Latest / Noise2Signal / EP 8. The Buyer's Seat w/ Aysha Khan. Inside the Mind of CISOs Buying in AI Era

Transcript

EP 8. The Buyer's Seat w/ Aysha Khan. Inside the Mind of CISOs Buying in AI Era · Noise2Signal

• Speaker 2: I hear you're allergic to a lot of things. What are you allergic to? Speaker 1: Actually I'm allergic to one thing and that is BS. I often say I describe myself in six words, which is living intentionally, passionately, fearlessly every day. Speaker 2: One of the finest pieces of work is the buyer setup. Speaker 1: was this out of frustration for me. How much time, energy, money personally I was wasting, my team was wasting. We don't have a buying problem, we have a delivery problem. Buyer series was my effort to bring buyers and sellers together to say enough is enough. Speaker 2: What breaks actually work in terms of getting a CISO's attention? What's the weirdest thing that you've seen come show up on your desk? Speaker 1: There was one example where somebody actually sent me a trophy after I was nominated for Global CISO, like what else works? Sharp, shot, crisp email with clear messaging. Speaker 2: Why do vendors ⁓ lose DLC renewals? Speaker 1: They think giving a seventy seven percent discount is the value. Even if I paid twenty five thousand dollars, I got zero value. Speaker 2: You know when a vendor decides to buy something, how long before the process has started, before the vendor is brought in? How do you evaluate our Speaker 1: The ROI you reporting is not the ROI that I disclose to my board and my sier. Speaker 2: How do you assess if this product is successful? Speaker 1: Why I say login frequency is not adoption. Feature clicks are not adoption. Training completion is not adoption. Speaker 2: So do leaders at your level actually use the tools? Speaker 1: I have a favorite saying authority is not the truth, truth is the authority. Speaker 2: The journey of buying product is completely changing in the age of AI. I can now go in myself instead of going to an SME. Speaker 1: I don't care if Anthropic is solving that problem or the current vendor in my ecosystem is solving that problem. You put an agent on top of your racket and you're like, okay, now we are AI native. You're not AI native. You are AI ready. How the conversation changes is now instead of just simply build versus buy, I look at it as build with AI, replace with AI. Speaker 2: think the dashboards would be relevant in the age of AI. What's the next big book that you're writing? Speaker 1: Ladies and gentlemen, please welcome Aisha Khan, CIO and CISO at Treasure Data. Speaker 2: Okay, we are recording. Aisha, I hear you're allergic to a lot of things. What are you allergic to? Speaker 1: A lot of things. Actually I'm allergic to one thing and that one thing is BS. Speaker 2: This is good. This this this is going to be one of the epic explosive interviews. Aisha, it's such a it's such a such an honor to have you on Noise to Signal interview series. You've been in the technology executive for over twenty-five years. ⁓ most recently as the CISO and CIO at ⁓ Treasure Data. And the thing that comes to mind is when I when I when I read your writing, it feels like you write like a monk. But then you are an operator, ⁓ like you you work as a system. And my sense is this has been a long journey for you to get to the point where you are. The way that you see yourself, the way you frame yourself, the way you ex express yourself. My question is, how did this process start about twenty-five year years ago? And what has been going on in that process? Speaker 1: Yeah. ⁓ so many things come to my mind. The process has been quite simple in my mind, but I've come to that clarity pretty recently, I would say in the last seven, eight years. ⁓ I've always been the misfit. When you speak about the misfit, meaning I ask a lot of questions. Even when I was a kid, I used to ask questions to my parents, to my teachers, and often I didn't get the answers that would satisfy that. Curiosity. ⁓ so over the years what I've realized that I care about clarity a lot and of work, non work, that clarity leads to asking the right question, which is often the why behind the why. Speaker 2: So So in that context, you're kind of in a wrong business because there is just too much noise in your industry. Getting clarity in your line of business, being a CIO, being a CISO, ⁓ is a difficult job because there you probably get pitched hundreds of times by vendors, ⁓ in terms of selling their products. In the years ⁓ in these twenty five years, how has the industry changed from your perspective? Or maybe it has not changed at all? Speaker 1: Actually, let me ⁓ answer two things here. Number one, I feel like and I think I I told you reached out to my own subsex a long time back. You're like, tell me if you are a monk, you are a operator, or you're a therapist. And I said, maybe I can be off, right? Why pick one when I can be off? Coming back to the point, I was talking to another ⁓ CISO friend of mine recently, and I he was telling me the same thing. You happen to be the spiritual CISO. And here's how I see it. I don't think I'm in the wrong industry. I feel like I am put in the right industry for the right reason. Here's why. There's so much noise to what you said. And exactly to reduce that noise to signal, which happened to be your podcast name, which I love. I think that's why I'm here. but the journey has been. First, I need to get clear with myself. Who am I? Why am I? What is the bigger purpose? ⁓ I often say I describe myself in sixth word, which is living intentionally, passionately, fearlessly every day. And that clarity has given me a backbone to say meho that I am I'm not as curious to speak the truth. And my goal for the rest of my life is bring clarity to everything that I do. And while look at the question that you're asking, what has changed in 25 years? What hasn't changed in 25 years? It's the same nonsense that we deal with. Look, we all operators are not operators for the namesake. We have a real job to do. We are sitting with real budgets, real problem statements. ⁓ I think when you were ⁓ demoing your product, what did I tell you? I said in 2010, I used to run SAS, DAST, OS scanning in 2025, the exact same process. Look, what are we doing? And when I ask my team these questions, they are also like lack of solutioning out there. Everyone is trying to sell single point solution. So we have real problems to solve. Founders are also passionate about solving what they want to be solving, but I think there's a lot of noise and distraction and lack of clarity. So my goal is to just help people get clear with what matters and just build in that I hope. Speaker 2: the I thought the tagline of a spiritual CISO is a very appropriate ⁓ tagline. It's a very appropriate tagline for you. My question is ⁓ was this was this a recent development? Because you did not show up on my radar until a few months ago and you started your Substack channel, ⁓ inward to outward, and the writing was very clear, very precise. You use fewer words to express profound points of view. ⁓ My my question is like why w what was the reason behind starting the Substack, the inward to outward channel and then expressing your point of view? Because I don't think you were very public before. Or maybe you are, maybe you just didn't show up on the radar. But that's the Substack ⁓ the Substack channel was the was the was the point where I started to read more about how you're thinking about the process. Speaker 1: Yeah. I would say ⁓ as I said it's a process. Process has been I was first busy with my own experimentation for the last ⁓ fifteen, sixteen years or so, and then after that the last ten years have been more, I'm going more inward. So my journey, what I write on Substack, it's not random stuff, it's been my own journey seeing how I became clear and how it helped me become the leader that I have become. So now what I want to do is offer that clarity to the rest of the world. why I write, I see the suffering of the world, and the suffering of the world I often say it is self-inflicted suffering. People comparing themselves and they're building for the sake of building, founders having no clarity why they are solving the problems that they are solving. And I feel like it's a gift that I can offer and share my perspective on how to get clear with yourself. I often say my home. ⁓ we need to learn to lead ourselves first. Our leadership journey is directly proportional to our inner work. The more we are clear, the more we are intentional, the more we understand our own triggers, that's how we show up in the world. ⁓ so that's what I've been doing. But the main thing is when I started reading, I what I noticed that thought leadership was polished for the most part, but empty. The truth was missing. So that was the trigger for me. ⁓ number one, write something that is useful and true. And number two, help people understand that no matter what they are looking outside will not happen. You know, like people talking about impact and titles and recognition. Those are the wrong questions to ask. Rather than saying what is next, ask what is true. And then from that truth, you figure out. How can I create the impact playing to my strength? And that's what I enjoy. Speaker 2: Do you write with the mindset that the wisdom that you impart outlives you? Is that part of your thinking where your whatever you write, whatever you share, outlives you? Is that a core thinking behind what you're doing? Speaker 1: I'll answer it this way. I am not like thinking I wanna be remembered or people, you know, like put me on pedestal, none of that. I see myself as someone who has sort of decoded the code how to live joyfully and with clarity. And I want to impart that wisdom on others so that everyone has the opportunity to live the same way. ⁓ and if my frameworks wisdom can help people, that's the goal and Whatever I share, I wanna make sure that even when I'm not here on this planet, that information, wisdom serves others. Speaker 2: Awesome. Awesome. Aisha, one of your one of your finest pieces of work is the buyer seed, apart from your spiritual writings that you write on SubStamp. One of your ⁓ and that is that is in some ways one is it was an inspiration for Noise to Sign Signal, the interview series, because this is truly the signal that founders and sellers need ⁓ in terms of how are buyers like you thinking about buying software because we are most In most cases we are mindlessly selling without understanding how the buyers are buying, right? Speaker 1: Think of the Speaker 2: And ⁓ I wanted to dive deeper into the buyer C. You ro you started this series, I believe ⁓ end of last year or early this year. And you're your and you've made it the like a weekly post. It was a weekly post. You would did I think ten of them. You did ten of them. And I thought each one of was each one of them was a banger. Like each one of them was like, Whoa, who is this person? And then I dive deeper into it. Well, this is this is obviously a CISO who has been through a lot. So I want to dive deeper into the the journey to write the buyer's three. What was you what were you thinking when you were writing the buyer's three? Speaker 1: Thank you for asking me that question. I think that's where the gist of ⁓ what we need to talk about. Number one, ⁓ there are two things will come to my mind, but number one was this out of frustration for me. How much time, energy, money personally I was wasting, my team was wasting their network that I know was wasting in finding the right solution. ⁓ and then seeing how we always talk about, you know, like in our industry, it's sort of like badge of honor, we are burned out. And I don't take that as a badge of honor. ⁓ somebody asked me recently and they said, ⁓ do you do you get stressed out being a season? I'm like, what is stress? I don't I don't ⁓ invite any stress in my life. And the reason being because I going back to the point I made, clarity. With that clarity, I write, I lead. I create my strategy, and then the goal is if I have clear problem statements that I understand what I need to be solving. And mayhold at any given point I'm sitting with budget as well. I have the money and I have the problem statements. What I need are the solutions. And same problem over and over again. We bring vendors, the demo goes great, sales gets closed, and then CSM gets involved. ⁓ And then professional services get involved, few things I will unpack as well. But the handoff is broken. I often say, as part of my whole buyer's says, if I pick one line, it is we don't have a buying problem, we have a delivery problem. And that's the truth that is not getting fixed. So imagine this business BDRs get involved, then account executive get involved and Speaker 2: Post sales. Post sales gets involved. Speaker 1: Engineers and then CSM and then professional services, now the favorite word, FDEs, or rated, hype word. Don't even get me started on that. The point I'm making is from my point of view, I've already talked to five people in that one cycle explaining five times what the hell Yes, what the hell I want to solve. That doesn't get solved. ⁓ but there there's a lot of other nonsense. They're gonna talk about everything else and then they will try to offsell and then they will talk about this. Just help me build what I hired you to build. Speaker 2: Mm. Deliver the outcome. Then I deliver the outcome I'm looking for. Speaker 1: I I kid you not, we will talk about it. I get emails like, we did this, we did this, we did this. Yes, I see a list of things that you have done, but what is the value you created for me? And nobody understands that. So that was frustration was number one. Number two was, ⁓ as I said, I often see if I see a problem that I need to participate in that problem by bringing a solution to surface. And buyer series was my effort to bring buyers and sellers together to say enough is enough. I don't have time to waste and you should either. So the goal was to really show you guys behind the scene how we think buyers, ⁓ where the sellers are making assumptions. How are they not seeing ⁓ value being created? What ROI actually means. ⁓ I have so many examples, we'll talk about it, but the whole goal was solve the dime problem. Bring the community together, build a playbook that actually works and save a lot of time for you guys to build what matters and for us to solve the problems that we care about. Speaker 2: Super interesting. Aisha, one of the most difficult things for founders and sellers is to find a buyer who has a budget, who's who has the problems, and who's willing to buy. One of the most difficult things to do. And founders do all kinds of crazy things to get the attention of the CISA. I've done a few crazy things in my life as ⁓ as a founder. I'm curious, you know, given the hundreds of pictures that you get. ⁓ how one for two parts a two part question. One is, what are some of the examples of people trying to get your attention? That is that is one. And then second is what tricks actually work in terms of getting a CISO's attention? Speaker 1: Yeah. Thank you for asking this interesting question. I'm giggling because there's so many funny examples that I wanna share here. Yes, I will try the name justice but the book will have more examples. but first I have a question for you. Guess how many or how often do I get surprised with goodies? Speaker 2: I would say least once a week. Because I I know I like personally know founders who have built companies around doing this contact management experience. And the whole point of this contact management experience is to like deliver flowers, deliver doormats. Like that's the that's the company they have built. So I know like this process deeply. And they have pitched me that hey, we can help deliver doormats. Speaker 1: Yeah, I'll give you I'll give you as much data on it as possible. So first of all to answer on the question that I was asking and you said I get goodies once a week. You have no idea, Mel, on an average weekly basis I'm talking about, I get surprised by at least ten to fifteen times. Speaker 2: And is this like a virtual thing or a physical thing? Speaker 1: All sorts of things. Okay. ⁓ before I give you examples, and here's what happens to me. ⁓ again with clarity, with respectful of people's time, being very appreciative of the gesture and want to show gratitude, but at the same time, the emotions that I go through, first that often shows up is obligated. The worst one. I feel like, ⁓ my god, now I'm obligated to do something. That's one. Number two, ⁓ the feeling I get is now I'm being pushed. Pushed like in some shape and form. There are multiple follow-ups. There was one example where somebody actually sent me a trophy after I was nominated for global CISO, like ⁓ CISO of the year twenty twenty-four, twenty twenty-five. And somebody actually ⁓ put an effort in building a trophy for me. That showed up on my desk and I'm like ⁓ my god, what do I do with this? And it didn't stop there. First there was a sweet note saying, ⁓ appreciate your bringing thought leadership to the world. Good, thank you. Then follow up. How did you like the dropping? I'm like, thankful and grateful. Then follow up. So how can we get on a call? I'm like, what did you sell? And the not only that I felt obligated push burdened, frustrated, all these emotions were there. But on top of it, I feel like now if you have got my attention, at least put in some effort. We we're gonna talk about effort as well. When I go see the demo, that demo had nothing to do with what I do in my work. So there is no relevancy. So why are you wasting your time, energy, effort in doing something that is not going to solve my problem and I'm not your buyer? So even such things happen. But what type of things come ⁓ show up on my desk? You mentioned doormats, donuts, cupcakes, candies, champagne, wine. Speaker 2: Do you like the do you like the donuts? I hope you'll like the cookies. Speaker 1: Well No, I I don't eat jump. Speaker 2: Maybe so the the the sellers who are selling sent healthy food too. So at least that get squared up. Keep going. Speaker 1: And not only that, then can't the list goes on. So those are the kind of things show up time to time and I said Speaker 2: What's the weirdest what's the weirdest thing that we've seen come show up on your desk? Speaker 1: Yeah it is. I saw I gave you this example trophy. I'm like I wasn't expecting what do I do with this trophy? Even the organization nominated me didn't give me a trophy. You know, so like where is this coming from? Speaker 2: I I read in one of your series you somebody sh ⁓ somebody shifted a sh ⁓ shipped a plant and it said something to the effect let us grow together or some some random sh shit that came up. So you know that that I've not seen, but I'm I was I I laughed when I read that. Speaker 1: Yeah, so for that one specifically, I think that was a beautiful gesture. I ⁓ I'm into sustainability, organic stuff, and I thought that plant was sitting on my desk for a long time. So I thought that was a good, beautiful thing. But do I need it? No. Was it effective to some extent? After that plant showed up, here is the tip for you. The person who sh shipped the plant didn't tell me anything about their company. So, like, what do I do with you? You know, like you got my attention. Now show me some work. And I do this hundred percent of the time. Good gesture, bad gesture. Cookies, donuts, all those things. I'm appreciative. I will put it in my kitchen and then people will eat it. But out of curiosity, I will still go on their website. And that's where the test starts. Twenty to thirty second test that what I say. In twenty to thirty seconds, I will go on your website. I will see your messaging. I will see which category you are in. And if it's not clear, full of love, it feels like you solved the whole world and you're not. Speaker 2: Yeah, you solve world hunger. Yeah, then you're right. Then you're if you're solving world hunger you're out. Speaker 1: Then you have lost me. So to answer your question, the second part, you said what works? What always works? Warm introductions. Full stop. That is my number one ⁓ advice for all the founders. Warm introductions. I will also tell you in our in our industry there's a still a lot of conflict of interest now. Conflict of interest in a sense that ⁓ How do I say it? Operators becoming advisors, advisors becoming investors, investors becoming LP. So there's like so much of that going on. And I don't take ⁓ everyone's words for it. So for example, if a warm introduction is coming from someone who has lived my problem. And this is what I do. Vendors do not realize we talk all the time. So if I have a problem, I pay somebody who I respect, who I admire, who I know that has done work that speaks for itself. I will ping those people and say, here is my problem. What do you think? Or what are we doing in your world? And if they tell me, look into the look look into this product, look into that product, hiding. So that's number one. if somebody in my network just reaching out to me, hey, go ahead and look at this product and they're just the advisor or investor, but they haven't lived with that problem, no, I'm not interested. In fact, I'll tell you a funny story. Once I was talking to a VC friend, And I I was solving this AI AI shadow problem. So I pinged some of folks and I said, Hey guys, I'm looking to this space. Can you provide some recommendations? And ⁓ different network folks reached out with some names. And I asked this question as a follow up. I said, How many of how many of you have lived this problem on your own? That's where I come to test operator reality. Because it's easy to say, go take a look at this company because I'm invested in it. Or my founder is saying I'm awesome. I don't need that. that validation I need to hear from people who have actually lived with that problem. So even in warm introduction, what I'm saying is it matters who is saying it. And I think I wrote another post on it as well. Operator reality so underrated. So underrated. People are coming up with examples or throwing name right and left without understanding when I am buying a product, I'm putting my name behind it. So that's one. What else works? Sharp, short, crisp email with clear messaging. Please be respectful of my time. Respect your own time. Tell me exactly what you are solving. Don't try to tell me that you're solving the world or world hanger problem. authentic networking. When I go meet people, I'm big into energy. I don't need transactional partners. I really want to be Present with that person hearing, what are you solving? So I think in in our case, Mehu, when we started talking, it was very natural where you were like, okay, you didn't try to come to me to try selling your product. You talked about you're building something. And you were more curious about how I'm thinking about this space. And then naturally I ask you, what are you solving or building, Mehu? I want to look at that. So Invest time and energy building authentic relationships so that I am not seeing you just as a transactional partner. I need long term partnerships. Speaker 2: After investing so much time, you know, we send you flowers, we send you trees, plants, doormats, donuts, finally close the deal, right? And then what I've seen is a lot of the software becomes shelfware and it don't doesn't get used as much. Renewal comes around and the vendor is like, we don't want this product. You know, renewals don't go as planned. Why do vendors lose the deals, you know, after they've done all this upfront effort of convincing the buyer, you know, taking them out for steak dinners and doing all this work goes upfront. And then once the deal is closed, you know, it's almost like Tata Bye Bye. Like, you know, see you later at the renewal time. ⁓ I'm curious, you know, from your perspective, why do vendors deal ⁓ ru ⁓ lose deals at renewals? Speaker 1: Many reasons. Many reasons. ⁓ the I will talk about that toward the end as what is the biggest differentiator they are not realizing. But I wanna start with a few examples. That has happened in my own stack. ⁓ a few years ago we signed a vendor and they were the ⁓ biggest thing in their space. The day ⁓ the sign off was celebrated and then they disappeared. No follow ups, no check ins, no product updates. Just silence until Speaker 2: No follow up with you or not with your team also. Like there's one level of follow up with the leader, the CISO, you know, that's pro probably a quarterly or a yearly thing. But like the team is engaged very week ⁓ daily or weekly. Speaker 1: Nothing. Nothing. No one who heard anything. And then ⁓ just silence until month eleven when they came back with a renewal quote and a sense of surprise that we were already in conversations with their competitors. Speaker 2: Interesting. Speaker 1: And this happens so often. Look, I've been doing it for twenty five plus years. There are vendors who will just we see through it. There are vendors who are just checking in for the sake of checking in. Then there are vendors who have no conversations going on. And then there are ones who may not even check, but they're so attentive. We recently had like I can give you a few examples here. There was one vendor in our stack. As the AI journey was changing, they were a SaaS play vendor. As the AI journey was changing, and I'm talking about good examples here, these guys were doing things behind the scene, although they didn't talk to us. But when we one morning, when we logged in, we see new features, we see new dashboards. They didn't have to show up or set up a call. They just put in the effort to make sure the product is showing what the trend is, what the CISOs or the engineers need. So the point I'm making is it's not always that we are asking you guys to put meetings on our calendar. Just do the awesome work so that we can see that in action. Right? So that's one example. The other wonder, let me talk about this specific example. And it's a problem statement. I'm still looking for a solution. If somebody's listening to this, please reach out. SaaS AI Portfolio Management. We had a vendor. again, big name. We were happy that okay, after the problem statement, and by the way, Mehul, I have a process. I do not bring in any vendor until my team clearly defines the problem statement. There are success criteria defined. We look at at least three to three to four competitors. We do a POC and then we pick a vendor. So imagine the vendors I'm talking about were the winners after the bake call. Now this vendor shows up in my ecosystem and ⁓ what is it? ⁓ over promising, under delivering. Classic example. Right after the before the contract was signed, we will give you the the support that you need. We will have the people to guide you through the minute the deal was closed. Nothing. And then my team is reaching out, asking for training, for integrations. And then everything is like we have two engineers, we are distributed among many customers. You are asking for something custom. We talked about it during our POC. And if you haven't built it as part of that POC and you promise that this is going to be part of our package, then you cannot say after you know the deal is closed that sorry, this is a custom thing. So then the conversation is start because it is custom, you have to pay for it. You have to engage our professional services. We have only two engineers who can only prioritize so many different things. And this nonsense gone for like so many months. Then they build something. We lost six months for them to build that integration. They come back and they they make us feel like they have done us a favor, sort of a gift that they have given us. And then that integration solved the wrong problem. So not only for the longest time you wasted our time, you wasted your own time, there was no alignment on what to build with us, you build something that you thought we needed, and then a pongrenale they're like the example I talked about. Our product was hundred thousand dollars. We gave you seventy-seven percent discount and we built a specific custom integration for you. And I my response to them was number one, let me just say that. There was no clear communication. You build something for for for the longest time you didn't build. And then when you build something, they've solved the wrong problem. And then after that, if your list price is wrong, that's not my problem. Speaker 2: Yeah, from the from their perspective I guess, you know, they delivered they cut the cost by seventy seven so seventy seven percent or seventy five percent. From your perspective there is like zero value. Speaker 1: Exactly. So I have a quote on that as well. Like they think giving a seventy seven percent discount is the value. I'm seeing it even if I paid twenty five thousand dollars, I got zero value. So the value is zero. And I gave them so many opportunities to tell me how they're gonna fix the problem, how we move forward, what is the plan ⁓ forward, and what was missing in that conversation? Accountability. Understanding partnership. We are not hard on vendors and saying, Okay, just because you made a mistake, we are not going to continue. We want authenticity, integrity and accountability. Speaker 2: Is that is that one of the reasons why the the the products fail to deliver from your perspective? Like, you know, you come in, you you know, they don't do the due diligence, they come up at renewal, the products don't deliver whatever they promised in the POC, you come in yearly, that it's not working. And as soon as you threaten, hey, I'm not going to renew renew, discounts come in, the discounts come in, and you know, ⁓ all big statements come in, these these are the things we did for you. Why are you not seeing the value and you are like, I didn't see any value in all the work that you did. Is that how products fail from your perspective? Speaker 1: Absolutely. That's the problem that I'm talking about. Look, as I said, as buyers, we have clear problem statements. We have money. Delivery is again and again. If I can tell you in 25 years, the biggest problems that I see is the delivery problem. Whether it's the hench ⁓ head-off, handoff is broken. Whether it's the lack of communication, it is the lack of accountability. And one of the but things vendors do that annoys the hell out of me is. Speaker 2: Hand off. Speaker 1: Send me a list of things. We did this, we did this, we did this, we did this. But whatever you did, how does that translate into value? Nobody talks about that. You wanna talk about what works, what good vendors do? As I said, do what matters. If you're really excited, passionate about solving a real problem without even me asking you, see where the trend is going, solve that problem, make it available in my dashboard. You don't need to do big communication, you don't need There is another vendor that we really love. I don't want to give names because I don't want to favor one vendor or the other. But there is one vendor, they do it so beautifully. They have weekly friends. They don't over promise. They're not sending quarterly roadmap talking about we're gonna do this, we're gonna do all those things, none of that. What they do is they first ship, they make it available in the product, and then they send an email, simple email. ⁓ feature release note. Here are the new things. Within the product. Go test it out. No drama. We love Speaker 2: I'm gonna I'm gonna talk I'm gonna talk to you about this vendor after this call. After the recording stops. I want to learn more. ⁓ Aisha, one of the biggest misunderstandings ⁓ for sellers is that, you know, when they get invited for a meeting, that's when they think that, hey, y there is there is an opportunity. Let's get in and convince them to buy our product. And the thing that you say is in your writing is the cast is already set before you even take up the first call. the the the buyer has already done a lot of research and you're you're just a cog in the wheel of the process. You know, it's not like you're going to re redefine the process or redefine the RFP. The RFP is already designed, the problem is already defined, the vendors are already picked for analysis and you're just you know showing up for that competition. I'm curious, ⁓ what is the thought process behind ev you know, when a vendor decides to buy something, how long before the process has started, before the vendor is brought in? Speaker 1: I will talk about my process. I'm not really sure how structured or organized other leaders or organizations are. In my case, ⁓ structure brings clarity, which is like alignment, alignment of so I do work mostly in fiscal year themes. So for example, we are in fiscal year twenty seven. In fisc for fiscal year twenty seven, our budgeting started in last November. So most big enterprises do their budgeting around ⁓ quarter, third quarter. So November, December is when we are doing budgeting. And I am not like setting ⁓ in stone that we have to know exactly the vendors. The game plan is around November, December time, I asked my entire team. So another so okay, let me break it down. So I have GRC. I have security operations, security architecture, IT ops, and AI. Five different pillars. Now I have to think about the the envelope that I'm getting, I have to distribute in five to six different domains. But five to six different domains have their own major pain points, foundational problems, and emerging trends. And then I see where there is overlap. Like for example, shadow AI. Shadow AI is impacting pretty much everyone, right? ⁓ continuous monitoring. It's impacting trust and assurance, it's impacting security architecture. So what I do is in around November, December time, I ask my leaders of these pillars, help me understand your pain points, help me understand where the foundational gaps are, the tech tech, and help me understand which vendors have not performed. That's the time I start the conversation saying if somebody is like a slacker slacker, we immediately try to get rid of them. But mostly around that time, my conversation is around which vendor is showing up and which vendor isn't. So we get that clarity as well. And then fourth question I ask is what are the emerging trends? Where the industry is heading? Where do we have gaps in our portfolio that we need to be addressing? Once we understand those, then we start talking about what should be our budget. I don't ever accept a blanket NM, a blanket ⁓ envelope from my CFO. I have that understanding that was another post that I wrote. People have problems getting money from their CFO. My CFO and I have trust. And the trust is I only ask when I need something. And I've been in treasure data for seven years. And I can tell you this, Mehul, my experience with my CEO and my CFO, there has never been a time where I've asked for something and they said no. In fact, my CFO is so proactive about security. That's not the case, maybe, generally speaking, but he's so proactive about security and all these AI discussions where he'll be like, What do you need? Is there anything that I can help you with? And I tell him all along, as direct, as truthful as I am, I'm doing my research, I'm looking at the problem statements, I don't have the answers right now, but I will, rest assured, tell you when I know I'm I need something. To build that relationship up and down as well. So coming back to the budgeting cycle and when we, you know, like ⁓ get involved in the vendor evaluation process, once we understand our problem statement and budgeting is defined, in November, December, we have highlighted categories where we will be looking. And that ⁓ clock starts in April. So meaning the budget becomes available in April to us. Now, June to March is the time when my team is looking. So, what happens in that process as well? Every single leader is responsible for writing a business case, which I personally review. Business case will be a problem statement. What does success look like? And then often they ask me, Hey, can you reach out to your network and figure out who are the vendors? Speaker 2: Evaluated. Speaker 1: showing up as reliable vendors. And I ask them to do the same because I want them to build their own thought leadership. So I'm like, okay, go meet people, attend conferences, build your own circle. Because my experience is from a CISO CIO level where we get to hear if the product is working or not. But then they're, they are the one in the weight. They need to know at their level if it's meeting operator reality or not. Right. So it goes both ways. So my guys and I come together around Jan Feb time and we are like, okay, here were the problem statements we talked about. In the order of priority, what are we going to be prioritizing? We're not gonna bring, let's say we've we have to bring this year along. I have replaced so far four to five tooling already. I'm planning to replace four, five another. So again, opportunity, opportunity for anyone who's listening. So there are opportunities. We are replacing those vendors because. They didn't perform. Not because our problem was solved, they didn't perform. And then there are new emerging threats, ⁓ threats that we need to address, four or five of new tooling that we will be looking at. But now from our point of view, we are not doing everything in one go. We have to sequentially see which one should come first because that builds the foundation for the others. Now, with that business case, I bring in, they bring in the names. We do our own evaluation first. We look at your websites. We look at your messaging. We ⁓ tap into our network, we get their testimonials, feedback, what work wouldn't work, and then by the time we knock on your door, there is enough evidence available to us to say they are worth the trial. Speaker 2: I mean, this is something that is not known to many vendors ⁓ who are trying to sell into your organization. ⁓ one ⁓ one one thing I want to touch upon, Aisha, is ⁓ when you're evaluating these vendors, ⁓ there's a lot of obviously they're going to come in and pitch you. Hey, our product is better. Look at our ROI for some random company we did. And I have seen this personally where I've seen this personally where Vendors would hire marketing firms to do an independent ROI analysis, and the marketing research firm will say this vendor provides 500,000 in ROI. They have it a very slick PDF, colorful, looks visually appealing. I personally never understood like who's going to buy this random number that you came up with. So I was always curious, how do the buyers think about ROI? When they're making the ROI decisions, right? ⁓ so ⁓ let me start there. How do you evaluate ROI? Do you count on these ⁓ I don't want to name names of these market analyst firms, but they come up with these the paid a paid reports where they are saying ROI, five hundred thousand dollars in ROI, so that the product is essentially free. ⁓ love to get your take on it. Speaker 1: Give you the country. I said the answer is never. Personally, in my journey I have not looked at these ⁓ reports for ⁓ the main reason. As I know the delivery is the problem. I don't care how great is your ROI. Speaker 2: I have one question. I have one ⁓ sorry to interrupt. I have one question. Do any of your peer networks look at this? Because this has this question has always boggled me where they're looking ⁓ do people look at these ⁓ they do they value these ROI reports? Speaker 1: Some do. Some do. Some do. But for me personally, it comes down to me doing a POC. That's why I said we don't bring in any vendor until we do our own POC. I mean, I don't know what's the value of me relying on a report when our environments are so different. I wanna make sure that I bring my okay. The it may be an approach question as well, but my approach has been that I want practical, realistic, informed data. I don't want hypothetical situations. I don't want somebody to vouch for someone, I wanna see it myself. Speaker 2: You you would be surprised, Aisha, how much time is invested in calculating these random bullshit ROIs. Organizations literally have ROI calculators on their website where you can go and plug in these numbers and some random number comes out of it. Speaker 1: You know what I call this? Speaker 2: Yeah, I would love to know. I'd love to know. Misaligned decks. Speaker 1: Missed alignment text. Speaker 2: Deaths. Speaker 1: No, no, text, text. So miss you're investing your time and energy into something that you don't really know if it's gonna work in reality. So that's the mission. And then you're putting text on by wasting everyone's time, energy, and money. Whereas what I would do is I would rather have my team spend POC one week with that vendor and get to see would it actually work in my environment? Am I close to seeing the ROI that I want? Speaker 2: Text, okay. Yeah. Okay. Yeah. Speaker 1: I think these people should ask themselves if they have clear success criteria, if they have done a POC, why are they relying on other ROI calculators? They can do it internally quickly, you know? Speaker 2: What is the ROI that you care y that you care about? Like what is that number that you really care about? Speaker 1: It depends on the functions. So GRC ROI is a different security operations ROI is a different. So you know, like by domain I go. But I I wanna give you an example. ⁓ recently I had a product and we were talking about renews and I said, Show me the ROI. And in that case, this is an AI product and I want you to see how AI is adding value to your bottom line. And I kid you not, exact wording. We have saved you 15 minutes per person in summary documents, trans ⁓ transcriptions, this and this and this. So the math was because we are saving you 15 minutes per person, your ROI is 1.5 million. You know what I said ⁓ when that email came? I laughed. I sent an email back with one line. Nice. Create fantasy map. Speaker 2: No, but you're this is correct because this is correct in the sense that these maths are fantasy maths. These ⁓ there is no sense to these maths. Like, you know, we saved X hours and your full time employee could be hundred thousand dollars, so you you know, ⁓ you know, whatever it is, and then they multiply that by the number of hours and here's the three million dollar number. I don't I don't know who believes those numbers, but then there are vendors who come up with these numbers. In fact, I've seen vendors putting these ROI metrics in the dashboards of the products. Four million dollars saved, four million dollars saved. I wonder who I mean, where where are these four where is this money? When can I get this money back? Is my question. Speaker 1: the clarity, even if many operators realize this is BS fantasy math, I don't know why many of them are not seeing it. Look, I am I I hope you know me enough. I am not someone who is disrespectful or inconsiderate. But my point is I don't have time to waste, so please don't waste my time. So from all intention when I send that evil back just one line, nice fantasy man. For three days, no reply. No reply, because I didn't know how to justify that. I said, we are not having a renewal conversation until you come back with realistic map. Because the ROI you're reporting is not the ROI that I disclose to my board and my CFO. Happy people, ⁓ 1.5 million saved by 15 minutes does not show up in my report. Speaker 2: Wow. Speaker 1: Let's talk about real numbers, real move needle movers. And if you don't have that, build with me. So see, Menhul, that's the point I'm making. Don't just randomly come up with things if you don't have it. Part membership is this. Hey, what would ROI for you makes sense? What sorry, what ROI, what makes sense to you? How can I help you build it? Let's work together to figure out what is it that you need to report, you need to track. Speaker 2: Okay. Speaker 1: Vendors do not understand this or they just have to put something for the sake of putting it. Just stop wasting your time and my time. Speaker 2: I would go a step further. If you don't have anything to report, don't report. Like if there is nothing to report, don't report, don't make up a random number and show this is the ROI because this essentially ⁓ impacts your credibility. fantastic. I mean, ⁓ the the next question I have for you, Aisha, is ⁓ is adoption rate. How do you how do you decide is now is the c product getting adopted? You know, you you said you start your process in November, the evaluation starts in January. How do you assess if this product is successful? Is it it's getting adopted within the company, within getting used by the company and so on? Speaker 1: First of all, ⁓ good products become viral on their own. We don't have to do a lot of training and adoption. But then there is also ⁓ a fundamental problem as well. Once the product is in our ecosystem, the minute you know the sign off happens, somehow Wonder thinks now it's our problem. Our problem to train, our problem to integrate, our problem to increase the adoption. And they are only tracking the number of clicks, you know how many people are clicking. And that's why I say login frequency is not adoption. Feature clicks are not adoption. Training completion is not adoption. This was another line in there. Speaker 2: True. Training completion is not adoption. I mean I have ⁓ that is that is so crazy. You have the five step process, everyone has completed the training. Speaker 1: So these examples that I talk about, I literally get them as email responses when I ask about ROI. One vendor sent me, we completed five trainings for you. We say number of people clicking on these features. What does that even mean? I'm not fucked. I'm just giving you a real example. And then these people talk about their QBR and sa you know, like seventy-three percent people logged into this logged in and did what? No no. Speaker 2: That the product doesn't work. Speaker 1: Often logged in, got overwhelmed, cannot make sense of how the data is well, the source of truths are not clean. Garbage in, garbage out is happening. ⁓ there is no clear sense of like there was one too that I would log in, fancy reporting. And I would ask my guys, can I take this? And the guy says, No, please don't rely on it because the data is not clean. And I'm like, What do you mean by that? Like that's Product was supposed to give me, you know, like executive spent by department on tooling, SAS portfolio one. And the guy says, you cannot trust this data. I'm like, then why the hell do I have this tool if I cannot trust this data? And whose problem is it? Well, the tool is so complex. This is another thing I wanted to highlight. Please, for God's sake, for God's sake, understand we want simple products. I don't know who came up with this idea. I think Mihal, I told you this as well. when VC, founder, advisor relationships are very intimate relationships. Like dating. Make sure you have the right people guiding you. In the industry, one of the things that I'm seeing, my mantra for my organization is being a CIOC. So first simplify, then secure. Yeah. Many of these tools are overly complicated. Click here, click that, aggregate this, and then look at this. And I am sitting here thinking, we all are engineers, why did we not learn to unlearn this whole notion of making things complex? Speaker 2: On that topic I have one question for you, Aisha. ⁓ do people do leaders at your level actually use the tools? Or do you rely on your teams to do you know, do you actually end up using the tooling at all? Or is it because my sense is you're mostly at the business level, looking at the metrics. Speaker 1: Depends. Depends on the tool the program. So for example, SaaS portfolio management, I am actively engaged because I want to see, I want to slice and dice information, figure out where the consolidation opportunities are, which tools are being adopted, which are not being adopted. So that's one category, ⁓ continuous monitoring. At any given time I wanna get a sense of how the trends are going, whether it's vulnerability, whether it's compliance, those tools I go into, even from like executive ⁓ point of view. ⁓ so I would say this is another thing that vendors have an opportunity. They often think the tool is black and white. Either it is for the executive or it is for, you know, the engineer who's in the tool. Speaker 2: Yeah. Yeah. I mean most you know, very common personas either it's the buyer or it's the user. Right? You know there are very clear personas in our mind. You we're still the buyer then you know, then care about the user. Speaker 1: Yeah. So that was a problem in SAS, but it is becoming more of a problem in AI because now we all are becoming more hands-on. Now, before I would send a question, question will make it to the SME, SME will go log into the tool, the answer will come back up. Now I have the ability to just go query the data. So vendors need to start thinking what how can they make that same data available to execs who are slicing and dicing for different purposes, and then engagers who are actually using that. to make sure things are compliant, trending down, doing what they need to be doing. That view is missing. We heavily relied in the SaaS era on our engineers to be doing the work and reporting back. What we are saying is we want that reporting visibility immediately. Speaker 2: But do you then get this reporting at like a you know, a BI tool like Domo and this is where do you mostly live in or do you actually go and because you know again the problem is the problem is most vendors would have probably have a siloed view of their come you know, if you're using something for cloud, they probably have everything about the cloud. ⁓ if you're doing web applications, you know web application tool would have everything about their product. in whatever they have to report, right? But there's something h else has to happen. Does it then end up in a reporting layer from your perspective? Speaker 1: We're talking about the horizontal layer. Yes, for horizontal layer we have things that we stitch together. Now with AI, things are becoming a lot more easier. It's simple MCP integrations and we are ⁓ catching in ⁓ data there. But what I'm talking about a layer down, even within your own space, whether it's AppSec, whether it's continuous monitoring, whether it's Gem or whatever, at least give us enough information for any exact to go and say how compliant ⁓ am I with my device control? Or how am I leveraging usage, adoption of the tool? That information within that space is also missing. So we have to very much rely on other people. Speaker 2: Interesting. And most of these decisions, ⁓ the the buying decisions that you make, I shany have talked about this extensively. These are reputation decisions. These are not just financial decisions. Every decision that you're making, it then in some respects it's a CYA. Like, you know, you don't want to like you know, there was a famous quote that nobody got fired for hiring IBM. I don't know if you remember that, right? Like, you know, ⁓ nobody got fired for hiring by IBM. So when you're dealing with startups or early stage companies, it's always a reputational risk. You come in, you bring in all this data and most of this data is very sensitive. Security data, it can get leaked, you know, exposed to S3 bucket and so on. ⁓ what goes in in terms of your you know, the these kinds of decisions that are happening that have had a reputation layer? Speaker 1: Vendors have no idea. ⁓ people who are making constant connections. This is this is what I'm talking about. Misalignment text bleeds into reputational text. Imagine this. If I build authentic, credible relationship with other stakeholders and I tell them, hey, for example, my SRE team, we are looking into ⁓ security architecture tooling, and here's the tool that is going to be coming in. If I bring in the wrong tool, that wastes everyone's time does not deliver the way it should have delivered, whose ⁓ credibility online? Speaker 2: It's mine. ⁓ Speaker 1: Next time they'll be like, you bring products that don't deliver. How are you doing your due diligence? Why are you wasting our time? And this is what industry has to understand that when operators are putting their name behind something, please deliver. Not only that we will stop buying from you in that instant or will not renew, anything that comes out of your mouth for the next five, ten, fifteen years, we will think twice. If this person did not deliver hair, why should I take this person's word for something else? Speaker 2: Question for you on that, is this most i are these decisions are these decisions singular or are they bottoms up in the sense that, you know, you said you have a process in place where you're relying on your team to do the analysis and so on. So eventually the decision is yours, but then your team has also contributed in that process in terms of in terms of, hey, you know, this is working, this is not working. ⁓ so is it again, the question is, is this a reputational list for the entire team? Like these teeth the for example, the one way to look at this is this leader doesn't know what they are doing. The other team is this team doesn't know what they are doing. They just bought this product and wasted our money. Speaker 1: Yeah, let me do justice to this question. I personally do not make unilateral decisions. From conversation so far, I think it should make sense of it that I'm very processed and structured of person. but Speaker 2: This is not only the has that sorry to interrupt, but is that like a is that a thing that that you have o developed over a period of time because there were so many failures along the way that you were like, This is not working, I need to put a structure in place. Speaker 1: Yeah. But I will tell you ⁓ it's the instinct to answer your question, uni why don't I make unilateral decisions? Because one, I won't buy in, buy in from people who will be implementing tools. If I come in, this is not I have a favorite saying, authority is not the truth, truth is the authority. Just because the position to come and tell you look at this product or look at that product, I You are the one living in that reality and I'm talking about my teen who understands what will work, what will not work. Me giving you a name is just opening the door for a vendor because it comes from a place that I trust. So just take a look at it. But I do not make unilateral decisions because one, my personalities, I like to be informed. Just because I know a name, I'm gonna tell you, check this out. However, I want my team to go do their due diligence. come back with information that also helps me. And then I often go back to my peers and say, by the way, the name you recommended will not work because of this, this, and this. So that industry is also getting educated in the process. So these are not unilateral decisions. I want to make sure everyone is involved. And the reason for that is one, we all learn from each other what is working, what is not working, how these vendors are delivering. The other thing is, ⁓ They are the one who is who are implementing. So if they are involved in the decision making, the buy in is there, then they are keen on implementing it as well. Speaker 2: Yeah. True. And this is true, you know, you might think this is applicable to only your space. This is actually applicable to product and engineering as well. So then, you know, for example, when we are building products, we want to make sure that the engineers are involved in the design process so that they own the problem rather than the product manager saying, Build this without understanding the context of why why why they're building what they're building. And it's a very good process because getting the team in, to getting the team to buy in. Because otherwise they'll not implement this Aisha told me to do this and I'm doing this and then you know y y you put essentially your reputation on the line and the product never delivers. Right. Speaker 1: Remember I said earlier the process that I have is I want their conviction. Regardless of who is giving you a name, they are going to be three for name. You have done the POC and I want my team's conviction. Look, I what I am most proud of is not the titles that I have. What I hope that my team remembers me for is me investing in their success. And investing in their success to me simply means they have a say, they are learning, they are growing, they have opinions. have opinions, I want them to have opinions. I tell every single leader on my team, if you are in charge of GRC, if you have a problem, I don't only want you to come to me with problems, I want you to come to me with some solutions as well. And in order to have some solutions, they have to go and they have to learn and they have to meet people and figure out what's working, what's not working. And when they come to the table, then they are going to say, hey, this is what I'm thinking. And I then start grilling, why this? Why not this? So it's not like my decision or their decision. We all come to the same decision together. And by the time we get there, there's conviction, there is support for each other. And then the journey itself is a lot more fun. Speaker 2: The the journey of buying products is com is completely changing in the age of AI. You know, like you just said, yeah, you you just said where I can now go in myself instead of going to an SME, I can ask the question, get the answer and get going. This was simply not possible before. Simply not possible before where the executives had to rely on maybe the director or the senior director, the senior director would send it to the See ⁓ the manager, the manager would send it to the analyst. The analyst is you know, some some kid is sitting in a low cost country ⁓ running the report and then it goes up the chain again all the way. And by the time you get the report, it's like three days old or four days old. But now you can just jump in. I'm curious, ⁓ how has the buyer's mindset changed in the age of AI? How are how are buyers buying in the age of AI? Speaker 1: lot has changed. First of all, what comes to my mind, I recently saw there was a like ⁓ there was a pyramid hierarchy of how information used to flow up. And now in the FAI, it's a circular flow of information. Everyone is connected to everything and everyone is learning from everyone. The context that I have is easily available to my engineers. The context engineers have now easily available to me. And in real time we can make decisions. We don't need a lot more meetings. So that has changed. So the ground has shifted. That's number one. Number two, personally, I'm not looking at SAS anymore. In fact, what I call is SAS was nothing but a glorified Excel. Speaker 2: True. True. Yeah. This is especially true for MySpace, the vulnerability management products that ⁓ it was essentially a glorified Excel sheet. Because even after doing all the work we did in vulnerability management, customers would just download it to an Excel sheet and then work for like the post action was always in an Excel sheet and a pivot table. And I'm we were like doing all this innovation on on the product side and the customers were like, just give me an Excel sheet. Speaker 1: way there was contact lacking misinformation more mostly hierarchy either w up or down. That the process itself has changed, but now what else is changing is everyone is sort of becoming an IC, even in their own position. Right? So forget about titles, but even in my job, ⁓ the biggest thing has happened, first I'm gonna start there. You know, like as leader, you have years of experience, you have way of doing things differently, you have been burn along the way, you have had your fair share of, you know, successes and failures. You learn. So the processes that I have built because of who I've been throughout that journey. But what has happened now is back then I would let's say have an instinct. I would say, I think my instinct tells me that I need to go in this direction, but I would not have data. So I would tell my team and I'd say, hey team, can you gather this data for me? I'm a very dear different person. So I would say, once I have the data, my instinct will tell me, like I will get the validation or confirmation of what I'm feeling. AI has solved that problem for me. Instinct was always there. Data was delayed. Now with AI, data is readily available to me. So with instinct and readily available data, now I can quickly make decisions. So AI has accelerated speed, not only in building, but fail fast, learn fast, use your data to make decisions that are going to actually move the needle. So that's one aspect. The other thing has changed is the expectation. Look, what is the difference between SaaS and AI? The way I describe it as in the SaaS, who is going to do the work? Because you have these glorified Excel, people will log in, all the other things that we have talked about. Whether there is adoption or not, at least they go, they log in, they see if the data is organized, clean, and they are not overwhelmed, they're gonna do something with it. So the math was mostly about buy tools and then put or throw people on those tools for them to be doing the work. And AI was changing. It's how the work gets done. Now the dashboards are giving us not only visibility, but agent. or genetic capabilities to do the work as well. So what I see is when people talk about AI ROI, the biggest AI ROI that I am shooting for is strategic thinking for my team. Before my teams were so busy within the tool trying to grab things, send it in all different directions. Now my team has the ability to rely on the agents, automate many of those things, and then they have time for strategic thinking to think about why it matters. What do I do with this? How do I solve with this? And the biggest thing that I have seen is b with that bandwidth that we have increased, the things, look, security is never 100%. There were there was a big parking lot item of things that we always wanted to get to. But the answer was always bandwidth, bandwidth, bandwidth. We need more people. We need more tooling. Now what we are doing is with the Gente capabilities, we are pulling more into our backlog and we are saying now we have the ability and focus to execute on other things to increase our scope for coverage. And that's how our CPI has changed the game. Speaker 2: I I'm curious, you said something on the lines that ⁓ the SaaS is dead or ⁓ something on those lines. I forget the exact term that you said. But my question my question to you is, do you see the value can concentrating from your perspective into the AI models and the AI companies, or do you still think the SaaS companies will continue to deliver value for your teams? Would they as you think about as you think about ⁓ replacing vendors, bringing on new vendors? Are you then more relying on the AI tools like Cloud and Chemini and I guess, you know, rely on them to do the work with the agentic capabilities, or do you think the SaaS vendors can build their agentic tooling and deliver the outcomes that they're looking for? How are you thinking about that? Speaker 1: First of all, I'll tell you at the level, I'm too liquidistic. I don't care if Anthropic is solving that problem or the current vendor in my ecosystem is solving that problem, number one, because if anthropic eventually is going to eat everyone's lunch and do it well, then we'll go in that direction. But right now that's not the reality's life. There are a few pieces in place, but not the whole thing. But the way I look at it is it's not black and white mehole. It's not like SAS is fully dead. Like, okay, let me say it this way. Even AI made system of record. And SaaS was system of record. Now the problem is the ones who are still selling SaaS is there is a difference by the way, AI ready, AI enabled, and AI native. You put an agent on top of your record and you're like, Okay, now we are AI native. You're not AI native. You're AI ready, you know? So don't fool yourself and don't fool people who know what the difference is. So the point I'm making is SaaS is transitioning. If you are going to be purely a system of racket, but you expect still people to come in, login, and do the things, then you are still purely SaaS. But AI native is you took your SaaS infrastructure, you now have the AI native capabilities on top. Now you empower your customers. Because not only we need the system of record for things that we need, but now there are agents helping us develop, build and implement. For the longest time, many things we could not deliver because we were relying on vendors to build integrations, to create implementations, to help my team do things within their tools. Speaker 2: And one of the w one of the biggest challenges I think in the previous era was build versus buy. There are always these discussions, should we build this ourselves? Should we buy a new tool to do this? ⁓ do you think that that changes now? With the build versus buy versus ⁓ there is something else that comes in place for for somebody like you? Speaker 1: Yeah, it does. My framework is very simple. ⁓ first of all, build versus pie, I feel like will always be a conversation. But how the conversation changes is now instead of just simply build versus pie, I look at it as build with AI, replace with AI. Speaker 2: Interesting. Interesting. Speaker 1: And now let me explain why I say that. Build build worse build with AI and replace with a AI, the lens that I use is the thing that we are building, is it core to who we are? Is it going to scale in the direction we want to go? If the thing that we are building is supporting our core capabilities, let's build it. With AI internally. But if we are investing our time and energy replicating another CRM, another ERP, another AI platform tooling, which is not core to who we are, we are wasting our time. So focus again going back to you know this whole conversation noise to signal, the biggest takeaway for everyone is guys, clarity of who you are, playing in your lane, building in that space, and then making bats on AI where AI is going to amplify you. AI is not strategy. AI is a tool to amplify your strategy. Speaker 2: Are you in some sense buying agency for your team with AI? Speaker 1: I am. Speaker 2: Is that what you is that is that what you're looking for in an aspirate of a mandate for tools with AI? Speaker 1: Yeah. I have changed the whole operating system. ⁓ the working operating model for my Speaker 2: Very important to clarify that. You know, it's not the wind it's not the Windows operating system, or the Linux operating the working operating system. Very important to clarify that. Speaker 1: So what I have asked the team to do is we are okay, so we have these mandates, you know, keep us out of the limelight, secure the product, assure the customer, enable and accelerate our workforce. These are mandates. The program doesn't change. How we think about those programs and deliver on them changes. One, we want to be tool agnostic. We are still doing some experimentation. We have many different tools, but I have high hopes by the end of this year, if you come back and reinterview me, I will tell you out of 23 AI tools, I will be down to good five or six of them. And they are going to be the core capability tools for our tech stack. Right. So that's number one. Use AI to amplify how you deliver these programs. Number two, agency in terms of again going to build with AI. ⁓ replaced with AI, there is one vendor that I brought in which is going to give a space to my security operations team to not worry about triaging, remediating, vulnerabilities, ⁓ you know, like S bombs and AI bombs and all those things. Cause now we have have the space for him to focus on other things while agent is able to do all those things. So yes, Agency, autonomy, all those things are being amplified with Ian. Speaker 2: You know, you mentioned some things that ⁓ seem a bit odd to me. ⁓ you use you mentioned maybe the context was wrong, ⁓ but that you still rely on dashboards to get insights. Do you think the dashboards would be relevant in the age of AI, or would you just have the agents do the work and let you know that the work has been done? Or would you still rely on these dashboards to visualize the work? Because what you're saying is you're relying on agents to do the work. not log in, like not humans to log in the product and check in and what is happening. But then the on the flip side you're saying that I want the agents to do the work in some ways. I want I'm buying agency, right? So do you think dashboards are relevant in the age of AI? Speaker 1: And thank you for asking this question. So this gives me the opportunity to clarify. What I'm saying is imagine this. This example that I gave you, security operation agents will be looking at triaging, incidents, level one, level two, remediation, all of it. Right? Agent is actually doing the work. But how do I know Agent is doing the work? So when I dashboards, what I'm saying is I still need the ability, forget about visibility. I still need the ability to know what the hell is this agent doing? Speaker 2: Okay. Got it. Got it. Yeah. So the the you want to be able to track what the agent has done and accomplished. And maybe that gives you the right ROI eventually. Eventually it solves the ROI problem. Speaker 1: The way if look at it, even in your own space, vulnerable space, right? They even with Mythos, we will Asian will be remediating, triaging, reaching out to engineers, maybe building PR codes and all of that. But how do I know what is the baseline? Like what were we like a month ago and what new is coming? I still have to have some ability to know how the trend is going so that I can also figure out my own. growth factors like where do I need to invest more? Now if if the funding or the budgeting opens again, how do I know where do I need to invest if I don't know or understand the trends over time? Speaker 2: Asha, this has been this has been an epic interview. Last question for you. ⁓ what's next for you? I know you're writing the buyer's seat. ⁓ you're writing the buyer's seat book. ⁓ what's what's the next big book that you're writing? Speaker 1: Right now I'm writing two books and you know, it's so funny me I hope even in my job. Speaker 2: That is in addition to the buyer's seat or is there something apart from like is the buyer's seat one of the books or is there two more Speaker 1: No no. So buyer seats is one book. And the other book that I'm writing is more of a spiritual book. The point I was making is even in my role being at the IONC, so there's constant context switching happening. And I don't know what is it with my life. Even at the same time, I've started these two projects and they're both going at panorama speed. So my focus right now is Finish the buyer's seats first, because I feel like this is what the industry needs right now. and as this book hopefully helps people get clear on what matters, why it matters, how to build, that will free up my own cycles from managing vendors and relationships. And that time that I get back, I will then write other books. Speaker 2: When does ⁓ when does the book come out? Speaker 1: My hope is fall of this year, if vendors do not add more to my plate. A lot of my time goes into managing relationships. Speaker 2: And then ⁓ how can viewers sign up to learn more about the book when it is coming out, and subscribe. Speaker 1: Yes, we have a domain, the buyerseeds.com. Again, the goal is not for me to write a book for the sake of writing a book. I have a lot going on in my life. I have a full life that I love and I'm writing it only with one intention. Hope this brings clarity to our community and we all start building what matters and stop talking about we are being burnt out, we are being depressed, we don't know why we are wasting time cycles. So every listening this book is for you guys if you are interested please sign up when the book is ready you will get a quite nudge that it's ready no spam or nothing ⁓ and at the end of the day if it helps you that's what I want Speaker 2: Awesome. That's ⁓ that's a great place to end the interviews.