Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Why a CISO Bets on a Startup Over Crowdstrike: Robbie Tyrie, Fractional CISO

Transcript

Why a CISO Bets on a Startup Over Crowdstrike: Robbie Tyrie, Fractional CISO · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_01: So let's say you've nailed the demo, you put the POV going, you've you've aced that, and then on the buyer side, the procurement team or the risk team get involved, and they're wondering, they're scratching their heads going, why on earth are we working with an earlier stage startup rather than the likes of our big partners such as Crystrike, Palo, Zscale, or companies like that?
• 0:54
  SPEAKER_01: Robert Tyree has made that bet more than once.
• 0:58
  SPEAKER_01: He's been at big name companies as a leader, as a practitioner, and he's working with smaller companies now on the startup side as a fractional CISO.
• 1:11
  SPEAKER_01: His math at the time was what are you going to lose by working with a startup?
• 1:16
  SPEAKER_01: You know, there's ways to mitigate the risk by doing that.
• 1:19
  SPEAKER_01: Um, you're you're setting yourself back only a small amount of time if it doesn't go right, but there's so much to gain from it.
• 1:25
  SPEAKER_01: You know, he ran pen testing at a company called FNZ with a startup vendor that he then started working with.
• 1:32
  SPEAKER_01: Now he's the fractional CISO for companies in the mid-market, the ones that many of you salespeople or your sellers, if you're a leader, are actually calling on right now.
• 1:43
  SPEAKER_01: So in this episode, we talk about a bunch of things.
• 1:45
  SPEAKER_01: Three things specifically, what a small vendor gave him that the big names could in terms of capabilities, and what he wanted back from it to make it worthwhile internally.
• 1:57
  SPEAKER_01: The free trial he says a buyer can argue with, and the point where he'd want to cut it off, and what JP Morgan did with Fortify, and how he'd stop your best customers doing that to you.
• 2:11
  SPEAKER_01: So a lot to cover in this episode.
• 2:13
  SPEAKER_01: Here's Robbie.
• 2:24
  SPEAKER_01: Well, Robbie, welcome to the podcast.
• 2:27
  SPEAKER_01: Thank you, Andrew.
• 2:28
  SPEAKER_01: Pleased to be here.
• 2:29
  SPEAKER_01: I'm looking forward to this episode, not because, not just because you're a fellow Scott, uh, but also because we've got an interesting set of topics to go over today.
• 2:38
  SPEAKER_01: And just as a a bit of a coincidence, I'm actually in Scotland myself right now with my mom, so I'm I'm not my usual appetite over here.
• 2:45
  SPEAKER_00: You don't sound like a usual Scotland, to be fair.
• 2:48
  SPEAKER_00: You've been away too long, Andrew.
• 2:50
  SPEAKER_01: I'm in that weird spot where I kind of joke that my my accent is somewhere over the Atlantic, because you know, I'm in the US, people kind of recognize Scott.
• 2:59
  unknown: Yeah.
• 2:59
  SPEAKER_01: I come back here to Scotland and never look at me like, what the heck is he saying?
• 3:03
  SPEAKER_01: He's using words and accents.
• 3:05
  SPEAKER_00: You're the ideal person to be um interpreting to your uh viewers and listeners for of the podcast here when uh nobody can understand me, because that usually happens.
• 3:14
  SPEAKER_01: If I have to do subtitles afterwards, I will.
• 3:17
  SPEAKER_01: It's like the uh old episodes of Rhapsody Nesbit.
• 3:21
  SPEAKER_01: You need the subtitles for the English folk, not just the international folks.
• 3:25
  SPEAKER_00: I I I encourage everybody who's watching this podcast to look up Rap C Nesbit and educate yourself.
• 3:31
  SPEAKER_00: Link linked in the show notes.
• 3:34
  SPEAKER_01: All right, Robbie.
• 3:36
  SPEAKER_01: So, first of all, the most important thing we're gonna do today to start off with is we're gonna spin the wheel and we're gonna find out what the questions we're gonna ask later on in the episode are.
• 3:46
  SPEAKER_01: You ready for me to spin this wheel?
• 3:48
  SPEAKER_00: Yeah, cool for it.
• 3:50
  SPEAKER_01: All right, here we go.
• 3:56
  SPEAKER_01: All right, you're gonna be on the Cyber Donut hot seat.
• 3:59
  SPEAKER_01: Okay, this should be interesting, actually, because Cyber Donut was a fictional company we made up a couple of years ago.
• 4:05
  SPEAKER_01: It was a startup.
• 4:06
  SPEAKER_01: It was trying to get to$10 million in revenue at the time, and we had this whole thing over the year that we worked on.
• 4:12
  SPEAKER_01: So we're revisiting Cyber Donut.
• 4:14
  SPEAKER_01: But interestingly enough, for it from your angle, which is not going to be on the necessarily on the revenue side, but it's gonna be on the on a different perspective from the security side.
• 4:24
  SPEAKER_01: So I'll be interested to see how that goes.
• 4:26
  SPEAKER_01: But uh for now, let's put that to one side and let's come back to that later on in our episode.
• 4:32
  SPEAKER_01: So, Robbie, you you right now you're a fractional CESO, but years ago, you started working with startups when you were a practitioner uh here in the UK.
• 4:43
  SPEAKER_01: Why don't you take us back to those early days of starting to work with startups, trying to work with them?
• 4:48
  SPEAKER_01: What were you trying to achieve and and what were your experiences early on?
• 4:51
  SPEAKER_00: So it wasn't actually that long ago.
• 4:54
  SPEAKER_00: Um I I worked for a cybersecurity company that predominantly did penetration testing out in New York, and their market was startups, mostly startups.
• 5:04
  SPEAKER_00: They've they've moved on since then quite quickly.
• 5:07
  SPEAKER_00: But yeah, it was I was trying to help startups get an a good understanding of where they were from a cybersecurity aspect.
• 5:15
  SPEAKER_00: That usually meant let's run a pen test, right?
• 5:18
  SPEAKER_00: Which is to be looking back on it, it's not ideal, but it does give you a good ground from a technical perspective of where you actually are.
• 5:26
  SPEAKER_00: Doesn't answer a lot of the questions though that's actually needed, like risk ownership, etc.
• 5:30
  SPEAKER_00: What do I do in the event of an incident?
• 5:32
  SPEAKER_00: It just tells you where your gaps are and your your infrastructure and what controls need, what technical controls need put in place.
• 5:39
  SPEAKER_00: Particularly handy if you're a startup developing software, SaaS, SAS solutions, because there's uh startups usually have a lot of change, a lot of new features on on the on the software, and vulnerabilities get introduced left, right, and centre.
• 5:56
  SPEAKER_00: So having a pen test or regular pen tests was a a good thing to do from a cyber perspective, so you know exactly where you stood from trying to protect yourself from the bad guys.
• 6:08
  SPEAKER_01: What was it that caused them to say now is the time to start doing this as opposed to three months or six months previously?
• 6:15
  SPEAKER_00: Oh, many factors, right?
• 6:17
  SPEAKER_00: And it's it's the case when when I'm speaking to prospective clients as well.
• 6:23
  SPEAKER_00: There's there's many factors.
• 6:25
  SPEAKER_00: One is they've had a cyber event, obviously, and they want to be more secure going forward.
• 6:29
  SPEAKER_00: Two, if they need to be compliant for different regulations, regulatories, whatever, to satisfy their clients, to show, to give them some sort of certificate to say, hey, we're secure, you can trust us with your data.
• 6:43
  SPEAKER_00: Or basically trying to get funding is another one.
• 6:46
  SPEAKER_00: So if they're going out and looking at venture capitalists, etc., and going to the banks and trying to get more funding, they're wanting to make sure that what you're doing's secure and their their product, their investment's going to be secure as well.
• 6:59
  SPEAKER_00: So there's there is many different factors, but that's usually where we've seen was the in the most cases, particularly in the finance industry, I would say, you've got to provide evidence that you're developing secure tools or you yourself are secure before they'll do business with you.
• 7:15
  SPEAKER_01: Yeah, my experience working at startups is they often don't take security all that seriously, even in the cybersecurity world, until they have to.
• 7:25
  SPEAKER_01: And it's often when you're starting to fill in those questionnaires from those big banks or big companies, like, oh, we've got to have a policy for passwords.
• 7:33
  SPEAKER_00: Exactly.
• 7:34
  SPEAKER_00: Yeah.
• 7:34
  SPEAKER_00: Well, interestingly, but the the trend that I'm seeing nowadays with the startups that uh that are actually growing, to say I've got between 50 and 200 employees, it's usually still the CTO that's responsible for security.
• 7:47
  SPEAKER_00: And then they get overwhelmed with it, and then that's when they give me a phone call and they say, Can we get some support?
• 7:53
  SPEAKER_00: But yeah, that seems to be the case.
• 7:55
  SPEAKER_00: It's when the CTO seems has had a has got too much on their point that they start needing to do something about it.
• 8:02
  SPEAKER_00: They'll take security seriously at that point.
• 8:04
  SPEAKER_00: But you've got to be delicate because there is investment that's required for security, and I think it's good that it's a lot of companies are recognising that it's a separate function because it's got its own skill sets, it's got its own challenges, other than what a CTO does or an engineering team, for example.
• 8:21
  SPEAKER_00: And I think covering that separation of duties is quite key for a business to grow.
• 8:26
  SPEAKER_01: When you go into these companies, let's say, and they they for whatever reason they feel like they've got to spend some money, you know, create the program.
• 8:34
  SPEAKER_01: What are you sensing their appetite is to truly invest?
• 8:37
  SPEAKER_01: Is it what's the minimum we have to do?
• 8:39
  SPEAKER_01: What's the right thing we have to do?
• 8:41
  SPEAKER_01: What's their mindset?
• 8:42
  SPEAKER_00: It really depends where they are on their journey, wherever they they want to be.
• 8:45
  SPEAKER_00: I mean, if they're if they've got a large investment, then obviously the the budget's going to be better.
• 8:51
  SPEAKER_00: But it's it's trying to explain to them that cyber, good cybersecurity is an enabler for business growth rather than just a bolt-on function that's another internal business operation with its own cost centre, right?
• 9:04
  SPEAKER_00: Because that can be the case in a lot of places.
• 9:06
  SPEAKER_00: However, if companies are starting to recognise that it is an enabler for getting new business in.
• 9:12
  SPEAKER_00: If you can say that you're compliant to various regulations and you've got SOP2, ISO 27,000 one, Cyber Essentials, whatever, you're looking good.
• 9:21
  SPEAKER_00: You're looking good to go to new clients because then they can trust you with their data sets or their operations or whatever it is that you're trying to sell them.
• 9:30
  SPEAKER_00: So I try and look at it as uh as a business enabler.
• 9:33
  SPEAKER_00: That makes the conversation easier about how much they need to spend.
• 9:36
  SPEAKER_00: I would say that there should be a a minimum baseline.
• 9:40
  SPEAKER_00: I try to get all my clients on a minimum baseline where they should be, what for what looks good.
• 9:45
  SPEAKER_00: Obviously, there's what looks better than good, but having them in a good position, it doesn't actually cost a lot of money.
• 9:52
  SPEAKER_00: It's it's getting the basics right, like who owns who owns such and such, do you have a software inventory?
• 9:59
  SPEAKER_00: Are you are you are you patching regularly?
• 10:02
  SPEAKER_00: Do you have endpoint detection on?
• 10:04
  SPEAKER_00: Are you have you got good identity and access management?
• 10:08
  SPEAKER_00: Are you stopping things like plugging in USBs, that sort of thing?
• 10:12
  SPEAKER_00: Have you got a password policy that you mentioned, Andrew, earlier?
• 10:14
  SPEAKER_00: Yeah.
• 10:15
  SPEAKER_00: It's it's having the basics right.
• 10:17
  SPEAKER_00: And to be honest with you, that doesn't cost a lot of money.
• 10:19
  SPEAKER_01: Is it quite fast to get to a minimum level?
• 10:22
  SPEAKER_00: Oh yeah.
• 10:23
  SPEAKER_00: Uh yeah, you uh really it takes what about one to two months, I would say.
• 10:28
  SPEAKER_00: If you're going aggressively, I'll caveat that and say that you need to have support from the organization that you're working with.
• 10:36
  SPEAKER_00: Typically, that means the CTO or the head engineering, or they allocate someday to actually enable you to put all everything in place.
• 10:45
  SPEAKER_00: But it's it's usually quite quick to get things in place, and then it's a case of managing it from there.
• 10:50
  SPEAKER_00: That's the tricky part.
• 10:51
  SPEAKER_00: A lot of people forget you usually just put the baseline in and say, thanks very much.
• 10:55
  SPEAKER_00: You walk off the park six months later, you'll get another phone call.
• 10:58
  SPEAKER_00: Yeah, there's drift, right?
• 11:00
  SPEAKER_00: Yeah, it's drift, exactly.
• 11:01
  SPEAKER_00: There is drift.
• 11:02
  SPEAKER_00: Typically, what I usually see is that around patching.
• 11:05
  SPEAKER_00: Because that's quite a it can be a significant, well, not a significant, but it can be an overhead on companies to do patching, particularly if you're if you're working in in a software house where you've got to keep library files updated, for example.
• 11:18
  SPEAKER_01: It's funny what you're saying before about uh uh being a business enabler.
• 11:22
  SPEAKER_01: I think it was the founder of Vanta who said that she realized after a bit of time that she wasn't in the business of certifications, things like that.
• 11:31
  SPEAKER_01: She was in the business of sales enablement.
• 11:33
  SPEAKER_00: Yeah.
• 11:34
  SPEAKER_00: Yeah, it's it is important.
• 11:36
  SPEAKER_00: It's important to stress that it is a business enabler.
• 11:39
  SPEAKER_00: It's too easy for it to become a back office function and a cost center.
• 11:44
  SPEAKER_00: But if companies take cybersecurity seriously, then it can not only get you new business, but simple facts are it can protect yourself from getting from losing money as well.
• 11:55
  SPEAKER_00: So it's it's good to see that more and more organizations at the the startup level are actually taking it seriously, which is great, it's great for our industry, to be honest.
• 12:06
  SPEAKER_01: Yeah.
• 12:07
  SPEAKER_01: If you look at your career, Robbie, going back, you've always been in the role where you've purchased software from big big vendors, but also small vendors from you know startups.
• 12:19
  SPEAKER_01: How would you back in the day think about that in terms of okay, do it do I go with the big name or do I try and find the startup that I should be working with in this one area?
• 12:29
  SPEAKER_00: It's a great question.
• 12:30
  SPEAKER_00: So I've worked at some very, very large organizations wherever I actually have taken risks and went with smaller vendors, startups, right?
• 12:38
  SPEAKER_00: One of them was the Pentest company that I went to be their CTO.
• 12:42
  SPEAKER_00: They were new on the block, but gave me an opportunity to work with the vendor to build the tool around my requirements rather than an off-the-shelf package from a bigger player.
• 12:53
  SPEAKER_00: And it also meant that you had, I felt you got better support from the smaller vendors.
• 12:58
  SPEAKER_00: They treated you more on the human level, they could react faster in 99% of the cases.
• 13:04
  SPEAKER_00: And you know what?
• 13:05
  SPEAKER_00: At the end of the day, you got a better deal as well.
• 13:07
  SPEAKER_00: So, like the crowd strikes, Qualis, etc., there are hundreds of thousands of dollars, right?
• 13:13
  SPEAKER_00: I mean, every for a large organization, you'll be surprised that smaller vendors can actually provide a better service, but you've got to work with them.
• 13:22
  SPEAKER_00: However, it's in your benefit because you can then define the tools and what goes what gets built into the tool and the roadmap to meet your needs.
• 13:30
  SPEAKER_01: You said you you've got to work with them.
• 13:32
  SPEAKER_01: What does that mean?
• 13:33
  SPEAKER_01: Like, what does a cadence look like?
• 13:35
  SPEAKER_01: What's the interaction you're looking for?
• 13:37
  SPEAKER_00: Yeah, uh there is a bit of effort on both sides, but it can be worth it.
• 13:41
  SPEAKER_00: So I would say at least at least quarterly meetings to discuss what went well, what could be done better, what their roadmap looks like, what your priorities are.
• 13:53
  SPEAKER_00: I think a lot of larger organizations miss a trick.
• 13:56
  SPEAKER_00: I mean, I used to talk about partnerships with vendors, and I felt it was important to build partnerships with vendors, and 99% of the cases you do that with their account manager.
• 14:05
  SPEAKER_00: If you're working with the smaller vendors, you get to know the CEO, you get to know the head of development, you get to know the head of customer operations, etc.
• 14:14
  SPEAKER_00: You can work across the organization to make sure that your requirements are being met properly rather than just dealing with account manager who's got several accounts that they're trying to juggle and you're just a bit of park player, no matter how big you are.
• 14:27
  SPEAKER_01: It's not a risk to make that that jump.
• 14:29
  SPEAKER_01: I mean, if you're a bigger company, what what's the how do you mitigate that risk, right?
• 14:34
  SPEAKER_01: What's your process to go through to say, okay, I know there's a risk, but here's some things I've done to know that it's worthwhile taking this risk.
• 14:42
  SPEAKER_00: Yeah, I'll mention the word again, right?
• 14:44
  SPEAKER_00: It's having a baseline of what's actually acceptable, right?
• 14:47
  SPEAKER_00: Um you can't compare apples to bananas about like you had a tool beforehand that did X, Y, and Z.
• 14:53
  SPEAKER_00: You're now now gone with another vendor because you don't want X, Y, and Z unless you're purely looking to save money, which is which is good, but it shouldn't be the way you look at things.
• 15:02
  SPEAKER_00: You want to make sure that you've got the capability that that you're looking for, right?
• 15:06
  SPEAKER_00: So it's you can't compare apples to apples in this case, right?
• 15:10
  SPEAKER_00: But it's having a baseline of what's acceptable to you and making sure that both parties agree on that and and there's get out causes if they don't meet it.
• 15:19
  SPEAKER_00: And it's also having things like there's plenty of open source tools available.
• 15:23
  SPEAKER_00: You can have just use an open source tool that runs concurrently in the background as well until you're satisfied that that new tool is up and running to where you want it to be.
• 15:32
  SPEAKER_00: You can do little things like that.
• 15:34
  SPEAKER_00: Yes, there's overhead on it, but it's worth it at the end of the day.
• 15:37
  SPEAKER_01: I'm wondering if there's any examples that you can give where this actually worked out quite well for you.
• 15:43
  SPEAKER_01: I don't know if company names can be mentioned or categories, something like that.
• 15:47
  SPEAKER_00: Yeah, I mean definitely.
• 15:48
  SPEAKER_00: So it was it was OSIC who, while I was at FNZ, ran the whole pen testing function for that company.
• 15:54
  SPEAKER_00: Now, FNZ had over 100 clients in the wealth management space.
• 15:59
  SPEAKER_00: They ran continuous testing against all these clients.
• 16:03
  SPEAKER_00: And it worked because the clients got to know the vendor as well.
• 16:07
  SPEAKER_00: Uh the clients could, they had their own requirements above and beyond what I had, and they could then also work with the vendor and make sure that specific reports contained information that they wanted.
• 16:17
  SPEAKER_00: Like uh there was one client who had wanted another uh six specific tests actually called out in the report.
• 16:25
  SPEAKER_00: I think it was six.
• 16:27
  SPEAKER_00: It was called misuse case testing, and that wasn't part of the core product offering, but the vendor OSEC enabled that for that particular client, which gave a lot of kudos, not only not only to to me running that that entire team, but also OSEC itself.
• 16:44
  SPEAKER_00: And it showed the capability from OSEC's side that they could they could do things on an ad hoc basis as well, which helped them going forward too.
• 16:53
  SPEAKER_01: One of the things I would be worried about if I'm a startup, I think, is getting over-reliant on the feedback from a small number of companies and then finding out that really what I've done is built custom software for for a few companies and it's not really applicable to the market.
• 17:07
  SPEAKER_01: Any advice about how to how to mitigate against that?
• 17:10
  SPEAKER_00: Uh it is a good question, right?
• 17:12
  SPEAKER_00: But as Andrew, see at the end of the day, every customer's got a different set of requirements, right?
• 17:16
  SPEAKER_00: There's hardly ever anything off the shelf that works for everybody.
• 17:20
  SPEAKER_00: Let's face it, it doesn't matter what application you're using in any c any situation at all.
• 17:27
  SPEAKER_00: Like, I I'll guarantee you, Amazon doesn't work for everybody.
• 17:30
  SPEAKER_00: There's there's there's functions that that people would would like to see added.
• 17:34
  SPEAKER_00: I think if there's the ability to have a feedback loop between the client and the vendor, and you've got a good customer service, there's opportunities for for all users to get their their functionality added or even customized functionality added if if a particular client's looking for it, but not there's there's not one off-the-shelf solution fit for fits for everybody.
• 17:58
  SPEAKER_01: Yeah, I think let's let's turn this around a little bit.
• 18:01
  SPEAKER_01: So let's say you were approached by the founder of a new cybersecurity company that got two or three early adopters design partners, but you know, one of your clients is interested.
• 18:11
  SPEAKER_01: How would you coach that that founder to engage with you know mid-sized companies as more early adopter clients?
• 18:20
  SPEAKER_00: I think it's just speaking from my experience, right?
• 18:22
  SPEAKER_00: I mean, I've just spoken about what I did with with OSIC and what the benefits were from there.
• 18:27
  SPEAKER_00: It's trying to convince them that taking a risk, but uh uh it's it's a risk that you can calculate, a calculated risk, right?
• 18:35
  SPEAKER_00: Based on what you're actually trying to get out of it and looking at the cost benefits as well.
• 18:39
  SPEAKER_00: What and what nine 99% of the time uh vendors will do it for free for an initial period as well, so you can get a trial and it's going to be a proper trial as well, and in a lot of cases.
• 18:50
  SPEAKER_00: So is the risk really there at the end of the day?
• 18:53
  SPEAKER_00: What are you going to lose?
• 18:54
  SPEAKER_00: A couple of months time putting some effort in at your side for what?
• 18:58
  SPEAKER_01: So they need to convince the the potential adopter.
• 19:01
  SPEAKER_01: Look, there's not much, not as much risk as you think there is, right?
• 19:04
  SPEAKER_01: You know, really what's the downside to this?
• 19:07
  SPEAKER_00: Yeah, it's exactly that, right?
• 19:08
  SPEAKER_00: And there's going to be a cost benefit, right?
• 19:10
  SPEAKER_00: Definitely, otherwise, you would just renew your existing software.
• 19:13
  SPEAKER_00: There will be a cost benefit to it, but there's also a benefit to the organization as well by you being able to get bespoke things added in that are unique to you rather than what's available off the shelf or with your current vendor.
• 19:26
  SPEAKER_00: And if it's a big vendor and you're asking for a feature, they'll probably turn around and say one of two things.
• 19:32
  SPEAKER_00: First thing is no, or yes, that'll cost a hundred thousand dollars and we'll have it delivered in six months.
• 19:38
  SPEAKER_01: Yeah, it's funny, it's funny that time frames are interesting things for people, right?
• 19:42
  SPEAKER_01: What when someone thinks it's fast might not be the next person's view of what fast is as well.
• 19:47
  SPEAKER_00: Yeah.
• 19:48
  SPEAKER_01: If let's change this up again a little bit, Robbie, here.
• 19:50
  SPEAKER_01: One of the challenges that I think a lot of startups have is, you know, they've got their first, let's say, five to ten customers.
• 19:58
  SPEAKER_01: They've done it by, you know, CEO instructions, investor instructions, things like that.
• 20:03
  SPEAKER_01: But now they're in the mode of saying, okay, we need to scale.
• 20:07
  SPEAKER_01: But it's really hard to get into have meaningful conversations with prospects these days for 95%, 98% of the startups out there.
• 20:17
  SPEAKER_01: I'm wondering in your experience, what's changed recently or's changed in the last five years that maybe a startup might be or should be thinking differently about how they engage with prospects, how they open up doors at prospects.
• 20:32
  SPEAKER_01: Are you trying to get on the subject to AI here?
• 20:35
  SPEAKER_01: Might be.
• 20:36
  SPEAKER_01: I don't know.
• 20:37
  SPEAKER_01: I don't know.
• 20:37
  SPEAKER_01: I feel like uh the traditional model was let's send emails, let's make cold calls, you know, things like that, right?
• 20:46
  SPEAKER_01: And it wasn't all that customized, it wasn't all that intelligently done.
• 20:50
  SPEAKER_01: I was part of that world.
• 20:51
  SPEAKER_01: That's what I used to do.
• 20:52
  SPEAKER_01: I feel like these days it's it's way overdone though.
• 20:55
  SPEAKER_01: So I'm wondering what you're seeing as alternative ways to get in there.
• 20:59
  SPEAKER_00: Look, nothing beats face-to-face interaction with people, right?
• 21:03
  SPEAKER_00: There's nothing does, right?
• 21:04
  SPEAKER_00: There's the the usual suspects, trade shows, but what buyers aren't going to trade shows these days.
• 21:10
  SPEAKER_00: I don't know if you've seen that as well, Andrew, but I think CEOs are getting really jaded with them because all they get is like business card after business card and then hundred follow-up phone calls.
• 21:19
  SPEAKER_00: I'm not seeing buyers go to trade shows at all.
• 21:22
  SPEAKER_00: It's good for people like myself who wants to keep abreast of what's going on in the market, but I would say it's not a good place to actually do business unless you're doing business with MSPs or trying to set up partnerships.
• 21:35
  SPEAKER_00: What I am seeing more of is startups actually creating their own events and attracting people that way.
• 21:42
  SPEAKER_00: And that look, that can be something as simple as lots of drinks and a pub somewhere, right?
• 21:46
  SPEAKER_00: And inviting people, dinners, etc., to I don't know, taking people to a Grand Prix, football, things like that, right?
• 21:53
  SPEAKER_00: There's there's more of that happening, and that's good for meeting people face to face in a relaxed atmosphere where you can actually then start talking business a bit more comfortably, the less formal.
• 22:04
  SPEAKER_00: There's there's a whole AI thing as well, that's happening.
• 22:07
  SPEAKER_00: You can use AI to do reach out, right?
• 22:11
  SPEAKER_00: And it'll do it instantaneously as well, and it'll mimic you and your company and what you're doing.
• 22:16
  SPEAKER_00: And it's it's great if you want to like if you if you've not got the capability to do cold calls yourself, AI can generate that for you.
• 22:24
  SPEAKER_00: But I'll stand by it that there's nothing better than meeting people face to face and building relationships.
• 22:31
  SPEAKER_00: Yeah, it can take time.
• 22:32
  SPEAKER_00: But you'll get better conversations.
• 22:34
  SPEAKER_00: And you're only really needing that one or two to actually kick off.
• 22:38
  SPEAKER_00: And to be fair, Andrew, right, you need to have a good product at the end of the day.
• 22:41
  SPEAKER_00: You really do.
• 22:42
  SPEAKER_01: Yeah, I feel like uh one of my things I've been wrestling with in my mind for the last six months is in this in this age of AI, suddenly the more human things stand out.
• 22:53
  SPEAKER_01: Because I think to your point, I think a lot of people default to let me just play the volume game, throw an AI something at something, and you know, hopefully something sticks out there.
• 23:03
  SPEAKER_01: Whereas I think those that try and be more human, connect one-to-one, you know, things like that, they're the ones that are going to win out in the end.
• 23:10
  SPEAKER_00: Well, yeah, it's and it's built, it's building a brand as well, right?
• 23:13
  SPEAKER_00: And I I mean everybody's I mean, there's a lot of startups in the market.
• 23:16
  SPEAKER_00: There's a lot of AI startups in the market.
• 23:19
  SPEAKER_00: There's a lot of fact you'll you'll hardly ever find a company these days who's got a SARS product that doesn't have AI, some sort of AI capability, a chatbot, whatever, right?
• 23:28
  SPEAKER_00: Uh AI is out there all the time, but it's all about building your brand and doing it on a a method that you're going to get the best response from.
• 23:34
  SPEAKER_00: And I don't think that is AI because it's it's cold, it's not human.
• 23:39
  SPEAKER_00: So yeah, that's definitely ways to engage with your market without using AI.
• 23:46
  SPEAKER_00: And I think the people who do that get appreciated more.
• 23:49
  SPEAKER_01: You said uh trade shows, you were kind of mocking them a little bit.
• 23:52
  SPEAKER_01: What do you mean by trade show?
• 23:53
  SPEAKER_01: Do you mean like InfoSec or or RSA or InfoSec, RSA, that sort of thing, yeah.
• 23:59
  SPEAKER_01: Yeah.
• 23:59
  unknown: Okay.
• 24:00
  SPEAKER_01: Yeah, if if I uh I'm trying to remember the exact numbers, but I think at Black Hat this year, they were talking about having 400 vendors there, I think.
• 24:10
  SPEAKER_01: Now, 400 vendors is still only 10% of the total number of cybersecurity vendors for one.
• 24:16
  SPEAKER_01: And they're in that big hall, and it's you know, same words in a different order is what you what you what you hear, what you see often.
• 24:24
  SPEAKER_01: There's always exceptions I know do very well, but many, many don't, unfortunately.
• 24:29
  SPEAKER_01: So if we're not going to do those things, and let's say we've done the state dinners and the football games, things like that, what else?
• 24:34
  SPEAKER_01: What other ideas do you have for people to say, here's some things you should at least try?
• 24:38
  SPEAKER_01: It might not be the silver bullet, but here's something that worth worth trying.
• 24:41
  SPEAKER_00: I think well, free trials is free trials if if you're if it's a software company, right?
• 24:47
  SPEAKER_00: You have free trials is a is a way to go, but actually do it in a managed way, don't have it running for months, say two-week free trial, month maximum, with engagement throughout it.
• 25:00
  SPEAKER_00: So actually doing a like a mini case study for that particular client is a is probably a good way to go about it, because then you can prove your product quite easily, and there's there's no risk from we talk we talked about risk from the client's aspect earlier.
• 25:15
  SPEAKER_00: There's no risk doing it that way.
• 25:16
  SPEAKER_00: The only downside is there's a cost element to the vendor and the time it for the time that the the client's got to put into it, but it's getting in front of the client in the first place, it's a tricky bit.
• 25:27
  SPEAKER_00: Yeah.
• 25:28
  SPEAKER_00: But networking, partnering with MSPs, you'll be surprised using your own networking to get introductions to other people is is probably a good starting point as well.
• 25:39
  SPEAKER_01: If you were partnering with AI security company, I'm wondering if you got any thoughts on not starting with the security team, for example, saying, okay, AI is enabling the business, why don't we get taught to the business?
• 25:54
  SPEAKER_01: Do you think that would be uh something worth trying, or would it just annoy the the security team that you're going around them is what they might feel like?
• 26:01
  SPEAKER_00: I've actually done that approach in the past.
• 26:04
  SPEAKER_00: And yes, it does annoy the security team because it can make them look bad.
• 26:09
  SPEAKER_00: You've got to be careful with that because at the end of the day, they've got to be your stakeholders, your main stakeholder in the organization.
• 26:15
  SPEAKER_00: So you want to get off on a good foot, you've got to be pretty confident that the relationship you've got with the, and I'll be honest with you, if you've got to the business, it's probably chief operating officer because they know everything that's going on in the business in the business.
• 26:27
  SPEAKER_00: They're the ideal candidate if you can get a hold of them to actually have that conversation with.
• 26:32
  SPEAKER_00: And do you know what?
• 26:33
  SPEAKER_00: They'll be up for it.
• 26:34
  SPEAKER_00: They'll they'll be up for doing it because they're interested in what the technical, the technological side of the company is up to as well.
• 26:41
  SPEAKER_00: They want to make sure that they're doing their job properly.
• 26:43
  SPEAKER_00: So the chief operating officer is probably the right person to approach.
• 26:47
  SPEAKER_00: But you've got to be careful how you manage it.
• 26:50
  SPEAKER_01: Right, you've got to have the right message, right?
• 26:52
  SPEAKER_01: I would imagine.
• 26:53
  SPEAKER_01: You can't be, you know, all security teams are missing the stuff, you know.
• 26:58
  SPEAKER_01: So how do we go about let's let's think out loud here, how we go about trying to get in touch with the CEO then?
• 27:04
  SPEAKER_01: I mean, we could use traditional methods, but any other ideas what we could do?
• 27:08
  SPEAKER_00: Um you could it's just the traditional methods is just like, well, check your connections on LinkedIn.
• 27:15
  SPEAKER_00: I mean, you you get to know who this the chief operating officer is, the CEO.
• 27:19
  SPEAKER_00: You can use your connections to get an introduction, that sort of thing.
• 27:23
  SPEAKER_00: It's just, I don't think there's a silver bullet here, Andrew, to be brutally honest, or everybody would be doing it.
• 27:28
  SPEAKER_00: I mean, you tell me I've got my own business.
• 27:30
  SPEAKER_00: I'd like to speak to all the C the COs at the icon, but I only know so many.
• 27:35
  SPEAKER_01: So Yeah, I think in it's funny, I got a I've got a friend who he started up his his business recently where he was doing, like like some are doing, AI consulting for medium-sized, small, small businesses, right?
• 27:48
  SPEAKER_01: So yeah, how do you go and do stuff like that?
• 27:51
  SPEAKER_01: And he didn't go, I believe, to even the technology teams often at these companies.
• 27:57
  SPEAKER_01: He went to the business side.
• 27:59
  SPEAKER_01: And what he was doing, I think, was he was going through like local business groups, you know, and he would he would do presentations or whatever, breakfast, you know, whatever it was, right, to get in front of people.
• 28:11
  SPEAKER_01: And he wouldn't talk necessarily about the technology, but he would talk about, you know, ways to get going, approaches, things like that.
• 28:18
  SPEAKER_01: And they were he was perceived to be the expert.
• 28:20
  SPEAKER_01: I wonder if there's something similar on the security side, or if you're a sales rep.
• 28:25
  SPEAKER_00: Yeah, I have done that.
• 28:26
  SPEAKER_00: I have partnered with my uh local chamber of commerce, but I have given I have given a talk.
• 28:31
  SPEAKER_00: I got some business on the back of that with a chief executive officer of a company who came along to listen to me.
• 28:37
  SPEAKER_00: And then, yeah, as time goes on, over time, you become known as the the cyber guy, right?
• 28:43
  SPEAKER_00: And that does open doors, but you've got to make sure that the audience is the right audience that you're speaking to as well.
• 28:50
  SPEAKER_00: I mean, there's like things like a chamber of commerce that's got plumbers in it and it's got estate agents, and it's not your market, do you know what I mean?
• 28:58
  SPEAKER_00: Um but yeah, it it but everybody knows somebody in there.
• 29:01
  SPEAKER_00: I actually I was speaking to somebody and um Royal Bank of Scotland actually have got a have got a business group and they meet up, I think it's monthly, but it was interesting because somebody went there and it was full of it was full of older women, right?
• 29:17
  SPEAKER_00: And somebody described it as our knitting club, right?
• 29:20
  SPEAKER_00: But they say to me, it was brilliant because you got speaking to these women, and it turns out the majority of them were wives and husbands who owned massive companies, and you got an introduction that way.
• 29:32
  SPEAKER_00: And I was like, oh, well, that's interesting.
• 29:34
  SPEAKER_00: Why am I not going to that?
• 29:36
  SPEAKER_00: But yeah, it was it was it's just bizarre that there was this networking group of full of women who were either had their own business or were married for people who had their own business that you wanted to speak to.
• 29:47
  SPEAKER_01: Interesting.
• 29:48
  SPEAKER_01: So I wonder in in our world in cyber what what those equivalents are and where you find them, right?
• 29:52
  SPEAKER_01: I mean, I I always hear from people, oh, yeah, we've got our Slack community and it's just full of you know security leaders and no vendors will ever, you know, which I totally get.
• 30:00
  SPEAKER_01: But there must be creative ways that we can think about, you know, not just going to the reseller event, not just going to the local ISACA or or ISSA event, but something else, right?
• 30:12
  SPEAKER_01: That's more on the business side.
• 30:14
  SPEAKER_00: Yeah.
• 30:14
  SPEAKER_00: I'm going to OWASP, OWASP Scotland is next week.
• 30:17
  SPEAKER_00: So I'm going to that, see what, see what that's like.
• 30:20
  SPEAKER_00: The universities are a good one to partner with.
• 30:23
  SPEAKER_00: So I partner with Tayside University.
• 30:25
  SPEAKER_00: I'm giving a talk there next month, actually, later this month, actually.
• 30:29
  SPEAKER_00: And you'll find that they get sponsored by various companies.
• 30:33
  SPEAKER_00: Now they'll attend, they'll attend these these meetups.
• 30:36
  SPEAKER_00: So there's opportunities for you to speak to big companies who are sponsoring the smaller events.
• 30:41
  SPEAKER_00: You can then try and get a good introduction and a follow-up meeting after afterwards through that.
• 30:46
  SPEAKER_01: Yeah, yeah.
• 30:47
  SPEAKER_01: Robbie, have you got any experiences of companies who hire field CISOs?
• 30:55
  SPEAKER_01: Right?
• 30:56
  SPEAKER_01: They have the the, I don't know, former CISOs or former security leaders who go join the vendor and they're essentially an ad you know an evangelist for the company out there at these types of events.
• 31:05
  SPEAKER_01: Have you got any experience of doing that or or seeing that work?
• 31:08
  SPEAKER_00: So I do it with a couple of MSPs that I partner with.
• 31:11
  SPEAKER_00: So they bring me in as a as their sort of CISO under a white label.
• 31:15
  SPEAKER_00: So yes, yes, I do.
• 31:18
  SPEAKER_00: Does work definitely as a as a good a good idea, but unfortunately, in the majority of cases, they're tied to the MSPs who have got their own products to sell.
• 31:28
  SPEAKER_00: So unless you're partnering with them, you've kind of had it because it's a closed, it's a close book of what you're allowed to buy.
• 31:34
  SPEAKER_01: Yeah.
• 31:35
  SPEAKER_01: If I was let's say going back to my example, right?
• 31:38
  SPEAKER_01: The founder approaches you for advice on various things, and they said, you know, we've got, let's say, five people, eight people in the sales team right now, but we're gonna go hire two field CISOs.
• 31:48
  SPEAKER_01: We're gonna, we're not gonna add more codecarrying reps, we're gonna get people who can out there go out there and evangelize for us.
• 31:54
  SPEAKER_01: Would you say that's a good move, or do you think that's a bit too aggressive?
• 31:58
  SPEAKER_01: Two people doing that?
• 31:59
  SPEAKER_01: What would you say?
• 32:00
  SPEAKER_00: I think one's enough, right?
• 32:02
  SPEAKER_00: Because it can get confusing after that, because you're representing that organization as their field CISO if you've got more than one.
• 32:09
  SPEAKER_00: It's like it can get a bit awkward.
• 32:11
  SPEAKER_00: But it brings it just it you've got the same problem that you can only the company that the field season was talking to can only buy products from the company that the field CSW's working from.
• 32:23
  SPEAKER_00: Do you know what I mean?
• 32:24
  SPEAKER_00: That's the problem, and that's kind of it's difficult then for new vendors to get into that to to get in front of the client at that point.
• 32:33
  SPEAKER_01: Yeah.
• 32:34
  SPEAKER_01: You mentioned before you're doing a lot of AI governance work right now.
• 32:37
  SPEAKER_01: Is that what people are coming saying we need to do so you need someone who's done this before?
• 32:42
  SPEAKER_00: Too much AI governance.
• 32:44
  SPEAKER_00: I can't understand.
• 32:44
  SPEAKER_00: I think I was saying to you beforehand, I can't understand why everybody's just wanted an AI governance review at the moment.
• 32:50
  SPEAKER_00: It's just the world has just exploded, which is what it's great, right?
• 32:54
  SPEAKER_00: I'm not complaining, I just don't understand why AI's been about for years, but all of a sudden everybody's now realizing that hey, we've got some issues, we need to get a review done.
• 33:03
  SPEAKER_00: Look, maybe it's the new EU regulation that's came about, maybe it's people realising that AI has just been out in the wild too long and they now need to control it, which I think I'd like to hope is the case, rather rather than them having to meet a new regulation.
• 33:18
  SPEAKER_00: But but yeah, look, my my business is doing a lot of uh AI governance reviews at the moment.
• 33:24
  SPEAKER_00: And it's it's not much different than doing a security review.
• 33:28
  SPEAKER_00: It's like, well, who owns the AI data?
• 33:30
  SPEAKER_00: What what are what are you actually using AI for?
• 33:34
  SPEAKER_00: What personal data is going through it, where are you storing it, etc.
• 33:37
  SPEAKER_00: This sort of thing.
• 33:38
  SPEAKER_00: What's your rulesets look like?
• 33:40
  SPEAKER_00: Do you have a policy?
• 33:41
  SPEAKER_00: It's all basic stuff that that companies do not have.
• 33:45
  SPEAKER_00: It's good.
• 33:46
  SPEAKER_00: I I think it's it's needed in the industry, and I think this is going to be a new industry on its own.
• 33:53
  SPEAKER_00: And then next year, if I can see it going that way already, to be fair.
• 33:56
  SPEAKER_01: And what are you finding out there?
• 33:58
  SPEAKER_01: Well, I mean, that's a different way.
• 34:00
  SPEAKER_01: What I've heard is a lot of people, security people feel like the trains left the station, is what they say.
• 34:06
  SPEAKER_01: The business has gone off and just said, just do this.
• 34:09
  SPEAKER_01: And suddenly they're standing there going, well, what you know, let's do it sensibly.
• 34:13
  SPEAKER_00: Yeah, so so let's simplify it.
• 34:16
  SPEAKER_00: So companies have been using AI tools to enable them to do business functions faster, cheaper, right?
• 34:23
  SPEAKER_00: And they've been cutting back on a lot of human stuff, right?
• 34:26
  SPEAKER_00: If we like it or not, that's just the way the world's gone, right?
• 34:29
  SPEAKER_00: But the AI tools have started to become so embedded in organizations that nobody's controlling it.
• 34:35
  SPEAKER_00: And the train has left the station.
• 34:37
  SPEAKER_00: In the majority of cases, client data's been, or I'll give you an example, right?
• 34:42
  SPEAKER_00: I came across an organization, I won't name names, but they were um using customer application forums with data, financial data on it, personal PII information on it.
• 34:52
  SPEAKER_00: And they were just putting this into chat GPT to run a summary of it that then they could then dump into your spreadsheet.
• 34:59
  SPEAKER_00: And then that's that's the data it's in the weld now, right?
• 35:01
  SPEAKER_00: You can't that it it's left the station, you you can't get that back.
• 35:05
  SPEAKER_00: So there has to be controls put in place.
• 35:08
  SPEAKER_00: Now, there's two ways that you can put controls in place that I've been recommending.
• 35:11
  SPEAKER_00: One's an MSP server, which is a rules engine, which is a bit of modelware where all commands from all AI chatbots, whatever, goes into this, and the rule says yes, that's allowed, or no, that's not allowed, and the company configures the rules.
• 35:26
  SPEAKER_00: The other way that I've been recommending, you might be surprised at this, is building your your own LLM for that company and just managing it in-house yourself rather than buying an off-the-shelf package.
• 35:37
  SPEAKER_00: You can control it so much easier then.
• 35:39
  SPEAKER_00: So that's the two things that I've been recommending companies do.
• 35:43
  SPEAKER_00: But it's it's hard because businesses have been relying on AI to do business functions faster and cheaper, and now you're getting people like me coming in and saying, Yes, I'd still like you to do that, I'd still like you to be an enabler from a security perspective, but I need you to put these controls in it that is going to slow it down in some capacity, but they have to be careful.
• 36:06
  SPEAKER_01: I I've since there is this bit of disillusionment from leaders of big companies going, we're spending a lot of money on the big names out there.
• 36:16
  SPEAKER_01: They're taking our data and they're improving their products with our data, whether they say that they're gonna do it or not.
• 36:22
  SPEAKER_01: Is this really the right thing to do?
• 36:24
  SPEAKER_01: And one of the options is let's create our own.
• 36:26
  SPEAKER_01: How realistic is that for companies to do?
• 36:29
  SPEAKER_01: Just build their own medium language model or large language model?
• 36:33
  SPEAKER_00: Yeah, well, it's it's surprisingly easy to do, right?
• 36:36
  SPEAKER_00: And it's it for a mid-sized company, I wouldn't say it was too expensive.
• 36:42
  SPEAKER_00: You can do it for about under$5,000.
• 36:45
  SPEAKER_00: There is an overhead.
• 36:46
  SPEAKER_00: There is an overhead, Andrew, right.
• 36:47
  SPEAKER_00: You need to you need to keep it managed.
• 36:49
  SPEAKER_00: You need to have somebody who's looking after it, be that your cyber team, be that your IT team, or be that your new AI team, whatever you want to call it.
• 36:59
  SPEAKER_00: So there is there is an overhead there.
• 37:01
  SPEAKER_00: How easy is it to do?
• 37:02
  SPEAKER_00: You can have it up and running in a matter of weeks, if that quicker than that, to be honest.
• 37:06
  SPEAKER_00: It's not difficult.
• 37:08
  SPEAKER_00: It's I don't I don't even think it's very expensive to run either.
• 37:12
  SPEAKER_00: There's a lot of configuration if you've got tools embedded already, AI tools embedded already.
• 37:18
  SPEAKER_00: Is it worth doing?
• 37:19
  SPEAKER_00: I'd probably say the ones the reviews that I've done so far, it's probably about 60-70% of the companies I've said yes, definitely do it.
• 37:28
  SPEAKER_00: You'll get a benefit in the long run for it.
• 37:30
  SPEAKER_00: So yeah, I think there is a benefit from it, and it's easy.
• 37:33
  SPEAKER_01: Yeah, as a complete layman, it seems there's a disconnect for me that you hear all these you know AI gurus go to work for the big companies and they get paid literally tens of millions to go do it.
• 37:43
  SPEAKER_01: And then the other side, you know, you hear people like yourself saying, well, you could probably build your own in 510K and you know the rest of it.
• 37:50
  SPEAKER_01: So I'm wondering where that how that plays out.
• 37:53
  SPEAKER_01: Like, what do you lose by trying to build it yourself?
• 37:56
  SPEAKER_00: Do you not think these companies that pay the AI gurus gurus hundreds of thousands of dollars a year are just doing it to make their board look, hey, we've got an expert in AI, we're okay.
• 38:06
  SPEAKER_00: Do you not think there's a bit of that about it?
• 38:08
  SPEAKER_00: It's it's having a bit of a confidence factor.
• 38:10
  SPEAKER_00: The reality is that they'll be, I'll guarantee you that they'll be recommending what's built internally ourself and they can do it pretty cheap.
• 38:17
  SPEAKER_01: Yeah, it'd be fascinating to see how this plays out, right?
• 38:19
  SPEAKER_01: Because I think there'd be many people who'd be thinking, at least let's build our own models.
• 38:26
  SPEAKER_01: I I I don't know if your impression is the same as mine, which is you hear people saying, well, do we really need this whole category of software anymore?
• 38:33
  SPEAKER_01: Do we need this do we need Salesforce?
• 38:35
  SPEAKER_01: Why don't we just build our own CRM?
• 38:37
  SPEAKER_01: Uh I'm a little bit skeptical about whether that's actually what's going to happen, but I do think the underlying LLM stuff might be where it goes.
• 38:45
  SPEAKER_01: I don't know.
• 38:45
  SPEAKER_01: What's your thoughts on that?
• 38:46
  SPEAKER_00: Oh, yeah.
• 38:47
  SPEAKER_00: Well, and there's companies that are actually getting on the bandwagon now that are actually can provide this service where they'll come in and basically give you the hardware, the software, train you up how to do it very, very fast for a fraction of the fraction of the cost, to be honest.
• 39:04
  SPEAKER_00: Um, so yeah, I'm starting to see things change in that space very, very fast.
• 39:10
  SPEAKER_00: But that's the nature of AI, isn't it?
• 39:12
  SPEAKER_00: It moves so fast.
• 39:13
  SPEAKER_01: Yeah, I I feel like I learned something last week, and by this week I'm already out of date on some new thing that's come out.
• 39:18
  SPEAKER_00: Well, you know what, it's like AI.
• 39:20
  SPEAKER_00: So you go into Chat GPT and you ask it a question, 10 minutes later, you ask it the same question, you'll get a different answer.
• 39:26
  unknown: That's true.
• 39:27
  SPEAKER_01: That's so true.
• 39:28
  SPEAKER_01: So, Robbie, listen, on that note, let's go back to this the spin-the-wheel game.
• 39:32
  SPEAKER_01: We came up with the Cyber Donut hot seat.
• 39:35
  SPEAKER_01: And to remind everyone, Cyber Donut was a company, a fictitious company from three years ago in the podcast, where we we sent a lot of episodes around how do we help Cyber Donut get to$10 million in ARR.
• 39:47
  SPEAKER_01: Well, Cyber Donuts back.
• 39:49
  SPEAKER_01: So let's reveal the question below the hot seat and see what your thoughts are.
• 39:55
  SPEAKER_01: So here's the situation: Cyber Donut landed one of your fractional clients as an early adopter before you started working with them, right?
• 40:03
  SPEAKER_01: So you came in and started working with them afterwards.
• 40:05
  SPEAKER_01: They signed up a three-year deal, escalating price, you know, cheap to start with, obviously, increases over time.
• 40:11
  SPEAKER_01: But nine months in, half the roadmap of the vendor is just your own company's custom requests and things like that.
• 40:20
  SPEAKER_01: And the product's starting to only just work for your client, essentially, right?
• 40:24
  SPEAKER_01: It's almost like a custom development project for that client.
• 40:27
  SPEAKER_01: How would you work with the leadership of Cyber Donut to help them realize that's what's happening and help them realize they've got to be a bit more aware of the world out there and not just this one client?
• 40:37
  SPEAKER_00: Right.
• 40:38
  SPEAKER_00: I see why you asked this earlier there.
• 40:39
  SPEAKER_00: You kind of touched on this earlier.
• 40:41
  SPEAKER_00: Right.
• 40:42
  SPEAKER_00: So what I've what I would do, right, is um I would um get a round table set up for cyber donuts' mid-best clients, shall we say, right?
• 40:54
  SPEAKER_00: And get them sitting around the table and going through the roadmap and having a voting system about what they want in it and what they don't, or priority system, in effect.
• 41:02
  SPEAKER_00: You've got to make sure that it meets all clients' requirements.
• 41:05
  SPEAKER_00: I'll give you a real-world example of this for a major software company who actually had this problem was have you heard of Fortify, the soft the software analysis company?
• 41:17
  SPEAKER_01: Yeah, that from the early 2000s, right?
• 41:20
  SPEAKER_00: Yeah, that's right, yeah.
• 41:21
  SPEAKER_00: So JP Morgan were a massive client of Fortify's.
• 41:25
  SPEAKER_00: And JP Morgan went and dictated what the roadmap for Fortify looked like, and that meant that Fortify found it increasingly more difficult to sell to other clients.
• 41:36
  SPEAKER_00: But to solve it, what I would do is I'd get a round table together with several clients of CyberDonut, discuss what the priorities should be and have a voting system to get to get everything that should be in there.
• 41:49
  SPEAKER_01: Were you at JP Morgan then when Fortify was working with the R.
• 41:52
  SPEAKER_01: I was at JP Morgan, yeah.
• 41:54
  SPEAKER_01: Okay.
• 41:55
  SPEAKER_01: And and what did it take for did did Fortify and leadership realize this and were worried about it?
• 42:00
  SPEAKER_01: Or were they thinking, oh no, we're good.
• 42:02
  SPEAKER_01: We're if we can build for JP Morgan, you know, we're gonna have something for everyone.
• 42:05
  SPEAKER_00: Yeah, I think they were quite happy to take JP Morgan's money, to be fair.
• 42:08
  SPEAKER_00: Is that what it was?
• 42:09
  SPEAKER_00: Who wouldn't?
• 42:10
  SPEAKER_01: Yeah.
• 42:10
  SPEAKER_01: I mean, I I would.
• 42:12
  SPEAKER_01: Yeah, I I if I was the leadership of JP Morgan, I'd I think it was good and all, but I'd be worried that what's the longevity of a company that's really developing software just for us, you know?
• 42:21
  SPEAKER_00: Yeah, you might as well buy it at that point.
• 42:22
  SPEAKER_00: There you go, right?
• 42:23
  SPEAKER_00: Yeah, exactly.
• 42:24
  SPEAKER_00: Yeah, no, I think having a having a discussion across clients, right, is good for a vendor, a small vendor, to actually help build the product in a way that suits many clients.
• 42:36
  SPEAKER_00: And it's not just clients that are in the same market, they can be in different markets as well.
• 42:41
  SPEAKER_00: So cyber companies can be in finance, manufacturing, healthcare, etc.
• 42:47
  SPEAKER_00: And having a representative who can actually discuss what looks good, what could look better, what they would like to see, you'd be surprised what can cross-function across different markets that other clients would actually want.
• 43:01
  SPEAKER_00: What I found, because I've been through that myself, right, when I was at OSEC, a lot of clients wanted to see better reporting.
• 43:09
  SPEAKER_00: And if one client in one sector had a good idea, it usually translated to the rest of the clients, to be fair.
• 43:15
  SPEAKER_00: So, yeah, that's probably what I would do.
• 43:18
  SPEAKER_01: Alright, well, on that note, Robbie, uh, thank you so much for joining us on the podcast on this uh sunny but windy day here in Scotland.
• 43:26
  SPEAKER_00: You're more than welcome.
• 43:27
  SPEAKER_00: And it's uh it's still raining where I am, and I'm just about 30 miles from you.
• 43:31
  SPEAKER_00: So yeah.
• 43:32
  SPEAKER_01: So give it give me half an hour of the rain here as well.
• 43:36
  SPEAKER_01: All right, Robbie, thanks for joining me.
• 43:38
  SPEAKER_01: You're welcome.