Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 141: Garret Grajek, CEO and Co-Founder at YouAttest on how he is making the lives of risk managers exponentially easier

Transcript

141: Garret Grajek, CEO and Co-Founder at YouAttest on how he is making the lives of risk managers exponentially easier · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_01: Sometimes the simple solutions targeted on the right areas have the biggest impact.
• 0:37
  SPEAKER_01: Garrett Drechek has lived through the pain of access to review audits in roles at companies where he's been a senior leader and then decided to make them a lot easier.
• 0:48
  SPEAKER_01: Find out how they are doing that and the impact they're having in this episode with Garrett, the founder and CEO of You A Test.
• 1:05
  SPEAKER_01: Welcome to the Sales Bluebird podcast, which exists because at B2B startups it is hard to get consistent traction and scale the sales team.
• 1:13
  SPEAKER_01: Sales Bluebird provides you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or two about selling and building startups.
• 1:23
  SPEAKER_01: I am your host, Andrew Monahan.
• 1:25
  SPEAKER_01: Our guest today is Garrett Dredgek, the CEO and founder of UITest.
• 1:29
  SPEAKER_01: Garrett, welcome to Sales Bluebird.
• 1:31
  SPEAKER_01: Greetings, Andrew.
• 1:32
  SPEAKER_01: Happy day.
• 1:33
  SPEAKER_01: Yeah, looking forward to this.
• 1:34
  SPEAKER_01: If only because you've got a really interesting background, right?
• 1:36
  SPEAKER_01: A couple of well-known companies in terms of silence and secure auth and what you're doing right now sounds really interesting as well.
• 1:42
  SPEAKER_01: And I want to get onto the business side in a second, but I want to throw you three questions at you, Garrett.
• 1:47
  SPEAKER_01: Nothing weird and no need to overthink them.
• 1:49
  SPEAKER_01: Just to kind of bring out some personal things about you.
• 1:51
  SPEAKER_01: So when you're traveling, do you prefer a window or aisle?
• 1:55
  SPEAKER_01: I'm an aisle guy.
• 1:56
  SPEAKER_01: Why is that?
• 1:57
  SPEAKER_01: Like to get in and out fast.
• 1:59
  SPEAKER_01: Yeah, it's so much easier, right?
• 2:01
  SPEAKER_01: Right.
• 2:02
  SPEAKER_01: Tea or coffee.
• 2:03
  SPEAKER_01: Um, I'm a coffee.
• 2:04
  SPEAKER_01: Need the caffeine.
• 2:06
  SPEAKER_01: Any particular kind of coffee?
• 2:08
  SPEAKER_01: No, uh, McDonald's.
• 2:09
  SPEAKER_01: Caffeine is the key ingredient, man.
• 2:11
  SPEAKER_01: Right.
• 2:12
  SPEAKER_01: Absolutely.
• 2:13
  SPEAKER_01: Yes.
• 2:14
  SPEAKER_01: Love it.
• 2:14
  SPEAKER_01: Last one.
• 2:15
  SPEAKER_00: You're based in SoCal, but uh Beach or Mountains.
• 2:18
  SPEAKER_00: Beach or Mountains.
• 2:19
  SPEAKER_00: I'm a uh mountain person.
• 2:21
  SPEAKER_00: Grew up in Chicago and liked skiing and likes snow and uh lived in Canada for a while.
• 2:26
  SPEAKER_00: Okay.
• 2:26
  SPEAKER_01: I'm based in Denver, so mountains are much closer to me than beaches are.
• 2:30
  SPEAKER_01: There you go.
• 2:30
  SPEAKER_01: You got the mountains.
• 2:31
  SPEAKER_01: All right, let's talk about business then.
• 2:34
  SPEAKER_01: So you're the CEO and founder at Uitest.
• 2:37
  SPEAKER_01: Why don't you tell us a little bit about what stage you guys are at in terms of your growth?
• 2:40
  SPEAKER_01: You know, I'm I'm a simple person from Scotland.
• 2:43
  SPEAKER_01: Explain what uh Uitest does in words that I would understand.
• 2:46
  SPEAKER_00: First of all, the uh stage of the company, we are a functional customer serving company with uh 20 customers, all SaaS base, all cloud-based, with uh functional partnerships and agreements for resale out there.
• 3:01
  SPEAKER_00: The company itself is addressing the identity, the IT identity security and compliance space.
• 3:09
  SPEAKER_00: And what we're doing is eliminating a very costly, usually manual process that enterprises conduct usually every quarter and make it into something that is simple to use in cloud-based and uh implements in hours instead of months.
• 3:28
  SPEAKER_00: So, what is that quarterly process?
• 3:30
  SPEAKER_00: That process is something called a user access review.
• 3:34
  SPEAKER_00: A user access review means that the enterprise has gone through outside the IT admin, but like a business owner, and says that all the users that have access to these particular resources are legitimate and should have access, extremely relevant to regulations such as Sarbanes Oxley saying who has access to the financial resource, the HIPAA high trust for healthcare, who has access to the PHI, for PCI DSS, who has access to retail to the credit card information.
• 4:10
  SPEAKER_00: And now the DOD, the US DOD, has just implemented this and made this part of the requirement for their regulation called CMMC that says all users that have access to the information that is relevant for conducting business with the DOD must have their accounts reviewed.
• 4:30
  SPEAKER_00: And that's usually a manual process, and we've automated it with a cloud service.
• 4:35
  SPEAKER_01: Manual process sounds like a nightmare given the scale of systems these days.
• 4:39
  SPEAKER_01: Is that what people are facing?
• 4:41
  SPEAKER_01: Yeah.
• 4:42
  SPEAKER_01: There's two options.
• 4:43
  SPEAKER_00: And who does that then internally?
• 4:45
  SPEAKER_00: So usually what is done is that a compliance officer goes, Oh, I have uh section 164.b to fill out this control.
• 4:56
  SPEAKER_00: I'm gonna just go tell the director of IT he has to conduct this.
• 5:00
  SPEAKER_00: The director of IT looks at him and goes, I have no idea.
• 5:04
  SPEAKER_00: I guess I'll have one of my people create spreadsheets and send it out to each manager.
• 5:10
  SPEAKER_00: And if that sounds like a nightmare, it is.
• 5:13
  SPEAKER_00: We took one project that had a half a million roles and it was taking them three to four months, even though it was when they were supposed to do it quarterly.
• 5:22
  SPEAKER_00: So we knocked it out by putting our product in there, and we were able to implement in literally a day and then have the entire process done in two and a half weeks.
• 5:32
  SPEAKER_01: It seems like compliance is just blighted by spreadsheets in all sorts of different ways.
• 5:38
  SPEAKER_01: Is that fair?
• 5:39
  SPEAKER_00: There is something going on in the world.
• 5:41
  SPEAKER_00: What it has been is that the Garrett's of the world, which I was, focused 100% on functionality.
• 5:48
  SPEAKER_00: 100%.
• 5:49
  SPEAKER_00: I got 15 patents in SSO and two-factor and application associations, etc.
• 5:56
  SPEAKER_00: You created products for companies like SecureAlt that I started and then silence, which I created nine AI models to solve a problem.
• 6:04
  SPEAKER_00: What has not kept up with the pace of IAM and two-factor in SSO is compliance, specifically identity compliance.
• 6:14
  SPEAKER_00: The team members are doing their work the same way they were doing this 25 years ago when SOX came out.
• 6:21
  SPEAKER_00: Occasionally they'll be using an on-premise tool, which will cost them millions, which helps, which literally has no relevance to 95% of the market.
• 6:33
  SPEAKER_00: The dominant player in the legacy uh way of doing an access review is Sailpoint.
• 6:39
  SPEAKER_00: We have gone head-to-head against SailPo, and companies have chosen our product for ease of use and time to value.
• 6:48
  SPEAKER_00: That's the biggest problem out there.
• 6:50
  SPEAKER_00: The companies simply cannot deploy their solutions quick.
• 6:54
  SPEAKER_01: And is there like fines associated or just audit failings?
• 6:57
  SPEAKER_01: What's the really big downside to not hitting these compliance requirements?
• 7:01
  SPEAKER_00: Every single one of those I mentioned, SOX has fines, HIPAA High Trust has fines, PCI DSS has fines, GLB has fines, DOD has fines for non-compliance.
• 7:13
  SPEAKER_00: All of these tools, not only can you lose your business and lose your reputation, but you can be fined.
• 7:19
  SPEAKER_00: And sometimes very heavily when it comes to PHI and PII data.
• 7:25
  SPEAKER_01: Yeah, some of those fines are pretty onerous, right?
• 7:27
  SPEAKER_01: Yes.
• 7:27
  SPEAKER_01: And you're choosing to do cloud.
• 7:30
  SPEAKER_01: Is it just cloud or do you do on-prem as well?
• 7:32
  SPEAKER_00: 100% cloud.
• 7:33
  SPEAKER_00: 100% cloud.
• 7:35
  SPEAKER_00: Palo Alto Unit 42 just released 99% of cloud permissions are overly permissive.
• 7:43
  SPEAKER_00: There's a lot of business in the cloud.
• 7:45
  SPEAKER_00: Now we extract the data from anywhere.
• 7:48
  SPEAKER_01: Okay.
• 7:48
  SPEAKER_01: It seems like in the cloud, the people haven't got their head around the idea that there's identities and accesses from systems, not just from people.
• 7:54
  SPEAKER_01: And that must be one of the biggest headaches to try and figure out.
• 7:57
  SPEAKER_00: Yeah.
• 7:58
  SPEAKER_00: The race to the cloud has been great.
• 8:00
  SPEAKER_00: I mean, I don't care if it's identity as a service or platform in a service or systems as a service, uh, ISBS and this.
• 8:08
  SPEAKER_00: What has really gone on is the race to the cloud has left a lot of the permissions very open and just ripe for attackers and hackers to gain access to one account and then get much larger permissions and abilities than they should have because the adoption was so quick.
• 8:26
  SPEAKER_01: Yeah, yeah.
• 8:27
  SPEAKER_01: When you think about your customers, what makes a great prospect for you, Garrett?
• 8:31
  SPEAKER_00: Great prospect is we look for is uh someone who is under a regulatory environment.
• 8:37
  SPEAKER_00: That is something that's important, and that's literally companies that are working in healthcare and they handle healthcare data.
• 8:44
  SPEAKER_00: They get it.
• 8:45
  SPEAKER_00: They know they can be fined, and they know often, which is really relevant, is that the insurance company simply will not work with them if they don't have certain standards and compliances and certifications.
• 8:58
  SPEAKER_00: So they know they have to do this.
• 9:00
  SPEAKER_00: Then what we do is say, Great, you're in this industry, you're in the finance or the healthcare industry or two targets.
• 9:06
  SPEAKER_00: Then we look at them and say, Great, how are you meeting your compliance?
• 9:11
  SPEAKER_00: And we have to get to the person, usually has risk in his title or security in his title, who is doing the job and saying, understood, that one, the NISPR AC-4, user access review, how are you doing that?
• 9:24
  SPEAKER_00: Are you doing that manually?
• 9:26
  SPEAKER_00: We can save you 80 to 90 percent of their time on that process.
• 9:30
  SPEAKER_01: So when someone hears that, why would they not go sure?
• 9:34
  SPEAKER_01: What's stopping them from just saying sure?
• 9:36
  SPEAKER_00: What's stopping them is they feel they're too busy and they don't know if it's true or real.
• 9:42
  SPEAKER_00: And that's where we supplement them with uh quick install videos, free POCs, and reference accounts.
• 9:48
  SPEAKER_01: Okay, so you can shine the light on the problem if they don't think they're feeling it right now.
• 9:52
  SPEAKER_01: Right.
• 9:53
  SPEAKER_01: Absolutely.
• 9:53
  SPEAKER_01: And the go-to-market then, is it through a direct sales team or are you mostly channel-based?
• 9:58
  SPEAKER_00: I love that question because what we've done is we've gone direct and that's been effective.
• 10:04
  SPEAKER_00: But the real growth of this is selling through the channel and specifically the MSSPs.
• 10:12
  SPEAKER_00: That's going to be the growth of this product.
• 10:13
  SPEAKER_00: That is what we're starting.
• 10:15
  SPEAKER_00: We're building out the sales tools, which are already done.
• 10:18
  SPEAKER_00: We have the reference customers through our direct marketing.
• 10:21
  SPEAKER_00: And now what we're doing is building an interface over the product so someone else can manage multiple tenants.
• 10:28
  SPEAKER_00: And that's what the MSPs are looking for.
• 10:31
  SPEAKER_00: And it's a huge value add to the MSSPs.
• 10:34
  SPEAKER_01: That's where I was going, right?
• 10:35
  SPEAKER_01: I mean, for them, if it's an add-on, they increase their order, you know, their revenue per account, right?
• 10:40
  SPEAKER_01: By adding more services like that.
• 10:42
  SPEAKER_00: 100%.
• 10:43
  SPEAKER_00: What is gone on in the MSSPs is that they jumped out of the box and got right on top of the IAM space that is managing wonderful products like Azure AD and Okta and Jump Cloud and Ping.
• 10:56
  SPEAKER_00: And they learned how to manage those, right?
• 10:58
  SPEAKER_00: What they've left open is the compliance tools because those are kind of scary and dark and legacy.
• 11:05
  SPEAKER_00: And that's why we're approaching them now and saying, no, we've built a product in the way that you are comfortable addressing a market through a quantified web-based GUI that does everything you need over the browser.
• 11:20
  SPEAKER_01: Okay, you're going where I was going next, which is I think the MSSP world is maybe littered with people who have put a different front end on a basically an on-prem or run-it-yourself system and called an MSSP, but it seems like you've actually been quite thoughtful about how you presented this to the MSSPs.
• 11:35
  SPEAKER_00: We from the day one thought of this product as taking what sale point, what the legacy people don't, and giving it a Salesforce.com type interface, which is supposed to be dumbed down that anyone can use.
• 11:48
  SPEAKER_00: Remember the target, our target is there, is the risk managers.
• 11:53
  SPEAKER_00: They're the ones who corporate, usually under the office CFO, is saying, You are supposed to get me compliant and get me the reports.
• 12:02
  SPEAKER_00: And they're technical that they can run a GUI.
• 12:05
  SPEAKER_00: They're not technical enough to run a whole product.
• 12:08
  SPEAKER_00: Right, right.
• 12:09
  SPEAKER_00: And that's why we built our interface the way we did.
• 12:12
  SPEAKER_01: I love that.
• 12:12
  SPEAKER_01: Well, what's the biggest challenge the sales team is facing right now?
• 12:15
  SPEAKER_01: Is it trying to find those people who have the light shone on them, or is it something else?
• 12:19
  SPEAKER_00: The challenge a sales team had is getting to the right people, the risk managers or the people in security who are addressing this compliance.
• 12:29
  SPEAKER_00: That was a challenge they had.
• 12:31
  SPEAKER_00: What we're aiding them then is going through specific industry organizations like Isaaca, ISA, and the Institute of Internal Auditors, IIA, and then providing them with contacts and going through those trade shows as well to get the right contacts.
• 12:48
  SPEAKER_01: Okay.
• 12:49
  SPEAKER_01: So I want to take it up a level.
• 12:50
  SPEAKER_01: I'm at RSA this week, and you know, usual thing at RSA, right?
• 12:54
  SPEAKER_01: There's a thousand vendors all using the same buzzwords but in different orders.
• 12:58
  SPEAKER_01: How are you thinking about how you stand out, how you rise above the noise in the marketplace from a company perspective?
• 13:05
  SPEAKER_00: I love what you said.
• 13:06
  SPEAKER_00: Um, what we're doing is staying true to our audience, which is the risk manager.
• 13:11
  SPEAKER_00: Okay.
• 13:11
  SPEAKER_00: Now, the truth of the matter is many risk managers aren't even at RSA.
• 13:16
  SPEAKER_00: So we're going to their shows.
• 13:17
  SPEAKER_00: We're going to the ISAC at the IAA and the ISSA shows.
• 13:21
  SPEAKER_00: Okay.
• 13:21
  SPEAKER_00: Now I'm going up tomorrow just to associate, shake some hands, make some partnerships, that type of stuff.
• 13:27
  SPEAKER_00: We know our audience is not at RSA and not looking at necessarily the new whizbang AI, machine learning, AI tool.
• 13:37
  SPEAKER_00: That's not their, and there's nothing wrong with those because I've built those and I mean it.
• 13:41
  SPEAKER_00: I've done the marketing and I've done the, you know, the integrations, and I've told everyone I was smarter and better than everyone else.
• 13:48
  SPEAKER_00: That's not our current market for this product.
• 13:51
  SPEAKER_00: This product is the person that needs to get the compliance done in the first quarter of every year.
• 13:56
  SPEAKER_00: Otherwise, they're not so compliant and the CFO is going to come down to them heavy.
• 14:01
  SPEAKER_00: So what we have to do is adjust our marketing to them, let them know that this product works, that we can give them the right references, and we can meet their really crucial deadlines in a manner that they're not accustomed to.
• 14:13
  SPEAKER_01: I remember early on at silence, one of the things I thought looking from the outside seemed to get some traction.
• 14:19
  SPEAKER_01: Was that idea of the, I think they called it the awesome demo or the amazing demo?
• 14:22
  SPEAKER_01: Do you have something similar in the US world that you're trying to do?
• 14:25
  SPEAKER_01: Absolutely.
• 14:26
  SPEAKER_00: What we do is we show the customer to say, hey, here we go.
• 14:29
  SPEAKER_00: I'm going to connect right out.
• 14:32
  SPEAKER_00: I'm going to connect right out into an IAM and I'm going to run an identity access review in seven minutes instead of seven months.
• 14:40
  SPEAKER_00: And we never failed.
• 14:41
  SPEAKER_00: The best time I've ever been called, and I was an SE first for 20 years, is uh CTO got on one of our uh demos and said, Garrett, I called one of those references you gave me, and um they said that uh you can get this integrated in 10 minutes.
• 14:57
  SPEAKER_00: And he goes, and he showed the things goes, Well, I'm gonna have to call you a liar.
• 15:01
  SPEAKER_00: He did it in three, and that's that's what we do, you know.
• 15:05
  SPEAKER_01: Well, you know, in a world of unfulfilled promises, you know, doing it at that speed and actually doing it as you said you would must help you stand out quite a lot.
• 15:14
  SPEAKER_00: At time to value, that's really what we're gonna bring, what we are bringing to the identity governance space, which is the most legacy and painful of all the identity uh verticals.
• 15:25
  SPEAKER_01: Uh, where do you see the company in three years, Garrett?
• 15:27
  SPEAKER_01: What's the big things you're working on, the big strategies?
• 15:30
  SPEAKER_00: What's huge?
• 15:31
  SPEAKER_00: Our big announcements is coming up in this one.
• 15:34
  SPEAKER_00: Here is we just finished our open API to the product.
• 15:37
  SPEAKER_00: So what I can see is bringing attestation, which is certification of identities and bringing that into all events.
• 15:46
  SPEAKER_00: These new regulations coming down on by the DOD, by the CMC, in the SOX, and even NURC SIP, which is what?
• 15:53
  SPEAKER_00: Which is the regulations and guidances put on our energies, mean that all security events, the key security events, have to be attested to.
• 16:02
  SPEAKER_00: With our open API, we see this being a platform where security events are brought into a single council and not just alerts.
• 16:10
  SPEAKER_00: See, the alerts is one thing.
• 16:12
  SPEAKER_00: What the auditor and what compliance needs is so who acted on it and why and where are the notes?
• 16:18
  SPEAKER_00: And that gets asked to these companies every year, and it takes them far too long to compile this.
• 16:24
  SPEAKER_00: And they're they're they're extracting very valued resources to come up with these ports, and that's where we're gonna help.
• 16:31
  SPEAKER_00: Well, we help not only take any identity, and in a couple of years, it'll be all events in a single pane of glass.
• 16:37
  SPEAKER_01: That sounds awesome.
• 16:38
  SPEAKER_01: And remind me that you said it right at the start, the ROI.
• 16:41
  SPEAKER_01: I forget the story you told, but remind us of that story.
• 16:44
  SPEAKER_00: Yeah.
• 16:44
  SPEAKER_00: So literally what we're doing is we're creating all of our customers.
• 16:48
  SPEAKER_00: We had a CPA do this, they're getting up over 80% value in this product, which is they're cutting the cost of these deployments down by 80%.
• 16:58
  SPEAKER_00: We had one customer that literally had a quote for to do the project in six to eight months with no guarantees that it was going to be finished, and we got it done in two and a half weeks.
• 17:09
  SPEAKER_01: Six to eight months and two and a half weeks.
• 17:11
  SPEAKER_01: That's pretty impressive.
• 17:12
  SPEAKER_00: What's really important is no enterprise has enough IT security people.
• 17:18
  SPEAKER_00: The only way we can solve the combat that we're having with the hackers is to make our IT security people more efficient.
• 17:27
  SPEAKER_00: And having them complete audit reports is not adding value to the company.
• 17:32
  SPEAKER_01: Got it.
• 17:32
  SPEAKER_01: All right.
• 17:32
  SPEAKER_01: Well, someone wants to continue the conversation, Garrett.
• 17:35
  SPEAKER_01: What's the best way to get in touch with you?
• 17:36
  SPEAKER_00: Just go to uh uatest.com, Y-O-U-A-T-T-E-S-T.com and just fill out a contact form and said, hey, I heard you're on a wonderful Andrew show.
• 17:46
  SPEAKER_00: Love to talk.
• 17:47
  SPEAKER_00: You can ask for me directly, Garrett.
• 17:49
  SPEAKER_01: Awesome.
• 17:49
  SPEAKER_01: Well, I hope everyone does that.
• 17:50
  SPEAKER_01: And I wish you every success for this year and next year and making quite a difference in a world that seems uh way too manual right now.
• 17:56
  SPEAKER_01: Absolutely.
• 17:57
  SPEAKER_01: Thanks a lot.
• 17:58
  SPEAKER_01: Thanks for your time.
• 17:59
  SPEAKER_01: So I could be honest, this was an area of what we do that I just wasn't aware of before.
• 18:05
  SPEAKER_01: And sometimes it is those dull, boring, painful problems which uh hold us back or hold security or compliance teams back.
• 18:15
  SPEAKER_01: And uh just a simple way or a new way to get rid of them can be so impactful.
• 18:20
  SPEAKER_01: And when I was listening back to the conversation I had with Garrett, I had three main takeaways.
• 18:24
  SPEAKER_01: The first one is, you know, when you get to know and understand that one area that is the most painful, focus, focus, focus on that one area.
• 18:33
  SPEAKER_01: Don't get distracted.
• 18:35
  SPEAKER_01: There's lots of things you could be doing around that area to add lots of bells and whistles on, and maybe tangentially add in a new area, a slightly different part of the compliance framework over here at that end.
• 18:47
  SPEAKER_01: And what Garrett was talking about was how important it is to just focus on the one area that is the dull painful problem and make sure you deliver on that.
• 18:56
  SPEAKER_01: The second thing that I thought was interesting was that the risk manager was the main buyer.
• 19:02
  SPEAKER_01: You know, he understood that that was the person he was after, that's the person they were zeroing in on.
• 19:07
  SPEAKER_01: And a lot of what they're doing is then narrowed in on focusing in on that one buyer, the risk manager.
• 19:14
  SPEAKER_01: And then thirdly, you know, thinking through the impact that having you attach come in and help you out at their clients, it really is an exponential return.
• 19:23
  SPEAKER_01: You know, what people view as just a complete pain in the ass, but something that needs to be done, but it sucks up time, it sucks up mind space.
• 19:31
  SPEAKER_01: It's just one of these things that lingers and lingers until you have to make it go away.
• 19:35
  SPEAKER_01: And yet when you come in and say, listen, we'll take care of that, and by the way, we'll take care of it in days rather than months, that exponential return is what people are looking for to say, God, just make the pain go away and do it really quickly, right?
• 19:48
  SPEAKER_01: That's such a killer combo right there.
• 19:50
  SPEAKER_01: So those are my three takeaways from the conversation.
• 19:52
  SPEAKER_01: It was really interesting for me, as I say, an area I didn't really understand beforehand.
• 19:56
  SPEAKER_01: And uh, I wish you a test and garried every success for the rest of the year into 2023.