers back?
24:21
SPEAKER_01: Are are we putting sensitive data in there?
24:24
SPEAKER_01: Okay, let's run through a couple of these.
24:26
SPEAKER_01: Do we have controls in place for some of these problems already?
24:29
SPEAKER_01: When we look at the data piece, you know, we license, we, we, we categorize all of our data.
24:34
SPEAKER_01: So it all has a label on it.
24:36
SPEAKER_01: Um, those labels have different restrictions, and we use our DSPM and our DLP tool in conjunction to sort of put controls around that.
24:44
SPEAKER_01: So I can use JAS in this instance to say, hey, I don't want anything that's labeled confidential to go into any AIs, whether it's Chat GBT or Deep Seek or Copilot or whatever, and we can put blocks on that so it doesn't go, okay, that kind of fixes that problem.
24:59
SPEAKER_01: Do we care about students uploading answers or questions?
25:03
SPEAKER_01: I mean, do I sort of?
25:06
SPEAKER_01: I mean, faculty probably care more, but also maybe don't leave your your exams out for people to get the the answers to.
25:12
SPEAKER_01: So I don't know if that's the problem we're that the security team is here to fix.
25:16
SPEAKER_01: So I'm gonna mark that one off.
25:17
SPEAKER_01: You know, ancillary use, okay.
25:19
SPEAKER_01: And we just kind of work through a bunch of different problem sets to figure out what the real issue is and if we need a fix for that.
25:25
SPEAKER_01: If if there are issues in there, do we have the tools in place that can do it?
25:29
SPEAKER_01: Do we just need to add a couple different controls?
25:31
SPEAKER_01: Can the enterprise browser help?
25:32
SPEAKER_01: Can the DLP help in conjunction?
25:35
SPEAKER_01: Do we get where we need to go?
25:36
SPEAKER_01: Or is there just a gap there that we need to bring in another tool for?
25:39
SPEAKER_01: And that's kind of how we assess things with AI security.
25:42
SPEAKER_01: And and we haven't had to bring in anything other than we're, I mean, we're running everything through island and and and jazz and then labeling stuff with concentric AI.
25:50
SPEAKER_01: We feel like we have a pretty good platform in place to keep any sort of weird shadow AI uh miscreant work from happening.
25:57
SPEAKER_02: But your default is definitely what do we have that's gonna plug these gaps right now that we don't have to, you know, go and do something vastly different for, right?
26:05
SPEAKER_01: Yeah, we we don't want tool sprawl or tool fatigue.
26:07
SPEAKER_01: You know, I don't have a huge team.
26:09
SPEAKER_01: We have a fair amount of tools, but I I think in security, we're we're right, right sized.
26:14
SPEAKER_01: And you know, if I got to bring on another one, that's that's another dashboard someone has to look at, that's another alert someone has to go into, another configuration.
26:21
SPEAKER_01: So is it really needed?
26:23
SPEAKER_01: If it's truly needed, okay, we will do it.
26:25
SPEAKER_01: But you know, bringing on another tool pulls pulls work away from other stuff because it's another touch point we got to look at it.
26:30
SPEAKER_01: It's another amount of work for someone else.
26:32
SPEAKER_01: So we we're pretty specific when we have to bring something on board.
26:35
SPEAKER_02: Okay.
26:35
SPEAKER_02: If there's probably going to be early stage founders or go-to-market leaders listening to this, what would you say the way to approach someone like you is as a design partner or finding design partners?
26:48
SPEAKER_02: And what's some things that you just you you don't like seeing or you just wish they wish they wouldn't do?
26:52
SPEAKER_01: Stop messaging me on LinkedIn.
26:54
SPEAKER_01: Is that right?
26:55
SPEAKER_01: You're killing LinkedIn.
26:56
SPEAKER_01: That and AI slop has made LinkedIn and unbearable.
27:01
SPEAKER_01: I, you know, I don't think I'm trying to think through.
27:04
SPEAKER_01: I think out of all the cold calls, cold emails, cold messaging, I have maybe responded to two or three in seven years, probably.
27:16
SPEAKER_01: And that's because the pitch really did fit a fairy niche thing I was looking for at that exact moment, and it just lined up.
27:24
SPEAKER_01: So that's not a very high percentage of likelihood when you when you consider I probably get, I know this is not a joke.
27:30
SPEAKER_01: I probably get anywhere from 10 to 20 LinkedIn messages a day, connections or direct messages with someone, you know, telling me about their product.
27:39
SPEAKER_01: Not a joke, not an exaggeration.
27:41
SPEAKER_01: And I picked, you know, I I've responded to three, and I think those that three resulted in one.
27:46
SPEAKER_01: I think I purchased one if you go all the way down.
27:48
SPEAKER_01: I didn't end up purchasing the other two.
27:50
SPEAKER_01: The the place I found the most stuff, surprisingly, is either like startup showcases, VC showcases, or or conferences.
27:59
SPEAKER_01: I I go to a lot of events, I talk to, I talk to every vendor that I can.
28:04
SPEAKER_01: I can't do it at Black Hat, but but local conferences, especially.
28:08
SPEAKER_01: I mean, I was at one yesterday and I think they had 12, 12 vendors, 12 sponsors.
28:13
SPEAKER_01: I talked to every single one of them because I want to know what they got going on.
28:16
SPEAKER_01: It might be a product I already know.
28:17
SPEAKER_01: They might have some new stuff.
28:19
SPEAKER_01: I'll go talk to them.
28:20
SPEAKER_01: I definitely swing by any booth I don't recognize the name of.
28:23
SPEAKER_01: I just want to hear, and that gives me a good idea of where the market is, what problems people are facing.
28:27
SPEAKER_01: I I don't have a need for most of them at the time, but but I'll know if if that changes.
28:32
SPEAKER_01: You know, we CISOs, we change jobs frequently.
28:34
SPEAKER_01: It's about 18 to 24 months, so you never know where you're gonna enter a new new company and you have a new problem, right?
28:39
SPEAKER_01: You might bring in some of your your previous stuff, but you might have new issues, new new industries, and it got to solve new new problems.
28:47
SPEAKER_01: So I like to know everything.
28:48
SPEAKER_01: I know not all not all CISOs will go through at a at a conference and talk to everybody, but that that's kind of what I do.
28:53
SPEAKER_01: But the VC showcases, we do a thing here.
28:56
SPEAKER_01: So this again, CISO community is very tight.
28:58
SPEAKER_01: One of our big companies in St.
29:00
SPEAKER_01: Louis is like Centen, and we'll do a big startup showcase there, maybe once every six months or something, and we'll block out a whole day.
29:08
SPEAKER_01: We'll bring in four, five, six different startups, and they can come in and they can pitch to us a bunch, a room full of CISOs, what their product's doing, you know, what their customer base is, what they're looking to do, what their interest is, blah, blah, blah, blah, blah.
29:20
SPEAKER_01: We'll ask them questions.
29:21
SPEAKER_01: If they have a proof of concept, we'll see it.
29:24
SPEAKER_01: We can poke holes at it and see what's going on.
29:26
SPEAKER_01: They can go back out and then refine their products.
29:28
SPEAKER_01: So we find a lot of cool stuff there.
29:30
SPEAKER_01: That's that, and and just talking to our CISO community, you know, I mentioned this chat, I have a signal chat, and I'll go in there and be like, hey, you know, we need this issue, we have this issue.
29:39
SPEAKER_01: You guys doing anything about it?
29:40
SPEAKER_01: Or someone will be like, Have you heard of this this company?
29:43
SPEAKER_01: Do you know how to get in touch with them?
29:44
SPEAKER_01: And we just share that information back and forth.
29:46
SPEAKER_01: That's really how we do it.
29:47
SPEAKER_01: We'd go to a lot of dinners.
29:49
SPEAKER_01: Well, startups will come in and host a dinner, and we'll get 10, 15, 20 CISOs there and give us a brief pitch, and then we just, you know, eat some steak or something.
29:57
SPEAKER_01: You know, I'm not I'm not trying to say that we just you have to give us something to get a meeting, but I mean, we're inundated with with calls and messaging and stuff.
30:05
SPEAKER_01: So if you can get into one of these little groups and and pitch to us or talk to us with some of our peers, we're a lot more receptive at that point, I would say.
30:14
SPEAKER_02: No, I like that a lot.
30:15
SPEAKER_02: I mean, I I think we we hear on on the go to market side about these single chats and Slack channels that uh we don't get access to, which is great, right?
30:24
SPEAKER_02: You need to have that safe zone you you can you can chat to.
30:27
SPEAKER_02: But it's not all black and white, right?
30:29
SPEAKER_02: There's ways to to try and get invited to things and try to get your name out there and things like that, right?
30:34
SPEAKER_01: Oh yeah.
30:34
SPEAKER_01: If you if you guys if you know a CISO or have had good relations with the CISO, just reaching out to them and be like, hey, can you help us get together a dinner or a group of CISOs for an event?
30:44
SPEAKER_01: Or, you know, we've done some some startups have done some pretty cool stuff in the area for us and either going out and whether it's not food or maybe it's uh a movie screening or it's a a shoot skeet, you know, with the shotguns or something like we've done some pretty cool like off-the-wall stuff.
31:01
SPEAKER_01: There's also some different like companies you can partner with, organizations, I Saka, IC Square, Infraguard, different groups there.
31:08
SPEAKER_01: If you know someone there coming in and asking to do a pitch to them, um you can get in front of some some people, some decision makers there as well.
31:16
SPEAKER_01: I'd say that not as successful as some of the other stuff, but that is a different way, a little off-the-beaten path where you're just not cold messaging people.
31:23
SPEAKER_01: Yeah, I don't know.
31:24
SPEAKER_01: That's that was what that's what comes to mind.
31:26
SPEAKER_02: Yeah, yeah.
31:27
SPEAKER_02: No, I appreciate that.
31:28
SPEAKER_02: One of the things that I hear in the go-to-market side a lot is, you know, we we're working with a company, we're in a sales cycle with them.
31:36
SPEAKER_02: I just know there's a whole bunch of things going on behind the scenes that I just don't know what it is.
31:41
SPEAKER_02: There's conversations, there's, I don't know, what's the secret handshakes you all have behind the scenes?
31:45
SPEAKER_02: So I don't know if you give us a flavor of what we just don't see.
31:48
SPEAKER_02: Like, I don't know, the discussions, the conflicts, the different viewpoints, let's say.
31:53
SPEAKER_02: How does all how does all that happen?
31:55
SPEAKER_01: Yeah, I mean, I'll speak from my experience, and it's obviously different for other play places, but like, so if we we have a need and we let we've gone through everything, we've we've figured out which which product we want, like we want to move forward.
32:09
SPEAKER_01: A few things come into play.
32:11
SPEAKER_01: Where are we at in the budget cycle?
32:12
SPEAKER_01: Education, we have a like a July 1 through June 30 sort of cycle.
32:16
SPEAKER_01: We do zero cost budgeting in internally, so we kind of start with what our number is, and we have all of our software pieces, we know what they're gonna cost.
32:24
SPEAKER_01: And by the end of that budget, we we want to be back at you know, essentially zero flat.
32:28
SPEAKER_01: And uh so if you guys come on board, you know, I search around for a product, we find it, and we're in March or April.
32:35
SPEAKER_01: I probably don't have a lot of budget right now.
32:38
SPEAKER_01: Like we're nearing that end of the cycle.
32:39
SPEAKER_01: I just don't have any money, and it's probably gonna have to wait.
32:42
SPEAKER_01: Now, I've worked out deals with different different groups where we started early, like, hey, we're gonna give you a couple months free, we're not gonna bill you till July or something.
32:50
SPEAKER_01: Like you can finagle, and that's something also nice about startups.
32:53
SPEAKER_01: You can finangle different deals like net 90 terms or or uh three extra months free or or something like that and just work it to get to that budget cycle.
33:03
SPEAKER_01: I also try to align almost all of my spend to my budget cycle.
33:06
SPEAKER_01: I want almost every contract I have to start on July 1 and end on June 30 for a year.
33:11
SPEAKER_01: My CFO loves me for it.
33:13
SPEAKER_01: And if I can give her that, she's actually super happy about that.
33:15
SPEAKER_01: So we try to keep the CFO happy.
33:18
SPEAKER_01: That's got to go on.
33:19
SPEAKER_01: Anytime I'm gonna purchase something, I usually talk to this the COO about it.
33:22
SPEAKER_01: Him and I work very closely on stuff.
33:24
SPEAKER_01: I report into him.
33:25
SPEAKER_01: So I'll be like, hey, we're looking at doing this, he's gonna solve this problem.
33:28
SPEAKER_01: It's probably a problem he's aware about already.
33:30
SPEAKER_01: I'll tell him why, I'll tell him the price point.
33:33
SPEAKER_01: We have a pretty good idea of what we want to do.
33:35
SPEAKER_01: A lot of the times, if I'm bringing on something, I have to sunset something.
33:38
SPEAKER_01: Um, that's how I get budget.
33:39
SPEAKER_01: I don't get just every ass that I go in for, right?
33:42
SPEAKER_01: But if I can shift some numbers around and sunset a different product or squeeze a little savings out of here, I can usually make it work.
33:49
SPEAKER_01: But again, it all depends on that budget cycle and where we are in it.
33:52
SPEAKER_01: And that can be a sticking point early on.
33:54
SPEAKER_01: I might be able to allocate a little bit more, but yeah, late in the cycle, we're just waiting.
33:58
SPEAKER_01: Legal reviews, contracts, so it'll go through general counsel, he'll do his review, I'll do my review.
34:03
SPEAKER_01: We'll go back and forth on that some of the time.
34:06
SPEAKER_01: But I mean, outside of that, you know, if I can get the COO on board and then we go in and pitch to the CFO and she's on board.
34:13
SPEAKER_01: And if it's a net neutral ask for the budget where I'm just decommissioning something and bringing something on, usually no issue with that.
34:21
SPEAKER_01: It's it's some of those net you ask, or if I need an extra five or 10 grand or something like that, like, hey, I gotta go to this is what we're fixing for.
34:29
SPEAKER_01: Here's our return.
34:29
SPEAKER_01: This is what's gonna look like.
34:31
SPEAKER_01: I got you that aligned up to the fiscal year, you know, and whatever else I need to do.
34:35
SPEAKER_01: We got a great deal because we did a multi-year, they're not gonna raise rates.
34:39
SPEAKER_01: I usually I can get that pitch done.
34:41
SPEAKER_01: So um, and once I get the green light from her, it it's it's solid from there.
34:44
SPEAKER_01: But that's how most of our process works.
34:46
SPEAKER_02: And with your CEO and your CFO, do you feel like you're gonna align the justification to purchase to something the the university cares about?
34:54
SPEAKER_02: Like is some big strategy thing, or is it that they just kind of get that these are gonna be security things that you have to do to mitigate risk?
35:01
SPEAKER_01: I usually align it to strategy of the university.
35:04
SPEAKER_02: Okay.
35:04
SPEAKER_01: You know, something we're we're planning on doing.
35:06
SPEAKER_01: I I think if I just come in with an ask for an ask, it's like, oh, okay, I I guess, you know, like they they don't understand the the value of it.
35:13
SPEAKER_01: And I I like I want to make sure it's tied to something at the university.
35:17
SPEAKER_01: Security, you know, has to, for the most part, needs to be frictionless.
35:21
SPEAKER_01: I know that's not always possible, but we want something that we're gonna be able to plug into the university.
35:25
SPEAKER_01: It's not gonna interfere with how business runs, it's not gonna interfere with how we make money, which is essentially educating the students.
35:32
SPEAKER_01: So if I can tie it to that where people aren't gonna see anything, but maybe we can get more students or will they be more secure, or data's not gonna leak out or or whatever, then then all the better.
35:42
SPEAKER_01: And I'm saying also for fortunately, this is a weird fortunately, but you know, a few years back we had a uh a ransomware attack, and I I I've spoken a lot about this and and actually written a book on it.
35:53
SPEAKER_01: But I I I I use that as a as a point of reference for a lot of these talks around security tools and things, and not so much as like a fear, uncertainty, doubt sort of pitch, but like, hey, you know, like that ransomware attack happened, and we we bought these products afterward, and that fixed this problem, this problem.
36:10
SPEAKER_01: But if we had had this, this wouldn't happen.
36:12
SPEAKER_01: Well, you know how much that would have cost, okay.
36:14
SPEAKER_01: Well, if we do this, we can actually decrease that cost by this, and that ransomware can't get in, or you know, whatever it is, and just try to really pitch it in terms of a scenario, a story of why we're doing it, why it works for the strategy of the university, and and how much our our return is gonna be.
36:28
SPEAKER_01: Because it's hard to say like security is going to ever make the university money or or make an organization money, but we're more of a revenue protector than a generator.
36:37
SPEAKER_01: So how are we how are we ensuring that that revenue is still gonna come in and not go out the door?
36:41
SPEAKER_02: Yeah, that ransomware thing is fascinating.
36:43
SPEAKER_02: I mean, every salesperson's been around for a while has the story of the company that underinvested in security and can never make any progress.
36:51
SPEAKER_02: And suddenly something happens, the budget goes wide open, and they they make sometimes they make rapid and rash decisions about what they really need to do to recover, right?
36:59
SPEAKER_02: It seems like it goes from one extreme to the other.
37:02
SPEAKER_02: It must be frustrated on your side.
37:03
SPEAKER_02: Maybe I don't know if you experience it where you are right now, but try to, well, how can I, how can we get some more investment?
37:08
SPEAKER_02: Because I know this could happen, right?
37:10
SPEAKER_02: And then suddenly it happens.
37:12
SPEAKER_01: Yeah, I I mean for us at the beginning, it was we thought we had a pretty good program, and then and then we got hit, and we were able to expand the budget and get a couple other tools.
37:22
SPEAKER_01: And I I call those tools prior to the incident, they were like nice to have.
37:26
SPEAKER_01: So we just didn't have the money for it sitting around.
37:29
SPEAKER_01: But again, never let a good crisis go to waste.
37:32
SPEAKER_01: It happens, they free up a little bit more funds.
37:34
SPEAKER_01: You know, the the board doesn't want something like this to happen again.
37:36
SPEAKER_01: You don't want to be in the news, you don't want to, you know, we got lucky in our situation and and didn't have to like pay a ransom or we didn't lose a lot of sensitive stuff.
37:44
SPEAKER_01: That could be very different the next time.
37:45
SPEAKER_01: So, how do we make sure it happens?
37:47
SPEAKER_01: And these companies sometimes go in, they go a little too hard and they buy way too many things.
37:51
SPEAKER_01: Again, you get tool fatigue, you get tool sprawl.
37:54
SPEAKER_01: And I think you need to be very precise.
37:56
SPEAKER_01: Like, what again, what problem are we solving for?
37:59
SPEAKER_01: Let's bring it in.
38:00
SPEAKER_01: Do we have the bandwidth for it?
38:01
SPEAKER_01: If it doesn't make sense if you get 5,000 alerts a day and the team can only read 500, there's 4,500 out there that you're missing, and no one's ever gonna look at, so it's irrelevant, right?
38:10
SPEAKER_01: Like that tool's not serving a great purpose.
38:12
SPEAKER_01: So be very specific, almost like a scalpel with that on what you're bringing in and and just make sure that the attack doesn't happen from the same entry point again after you've asked for for tools.
38:23
SPEAKER_01: You don't want to get hit the same way because that's not gonna look good.
38:25
SPEAKER_01: That's not good.
38:26
SPEAKER_01: No, tell us about your book.
38:27
SPEAKER_01: Uh, the book.
38:28
SPEAKER_01: So the book is called Locked Up.
38:30
SPEAKER_01: It is a real story, true story of a ransomware attack from a group Lockbit, which was the most prolific ransomware attackers, threat actors of the 2022, 2023 era.
38:41
SPEAKER_01: In in 2024, they were taken down by the FBI.
38:45
SPEAKER_01: A couple of their members were indicted, a couple were arrested, but essentially they were they operate out of uh Russia.
38:51
SPEAKER_01: They were a nasty group that had a compromised Boeing and TSMC and the Ministry of Defense and all sorts of big companies.
38:58
SPEAKER_01: So you're in great company.
38:59
SPEAKER_01: Yeah, we didn't stand much of a chance, but it just shows like it doesn't matter really how big you are or what your budget is, like you you can still get hit by these, you know, this group or any of the groups, frankly.
39:09
SPEAKER_01: And so we got hit, and the story locked up is all about everything that about our environment beforehand, where we built, where we were at, why we were at that stage.
39:18
SPEAKER_01: Then we get hit, and I talk about everything that goes into the decision making, the recovery, why we decided to do what we did, and and conversations that happened around it, to everything that happened after the incident, what sort of software we brought in, why we brought it in, how our users handled it, and just the emotional toll, the mental toll, everything that goes into some sort of cyber incident.
39:37
SPEAKER_01: There is nothing else like it on the market.
39:39
SPEAKER_02: It was I was pitched that to No, I've never heard anything like this.
39:43
SPEAKER_01: Yeah, I pitched it to Wiley.
39:44
SPEAKER_01: Wiley loved it, they published it, they agreed nothing like it on the market, and the book sort of has gotten legs.
39:50
SPEAKER_01: It came out in January, it's sort of taken off, and uh a lot of people are reading it and really enjoying it.
39:55
SPEAKER_01: So that's great.
39:55
SPEAKER_01: I'm very happy for them.
39:56
SPEAKER_01: I hope it helps the industry.
39:57
SPEAKER_01: There's this weird stigma about talking about your your cyber incidents and when you have attacks, people don't like to do it.
40:03
SPEAKER_01: It's sort of this like Marcus Shane thing.
40:05
SPEAKER_01: So trying to normalize it a little bit more, educate people on what it's like to live through one of these ransomware attacks and how to get through it, and and hopefully help the industry as a whole get better.
40:14
SPEAKER_02: Is it written for go-to-market people as well as technical people?
40:18
SPEAKER_01: It is.
40:18
SPEAKER_01: It is not a technical read.
40:20
SPEAKER_01: It is a narrative read.
40:21
SPEAKER_01: You're gonna read it with you know characters of myself and my team and the university talking through stuff in conversation that you know, talking about these decisions that are going on, very, very high level in terms of technical detail.
40:34
SPEAKER_01: We explain anything that's a technical term.
40:36
SPEAKER_01: I have people, my my mom who read it, understood it.
40:39
SPEAKER_01: So I think everyone's in in good good hands.
40:42
SPEAKER_02: That's the ultimate test right there.
40:43
SPEAKER_01: That's right.
40:44
SPEAKER_02: Well, Zach, let's go back to the spin the wheel and see what gets thrown up with these questions right here.
40:50
SPEAKER_02: So we span the wheel, we got visionary or smoking crack.
40:53
SPEAKER_02: Let's look at the questions.
40:55
SPEAKER_02: All right.
40:55
SPEAKER_02: First one is by 2030, 80% of BTP purchases under 100K will happen without a human seller or buyer.
41:06
SPEAKER_02: It'll be AI agents buying and AI agents selling.
41:10
SPEAKER_02: Am I visionary by saying that or am I smoking crack?
41:14
SPEAKER_01: Man, that's a great question.
41:17
SPEAKER_01: Ooh, I think you would be a super visionary if you're really predicting that's gonna happen.
41:21
SPEAKER_02: That's a plain way of saying I'm smoking crack.
41:24
SPEAKER_01: Yeah, I don't think I don't think it's gonna happen, but that is that's a nice visionary perspective on it.
41:28
SPEAKER_01: I don't think we're gonna be quite there yet, but but definitely move in that direction.
41:32
SPEAKER_02: Let me ask you about this though.
41:33
SPEAKER_02: So people in our world always talk about will salespeople get replaced by AI, right?
41:39
SPEAKER_02: My thought is that a lot depends on the buyer side, what you're willing to accept, right?
41:43
SPEAKER_02: And you know, would you make a 50k purchase, would you make a 100k purchase, would you make a 2K purchase with an AI bot?
41:50
SPEAKER_02: Like where's where's the where's the where's the line right now?
41:53
SPEAKER_01: I think the letting uh letting an AI buy something, I I think that line's very, very low right now.
41:58
SPEAKER_01: I and I think that's that's part of the problem with all AI initiatives right now.
42:02
SPEAKER_01: If you you look at the stats, most of them are failing in in businesses.
42:05
SPEAKER_01: And I think it's um I liken it back to even automation, like IT people and and security people, we love automation and we'll set up all the automation, but we just never turn it on.
42:14
SPEAKER_01: It's like it's all there, but we never just finally pull that final switch and let it run a lot of the time because it's a that's a trust factor.
42:21
SPEAKER_01: We're just not trusting yet of the technology.
42:25
SPEAKER_01: People are very comfortable in their workflows and their their day-to-day lives.
42:28
SPEAKER_01: It's almost like an identity for them and how they do stuff.
42:31
SPEAKER_01: And when you want to take that away and change it and give it to something else that it, you know, does it, even if you're not gonna lose your job, like people still just get uncomfortable.
42:39
SPEAKER_01: You're shaking up their routine.
42:40
SPEAKER_01: And and I think that's why a lot of these initiatives are failing.
42:43
SPEAKER_01: So I think we're gonna have to get there.
42:45
SPEAKER_01: I think the big companies will adopt.
42:47
SPEAKER_01: Um, and as they adopt, there there'll be that trickle down where then the the large companies and the mediums and the smalls will eventually have to just to keep up with AI because AI is gonna be everywhere, whether you want it to or not.
42:58
SPEAKER_01: There doesn't seem like there's anything to do about it.
43:00
SPEAKER_01: So adopt when you can, but I I don't think you're gonna see any big purchases being made.
43:04
SPEAKER_01: Uh, at least not I can tell you from the university standpoint, they wouldn't be comfortable with a a bot making a hundred dollar hundred thousand dollar purchase.
43:11
SPEAKER_02: So yeah, I I almost feel like you never underestimate a human being's ability to try and stick with they've been doing for a while, right?
43:19
SPEAKER_02: Yeah.
43:19
SPEAKER_02: You know, it it and especially if there's big outcomes, big impacts if you get it wrong.
43:23
SPEAKER_02: Like I'd be very worried if uh I was on your shoes.
43:26
SPEAKER_02: All right, let's go to the next one.
43:28
SPEAKER_02: The most successful cybersecurity salespeople in the next five years won't be salespeople, they'll be former security practitioners who also know the business of cyber really well.
43:38
SPEAKER_02: Am I visionary or am I spoken crack?
43:41
SPEAKER_01: Visionary.
43:42
SPEAKER_02: Tell me more.
43:43
SPEAKER_01: I think I'll so this goes back to a problem in the industry.
43:46
SPEAKER_01: I think there's a lot of burnout in the industry, and we're seeing a lot of CISOs move from the C a true CISO role into more like a field CISO role.
43:55
SPEAKER_01: And they they seem to be pretty happy there.
43:58
SPEAKER_01: They still get to talk security and they get to pitch a product, usually one that they either were a purchaser of or or they're familiar with, and they're they're getting in there and they're gonna need to sell that to the masses, and they're they're finding out, hey, this isn't this isn't so bad.
44:12
SPEAKER_01: So I think as if burnout continues the way it is, CISOs are gonna get tired and and they get more stuff piled on them, especially with AI happening.
44:21
SPEAKER_01: Maybe they maybe they get outed by AI too, and they need another gig.
44:24
SPEAKER_01: So real CITO, sell CISO, there it is.
44:28
SPEAKER_02: That's good, just could be a salesperson, a lot easier than the real job, right?
44:32
SPEAKER_02: Yeah.
44:33
SPEAKER_02: I do, I mean, I I know it's always easy looking at a job going, oh you know, it's always easier looking at it than actually doing the job, but it feels like to me, that's a great gig, right?
44:42
SPEAKER_02: You've you've kind of you've earned your scars and black eyes and stripes for 20 years, and now you get the chance to, you know, go do something that's actually probably a lot of fun without all the downside that perhaps you have in as a as a CISO.
44:55
SPEAKER_01: Yeah, especially if you've worked your network too.
44:57
SPEAKER_01: If you know a lot of people and you were out there, you know, doing conferences, meeting people, and it like you're you're gonna have an easy gig.
45:04
SPEAKER_01: Like the more people you know, like, yeah, go out there, introduce them to a product and do some sales, man.
45:09
SPEAKER_01: Yeah, you're gonna crush it.
45:10
SPEAKER_02: All right.
45:10
SPEAKER_02: Last one, third question.
45:12
SPEAKER_02: By 2030, only 10% leads will come from traditional marketing.
45:18
SPEAKER_02: So I'm interested in your thoughts on this from your side.
45:21
SPEAKER_01: Again, probably visionary on this.
45:23
SPEAKER_01: It's probably true.
45:24
SPEAKER_01: I I mean, a lot of stuff is I mean, we see websites even changing right now for bot traffic, like just so AI and and bots and agents can read it.
45:32
SPEAKER_01: Yeah, I mean, I think that's all gonna change.
45:34
SPEAKER_01: The way we gather information on on customers is gonna change and how we how we pitch to them will change.
45:40
SPEAKER_01: I mean, definitely after they they watch this episode, they're gonna be like, yeah, change the whole thing.
45:45
SPEAKER_01: So we're gonna make this a reality, I think.
45:47
SPEAKER_02: Well, I feel like there's there's something there, right?
45:49
SPEAKER_02: You mentioned before, right?
45:50
SPEAKER_02: You're just getting bombarded with uh let's call it traditional ways, right?
45:54
SPEAKER_02: And you know, as long as there's finite resources on the vendor side, you can't just keep doing that and try to scale something to actually work set in terms of numbers.
46:03
SPEAKER_01: Yeah, you know, there's uh there's a saying where like threat actors will will text you and they text you a number and they're like, hey, buddy, like how's it going?
46:11
SPEAKER_01: Or you want to have the call with me, or can you send me a gift card?
46:14
SPEAKER_01: And and you get these things and you're like, there's no way this works.
46:17
SPEAKER_01: But at the end of the day, they keep doing it because it does work and it's working somewhere.
46:21
SPEAKER_01: So I don't know, maybe this this cold outreach is working somewhere and that's why it keeps happening, but it's not it's not working here, so let's change it.
46:27
SPEAKER_02: There's always that one person somewhere that picks up the phone and something it works, cold calling works.
46:32
SPEAKER_02: Yes, we got them.
46:33
SPEAKER_02: Well, listen, Zach, it's been uh it's been a lot of fun having you on.
46:36
SPEAKER_02: I really appreciate you joining us.
46:37
SPEAKER_00: No, thanks, Andrew.
46:38
SPEAKER_00: This was great.
46:38
SPEAKER_00: I I love the change of pace for once.
46:40
SPEAKER_00: It was a good time.
46:40
SPEAKER_00: Thank you.
46:41
SPEAKER_02: If someone wants to get hold of you, they don't message you on LinkedIn, right?
46:45
SPEAKER_01: If if you don't want to sell to me, you can reach me on LinkedIn.
46:48
SPEAKER_01: If you do want to sell to me, um I don't don't Yeah, be be creative, let's say.
46:54
SPEAKER_00: Be creative.
46:55
SPEAKER_00: Be at a conference, we'll do it there.
46:57
SPEAKER_00: And and the books available in all the user places.
47:04
SPEAKER_00: Awesome.
47:05
SPEAKER_00: Well Zach, uh thanks for joining us.
47:07
SPEAKER_00: Cool.
47:07
SPEAKER_00: Thanks everybody.