Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 150: Wias Issa, CEO of Ubiq Security, on how Ubiq’s GTM for their API encryption for developers

Transcript

150: Wias Issa, CEO of Ubiq Security, on how Ubiq’s GTM for their API encryption for developers · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_01: Way back on episode 111, Mike Rogers and I chatted about why Ionic Security did not break out and be a massive hit.
• 0:40
  SPEAKER_01: Which is why I was excited to meet with Weiss Issa, the CEO at UBIC Security, in this episode and learn how he is approaching the same space differently, the lessons he's learning winning early customers, and how he is approaching his go-to-market.
• 1:06
  SPEAKER_01: Welcome to the Sales Bluebird podcast, which exists because at cybersecurity startups, it's hard to get the team to repeat ability and scale the business.
• 1:16
  SPEAKER_01: Sales Bluebird gives you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or ten about building great cybersecurity companies.
• 1:26
  SPEAKER_01: I am your host, Andrew Monahan, and our guest today is Weiss Issa, CEO at UBIC Security.
• 1:33
  SPEAKER_01: Weiss, welcome to Sales Bluebird.
• 1:35
  SPEAKER_00: Thanks, Andrew.
• 1:36
  SPEAKER_00: Appreciate it.
• 1:37
  SPEAKER_01: Yeah, I'm looking forward to this, Weiss.
• 1:38
  SPEAKER_01: I think I mentioned you before, you know, what Ubic does is not that far different, you know, not off on a completely different tangent from a company I worked at a few years back.
• 1:48
  SPEAKER_01: So it'd be interesting to hear your experiences so far building what you're building and the big impact it's gonna make when uh lots of customers get hold of it and really get some value from it.
• 1:57
  SPEAKER_01: So that's why I'm looking forward to this conversation.
• 1:59
  SPEAKER_01: However, before we get to business, let's get to know a little bit more about you.
• 2:04
  SPEAKER_01: Weiss, I've got 35 questions on my list here.
• 2:08
  SPEAKER_01: The good news is we're not going through 35.
• 2:10
  SPEAKER_01: I'm gonna ask you to randomly pick three numbers between one and thirty-five, and I'll read out the question to you.
• 2:15
  SPEAKER_01: You ready to go?
• 2:16
  SPEAKER_00: Let's do it.
• 2:17
  SPEAKER_01: First one.
• 2:18
  SPEAKER_00: 13.
• 2:19
  SPEAKER_01: 13.
• 2:20
  SPEAKER_01: How did you first make money as a kid?
• 2:23
  SPEAKER_00: Cutting lawns for the neighbors in the in the area that I lived in.
• 2:27
  SPEAKER_01: And which part of the world was that?
• 2:28
  SPEAKER_00: Northern Virginia, right outside of Washington, D.C., probably about 10, 15 minutes from the border of DC to Virginia.
• 2:34
  SPEAKER_01: And I'd imagine that's a quite a humid environment.
• 2:36
  SPEAKER_01: You got some rainstorms come through.
• 2:38
  SPEAKER_01: I bet that grass grew pretty quickly.
• 2:40
  SPEAKER_00: Oh yeah, especially July, August.
• 2:41
  SPEAKER_00: I mean, if you're familiar with the area, it's very, very humid those two months.
• 2:45
  SPEAKER_00: And uh the mosquitoes are in full force too.
• 2:47
  SPEAKER_00: So not only are you battling the sun and the humidity, but you've also got the mosquitoes to contend with.
• 2:51
  SPEAKER_00: But it's a great experience, right?
• 2:53
  SPEAKER_01: Do you get danger money?
• 2:55
  SPEAKER_00: No danger of pay.
• 2:57
  SPEAKER_00: No danger of pay.
• 2:57
  SPEAKER_00: Although now that I look back at it, I should have asked.
• 2:59
  SPEAKER_01: Yeah, I know, right?
• 3:00
  SPEAKER_01: Good learning, though.
• 3:01
  SPEAKER_01: I mean, you use hard work, you're out there, you have to drum up some business and then deliver on it.
• 3:05
  SPEAKER_01: Uh great learnings, I'm sure, for the rest of your life and from that those early days.
• 3:09
  SPEAKER_00: Yeah, for sure.
• 3:10
  SPEAKER_00: I mean, you get to meet all kinds of people along the process and you learn what it's like to get rejected at a very, very young age.
• 3:17
  SPEAKER_01: Very cool.
• 3:17
  SPEAKER_01: I've got to tell you a quick story.
• 3:19
  SPEAKER_01: Uh Lee Trevino, the don't even know the golfer, he was a kind of Hispanic golfer, professional golfer from 30, 40 years ago.
• 3:26
  SPEAKER_01: And uh he was in his yard, front yard one day mowing his lawn.
• 3:29
  SPEAKER_01: And this lady in the neighborhood stopped and said, Hey you, and he goes, What?
• 3:33
  SPEAKER_01: He goes, You mow lawns, right?
• 3:34
  SPEAKER_01: He goes, Yeah, I mow lawns.
• 3:36
  SPEAKER_01: And uh she goes, How much do you charge for mowing lawns?
• 3:39
  SPEAKER_01: And he goes, Well, the lady this size lets me sleep with her.
• 3:46
  SPEAKER_01: Oh wow.
• 3:49
  SPEAKER_01: And the lady just drove off.
• 3:51
  SPEAKER_00: What an epic response.
• 3:53
  SPEAKER_01: If you know anything about Lee Trevino, he jokes his way uh around a golf course.
• 3:57
  SPEAKER_01: You know, still plays, I think, in the senior tour.
• 3:59
  SPEAKER_01: Maybe he's mostly retired, but he was always known as a great storyteller or a joke teller.
• 4:04
  SPEAKER_01: I just always remember that one.
• 4:05
  SPEAKER_01: I thought it was quite funny.
• 4:06
  SPEAKER_00: That's awesome.
• 4:06
  SPEAKER_00: I mean, storytelling is so important in so many aspects of life, especially business, especially selling, but you know that very well.
• 4:12
  SPEAKER_01: Yeah, it is.
• 4:13
  SPEAKER_01: It really is.
• 4:14
  SPEAKER_01: The power of a good story, I ranted about this on podcasts before, but I think every salesperson I know tells stories.
• 4:20
  SPEAKER_01: I think very few of us tell great stories, but it's a learnable skill, and it's something that we can probably all get better at.
• 4:26
  SPEAKER_01: Question number two, Weiss.
• 4:27
  SPEAKER_01: What number do you want?
• 4:28
  SPEAKER_01: 22.
• 4:29
  SPEAKER_01: What's the scariest animal?
• 4:31
  SPEAKER_00: Man, fantastic question.
• 4:33
  SPEAKER_00: I gotta go with like the easy answer and say shark.
• 4:36
  SPEAKER_01: Shark.
• 4:37
  SPEAKER_01: Any experiences with sharks then in uh San Diego Way?
• 4:41
  SPEAKER_00: No, thankfully not yet.
• 4:42
  SPEAKER_01: Yeah.
• 4:43
  SPEAKER_01: I don't think I've been in the water of the shark.
• 4:47
  SPEAKER_01: I may have been, but not knowing it anyway.
• 4:48
  SPEAKER_01: Let's put it that way.
• 4:49
  SPEAKER_01: Yeah, that's right.
• 4:50
  SPEAKER_01: All right, last question.
• 4:52
  SPEAKER_01: 17.
• 4:53
  SPEAKER_01: 17.
• 4:54
  SPEAKER_01: Cats or dogs?
• 4:56
  SPEAKER_00: Dogs.
• 4:57
  SPEAKER_01: Why dogs?
• 4:58
  SPEAKER_00: I like the aspect of the friendship.
• 5:00
  SPEAKER_00: Not that cats can't be friendly with their owners, but I feel like there's a more visible connection or bond between dogs and their owners than uh than I've experienced with cats.
• 5:08
  SPEAKER_01: Do you have dogs right now?
• 5:09
  SPEAKER_00: I do not.
• 5:10
  SPEAKER_00: I do not.
• 5:11
  SPEAKER_00: Although my wife has been asking for a dog for quite some time.
• 5:14
  SPEAKER_00: So I may have to cave in soon.
• 5:17
  SPEAKER_01: Yeah, we've got two dogs.
• 5:18
  SPEAKER_01: I agree with you, man.
• 5:20
  SPEAKER_01: They're just so friendly.
• 5:21
  SPEAKER_01: They're a part of our family, you know.
• 5:22
  SPEAKER_01: They're they're just such good fun.
• 5:24
  SPEAKER_01: Our dogs are not guard dogs, but the way they bark sounds like guard dogs.
• 5:27
  SPEAKER_01: So when anyone ever comes to the door, they tells any visitor, oh, these guys have got loud and aggressive dogs, even though they're not that tall.
• 5:35
  SPEAKER_01: Uh dear.
• 5:36
  SPEAKER_01: All right, Wise.
• 5:37
  SPEAKER_01: So as you transitioned out of your lawn care business when you were younger, what was the first real job you had in business?
• 5:45
  SPEAKER_00: I was a security analyst uh at Cementec, which had recently acquired an early stage startup called RipTech, which was one of those one of the first emerging players in the managed security services space before Gartner and Alexa Forrester had even defined what managed security services was.
• 5:59
  SPEAKER_01: Oh, they were pioneers, right?
• 6:01
  SPEAKER_01: That's right.
• 6:01
  SPEAKER_01: RipTech was pioneers in MSSP.
• 6:03
  SPEAKER_00: That's right.
• 6:04
  SPEAKER_00: And you know, so the value prop was you're a big corporation and you likely have the security technology in place, but who's watching it?
• 6:12
  SPEAKER_00: Why don't you let us be the people who are sort of watching your backs and taking that event data to make sense if something's happening or not?
• 6:19
  SPEAKER_00: Because back then the mentality was I bought a security product, I'm fine.
• 6:22
  SPEAKER_00: It's a set it and forget it sort of exercise.
• 6:24
  SPEAKER_00: But what we learned over the last 20 years is that's definitely not the case.
• 6:27
  SPEAKER_01: No, no, for sure.
• 6:28
  SPEAKER_01: So from Symantec, you went to Mandian.
• 6:31
  SPEAKER_01: Was Mandian early stage in those days, or was it quite established?
• 6:35
  SPEAKER_00: Probably gross stage.
• 6:36
  SPEAKER_00: I think we were in the high double digits in terms of total employees at the company when I joined.
• 6:42
  SPEAKER_00: And for me, it was frankly a tough decision.
• 6:44
  SPEAKER_00: I'd been at Symantec for RipTech Symantec collectively for almost a decade.
• 6:48
  SPEAKER_00: So the transition over to Mandian was tough because it's not necessarily that we view them as a competitor, but I think the way that they approach things uh was slightly different, which compelled me to move over.
• 6:57
  SPEAKER_00: But when I got over to Mandian, it was a very different sort of way of looking at the problem and helping customers, which was super, super exciting.
• 7:05
  SPEAKER_01: And then fast forward a few years into 2018 and you you founded Ubic Security.
• 7:11
  SPEAKER_01: Imagine that I was a CISO and I said to you, what does Ubic do?
• 7:14
  SPEAKER_01: What would you say?
• 7:16
  SPEAKER_00: We help CISOs reduce the risk of data theft in the event of a breach by helping you plug in encryption directly into an application, which is far more effective than relying on storage layer encryption controls like database encryption.
• 7:30
  SPEAKER_00: Because the general theory with most attackers and really the practical scenarios that play out are an attacker gets a hold of admin credentials, gets to a database, and uses those admin credentials to essentially view data in the clear instead of ciphertext, which is really what you want to happen.
• 7:46
  SPEAKER_01: So then in that scenario, you're creating is it almost like an end-to-end encryption process then?
• 7:52
  SPEAKER_01: If someone tries to get data from somewhere that's already encrypted, it stays encrypted and needs to use it.
• 7:57
  SPEAKER_01: I'm trying to understand quite how it ends up being a user experience.
• 8:00
  SPEAKER_00: Yeah, so our focus is on what we refer to as application layer encryption and key management.
• 8:05
  SPEAKER_00: So the idea being that you likely have, depending on the size and industry, of course, of the organization, but you know, large companies could have thousands of applications, and a lot of those applications generate sensitive data.
• 8:16
  SPEAKER_00: And sometimes sensitive data is sort of very obvious.
• 8:18
  SPEAKER_00: It's credit card information, first name, last name, social security numbers, or date of birth.
• 8:23
  SPEAKER_00: But in some cases, that sensitive data is not as obvious.
• 8:26
  SPEAKER_00: For example, a freeform text field in a web UI that a customer uses, and they unknowingly or maybe deliberately put in sensitive information in there as a reminder, like mother's made a name or the color of your first home, which could be an answer to a secret question.
• 8:41
  SPEAKER_00: So what we enable teams to do is plug encryption directly into the app so that when the app first handles that data, it encrypts it before it sends it to the network or storage layer.
• 8:52
  SPEAKER_00: So it's sort of all self-contained within the app.
• 8:54
  SPEAKER_00: And then you can leverage the application's existing identity and authentication sort of infrastructure, the trusted model that they might have that says something like, you know, Weiss has access to this data as a user, and Andrew has access to that data as a user, and sort of plugging directly into that identity and authentication by default.
• 9:11
  SPEAKER_01: So you know, I always think about enterprises, you know, they tend to buy things to solve problems.
• 9:16
  SPEAKER_01: When you're thinking about the use cases that you specifically solve for, what's top of mind?
• 9:20
  SPEAKER_00: The one that probably comes up the most often is taking sensitive sort of credit card or financial data that's ingested into some system or an app and encrypting it at the point of entry in the org.
• 9:31
  SPEAKER_00: So when you think about, for example, like a very large sort of credit agency, they have tons and tons of data sources and they have tons and tons of data partners.
• 9:39
  SPEAKER_00: You know, data ends up in their environment in a sort of staging sort of environment.
• 9:43
  SPEAKER_00: And at that point of entry is where a solution like ours comes in and says, you know what, we're going to encrypt this immediately upon entry.
• 9:49
  SPEAKER_00: And then as it gets passed from system to system, only systems that are sort of explicitly authorized, and we do that very simply via API tokens, can actually decrypt that data or read that data.
• 9:59
  SPEAKER_00: So credit card data, financial data is obviously a big one.
• 10:02
  SPEAKER_00: The other one is personal identifiable sort of health information, PHI.
• 10:06
  SPEAKER_00: This goes beyond like the patient name, but it's also like information about the patient's health status.
• 10:12
  SPEAKER_00: And for example, we work with a company that focuses on the betterment of individual sort of mental status, and they track individuals for six to 12 months at a time.
• 10:21
  SPEAKER_00: So they have a pretty, pretty in-depth amount of personal, private information about people, we help them protect that.
• 10:27
  SPEAKER_00: So a lot of use cases sort of tend to be around financial information, uh, healthcare information, and then a lot of IP, intellectual property for companies.
• 10:37
  SPEAKER_01: So if I'm a user, let's say of a healthcare system, I'm a I don't know, a nurse or a doctor sitting there trying to look at patient records.
• 10:45
  SPEAKER_01: Do I have any knowledge at all about what's going on?
• 10:47
  SPEAKER_01: Is it all transparent to me or do I have to do things to access records that's a bit different?
• 10:52
  SPEAKER_00: Great question.
• 10:53
  SPEAKER_00: It's entirely transparent to the end user.
• 10:55
  SPEAKER_00: So the way the product works is it gets plugged into the app layer via a client software library.
• 11:01
  SPEAKER_00: That software library then essentially makes API calls to our sort of SaaS back end.
• 11:05
  SPEAKER_00: But to the user, it's completely entirely transparent.
• 11:08
  SPEAKER_00: They've got no idea what's happening.
• 11:10
  SPEAKER_00: But what might be actually engineered in the background sort of automatically is we know that that user, let's say it's a doctor and she's accessing my medical records.
• 11:19
  SPEAKER_00: And because she's a doctor and she's defined as at that level of privilege inside the medical application, she'll be able to access a multitude of app of patient records.
• 11:28
  SPEAKER_00: Whereas maybe one day she accidentally wants to click on a patient record that's not one of her patients.
• 11:34
  SPEAKER_00: It's her peer patients.
• 11:35
  SPEAKER_00: Let's say it's Dr.
• 11:36
  SPEAKER_00: Monaghan.
• 11:37
  SPEAKER_00: She wouldn't be able to for a multitude of reasons.
• 11:39
  SPEAKER_00: One being the identity infrastructure, of course.
• 11:41
  SPEAKER_00: But the latter part is if for some reason she was able to bypass that aspect, she would only see ciphertext.
• 11:47
  SPEAKER_01: Got it.
• 11:47
  SPEAKER_01: So there's a kind of data control, access control element to it as well, right?
• 11:52
  SPEAKER_01: And the reason I said at the start, you know, I worked at a company uh a few years back, similar sort of space.
• 11:57
  SPEAKER_01: I can understand, you know, what it is you're shooting to do here.
• 12:00
  SPEAKER_01: It's something that you know could be hugely impactful for the industry.
• 12:04
  SPEAKER_01: I'm wondering what you, as you look at what you're building, what you think the biggest challenges might be for adoption in the market.
• 12:11
  SPEAKER_00: It's a fantastic question.
• 12:12
  SPEAKER_00: I think probably when I think through the different personas that we generally interact with, sort of at the executive level, when they're larger companies, and we deal with companies that are Fortune 10, and we deal with companies that you've never heard of.
• 12:26
  SPEAKER_00: For the larger companies, there are generally three distinct sort of personas that we interact with frequently at the executive level.
• 12:32
  SPEAKER_00: One's the CISO, the individual leading sort of the InfoSec program.
• 12:36
  SPEAKER_00: The second is the VP of engineering.
• 12:38
  SPEAKER_00: Because our product integrates directly into an application, that VP of product or VP of engineering is a super critical person for us.
• 12:45
  SPEAKER_00: And then lastly, if it's a very large company, generally in financial services or like the very well seasoned industries like telecommunications, there's a data protection officer or the data protection office that we also deal with.
• 12:57
  SPEAKER_00: The challenging aspect that we found is for the smaller companies where there's no security person, and by small I mean a couple hundred people could be small, right?
• 13:04
  SPEAKER_00: 200, 300 people, but there are no security resources, no InfoSec people.
• 13:08
  SPEAKER_00: And there's generally a technology team mostly comprised of software engineering resources that they absolutely appreciate security.
• 13:16
  SPEAKER_00: They absolutely respect the need for security, but there's a big pressure on them to ship product.
• 13:21
  SPEAKER_00: So getting them to not appreciate the security or the data protection aspect, but to appreciate how easy it is to integrate and how how not burdensome a solution can be has been something that we've been continuously focusing on.
• 13:35
  SPEAKER_00: And I wouldn't call it a major challenge because one of the initial design principles we had before we even built or wrote a single line of code was this has to be incredibly easy to use and it's got to be self-service.
• 13:45
  SPEAKER_00: And we want to focus on making it something that a developer with sort of one or two years of practical engineering experience could get up and running with.
• 13:54
  SPEAKER_00: So to come back to your question, the key sort of thing we're trying to crack is how do you get the engineering community to actually believe that your security product is not going to get in their way or slow them down?
• 14:05
  SPEAKER_00: And that's something that we're continuously working on from an education and awareness and frankly from a product perspective.
• 14:11
  SPEAKER_01: In talking to the early adopters, any learnings about how to talk about what you're doing that was perhaps a bit different than what you thought that's you know, to try and get that connection with them?
• 14:21
  SPEAKER_00: Absolutely.
• 14:22
  SPEAKER_00: Well, we started off, you know, what we thought was the killer story, and we talked to a company with 250,000 employees, and we'd talk in the security team, and we use that story, and we were like, wow, this resonates.
• 14:33
  SPEAKER_00: And then we get on a call with a thousand-person company that had literally one security person and 500 developers, and we use that same story, and the killer story will fall flat on its face because the challenges and the problems that the security team faces and what sort of resonates with them didn't necessarily resonate with the engineering teams.
• 14:53
  SPEAKER_00: And sort of learning that along the way was so, so critical.
• 14:56
  SPEAKER_00: So I think one tip I'd give to an early stage company is if you're going to deal with multiple sort of different personas, and the personas need to be an individual, it could be a group of people, make sure that you really understand what makes them tick and the challenges that they face because it's wildly different.
• 15:11
  SPEAKER_00: And a killer story for one group cannot always necessarily, or may not always necessarily translate into a killer story for another group.
• 15:17
  SPEAKER_01: Yeah, it's so true, right?
• 15:18
  SPEAKER_01: Different persona, but also different size companies have different sophistication and needs.
• 15:22
  SPEAKER_01: Interesting to hear that.
• 15:23
  SPEAKER_01: I noticed, you know, we'll give you one huge compliment.
• 15:26
  SPEAKER_01: When I look at your website, it's very clear on the homepage about the folder, exactly what you do, right?
• 15:30
  SPEAKER_01: There's no cute words or some weird way of describing it.
• 15:34
  SPEAKER_01: It literally says application layer encryption made simple.
• 15:36
  SPEAKER_01: And then you got a three-line thing below below that saying here's what it really means, right?
• 15:41
  SPEAKER_01: So I really kind of admire the way you've cut that simple messaging so quickly.
• 15:45
  SPEAKER_01: I'm wondering if that came from discussions with with early adopters as well.
• 15:49
  SPEAKER_00: Well, absolutely it did.
• 15:50
  SPEAKER_00: I could promise you that our first iteration of the website, not the in its current design form, but uh, you know, a year, year and a half ago, was not like that.
• 15:58
  SPEAKER_00: And that messaging absolutely shifted.
• 16:00
  SPEAKER_01: Do you remember what it said?
• 16:01
  SPEAKER_00: Yeah, it said encryption made simple for developers.
• 16:04
  SPEAKER_00: And I recall getting on the phone with the CISO of one of the largest grocery store companies in the US, retail companies.
• 16:12
  SPEAKER_00: And they were sort of super interested to talk to us.
• 16:15
  SPEAKER_00: And one of the first things out of his mouth was, I didn't know like this product was made for us because it said it's encryption made simple for developers.
• 16:22
  SPEAKER_00: And we're a security team.
• 16:24
  SPEAKER_00: And we realized, wow, what we're doing is we're telling everyone who's not a developer this is not for you indirectly, or that could be someone's impression.
• 16:31
  SPEAKER_00: So, yeah, to answer your question, it was absolutely a journey.
• 16:34
  SPEAKER_00: And where we got to today is through feedback and listening to what customers and prospective customers were telling us on calls or literally even in submission forms on our website, right?
• 16:45
  SPEAKER_00: The contact us form.
• 16:46
  SPEAKER_00: Believe it or not, there are people who still like to do that.
• 16:48
  SPEAKER_00: And they reach out and they say, Hey, I've got a question here.
• 16:50
  SPEAKER_00: Do you support this?
• 16:51
  SPEAKER_00: And I'm like, Well, it says in our website, of course we support that, but it's not clear.
• 16:55
  SPEAKER_00: So that definitely helped us improve the messaging.
• 16:57
  SPEAKER_01: Well, that's great.
• 16:58
  SPEAKER_01: You know, I love other when people take that feedback and really learn from people are telling you the best source of descriptions and words and phrases and things like that comes straight out of the mouths of prospects and customers.
• 17:09
  SPEAKER_01: And too often we we think we're, I don't know what, if we if we think we're smarter or whatever it is, we just choose to ignore it sometimes.
• 17:15
  SPEAKER_01: But I love the fact that you listen to those guys so clearly.
• 17:18
  SPEAKER_01: Let me ask you a different question, Wise.
• 17:19
  SPEAKER_01: So your background is semantic MSSP, Mandi, and then a spell at SonicWall.
• 17:25
  SPEAKER_01: How did you go from that into application layer encryption?
• 17:28
  SPEAKER_01: What could it cause you to say this is an area you actually want to get into and start building for?
• 17:32
  SPEAKER_00: Fantastic question.
• 17:33
  SPEAKER_00: So when I look back at my time at Symantec, all the types of threats we dealt with for companies, I would sort of refer to them as what are now called commoditized threats, you know, malware being deployed, malware spreading throughout the environment.
• 17:45
  SPEAKER_00: And then sort of like tail end of 2009, 2010, maybe a little bit earlier, but less broadly speaking, this whole idea of a nation state actor, an advanced persistent threat actor, or APT for short, started to sort of emerge.
• 17:59
  SPEAKER_00: And when I transitioned from semantic to Mandiant, I realized, wow, there's this sort of iceberg, and I've only seen the tip of it, but underneath the sort of ocean water, there's so much of this activity going on.
• 18:10
  SPEAKER_00: And by this activity, what I'm referring to are people who are very sophisticated, very well funded, in some cases backed by nation state, sort of executing on a mission that sort of advances the strategic objectives of that country.
• 18:23
  SPEAKER_00: And what I began to see pattern-wise, and I think this is a really important sort of skill for people who are involved in early stage companies, not just founders, but an engineering resource or a product manager, is to be able to identify patterns because they're there, but you're not going to see them unless you look for them.
• 18:40
  SPEAKER_00: And to come back to your question, you know, maybe its core business model or business at the time was responding to large-scale incidents for publicly mentioned companies like Target, the Home Depot, JP Morgan Chase, the New York Times.
• 18:54
  SPEAKER_00: And time and time again, in many of those sort of like post-incident discussions, someone would ask the question, generally at the very senior level at the company, sometimes at the board level, how did the attackers make off with their data?
• 19:07
  SPEAKER_00: I thought we had encryption.
• 19:09
  SPEAKER_00: And I would watch the data protection leaders or the CISOs of these companies sort of have to feel this really uncomfortable question.
• 19:17
  SPEAKER_00: And time and time again, the answer was something along the lines of, well, we had encryption in place, and we had encryption in all the right places, but the attacker was able to disable the encryption.
• 19:27
  SPEAKER_00: And then there was this rat hole discussion that ensued.
• 19:30
  SPEAKER_00: Well, how's that possible?
• 19:31
  SPEAKER_00: How does an encryption solution exist that can be turned off so easily?
• 19:35
  SPEAKER_00: And that's what really for me was a pattern that after I sort of transitioned out of Mandiant, realized look, there is an opportunity here to help companies close this gap and make it much more difficult for attackers to execute their ultimate objective, which is to get to that sensitive data and get it out of the organization.
• 19:53
  SPEAKER_01: And encryption's a complicated world, let's say, right?
• 19:56
  SPEAKER_01: I mean, it's very, very technical.
• 19:57
  SPEAKER_01: And there's uh sometimes a lot of religion in encryption about types of encryption and what works best and where.
• 20:04
  SPEAKER_01: Any learnings about that world as you went into it?
• 20:06
  SPEAKER_00: Well, absolutely.
• 20:07
  SPEAKER_00: So cryptography, right?
• 20:09
  SPEAKER_00: Sort of as a subgroup of encryption, like you said, super technical, highly sort of mathematical.
• 20:15
  SPEAKER_00: There are a lot of really, really smart people.
• 20:17
  SPEAKER_00: Some of them are at NIST, some of them are involved with NIST, some of them are in private sector that have spent 10, 20, 30 years sort of researching things that have evolved into standards and encryption algorithms.
• 20:31
  SPEAKER_00: And for us, from day one, the thing we did not want to do, the thing we absolutely want to avoid was custom cryptography.
• 20:39
  SPEAKER_00: Because the best type of cryptography is the cryptography that's been tested, validated, vetted by experts publicly.
• 20:45
  SPEAKER_00: So in our solution, as an example, we use open source encryption libraries that are well known, vetted.
• 20:51
  SPEAKER_00: In some cases, they're sort of approved or supported by NIST.
• 20:55
  SPEAKER_00: And they're not things that if you find you look at, you're like, wait, I've never heard of this.
• 20:58
  SPEAKER_00: That's what we wanted to avoid.
• 21:00
  SPEAKER_00: And we didn't want that to be something that our customers have to think twice about.
• 21:04
  SPEAKER_01: Yeah, it's definitely an area where it's going with the standard that people understand is better because you don't want to get lost down a rat hole trying to explain how your encryption works because someone's concerned about it, right?
• 21:14
  SPEAKER_01: That's right.
• 21:14
  SPEAKER_01: Did you ever get asked about uh encryption questions when you're talking to prospects?
• 21:19
  SPEAKER_00: We do, we do.
• 21:19
  SPEAKER_00: They'll in some cases, like if it's a highly technical team, so there's a very large financial services company we work with, they have a dedicated cryptography team.
• 21:26
  SPEAKER_00: And by that I mean people who are literally, you know, analyzing encryption algorithms, sometimes developing encryption algorithms.
• 21:33
  SPEAKER_00: And we do get sort of in the fine details when we talk to them.
• 21:37
  SPEAKER_00: And they're generally focused on, you know, how are you working with this encryption algorithm?
• 21:40
  SPEAKER_00: How are you able to achieve some of the features that you deliver, things along those lines?
• 21:44
  SPEAKER_00: Um, and then sometimes we just nerd out, sometimes it's casual conversation about hey, did you see NIST after six years of sort of releasing their quantum encryption algorithm project that they've finally down selected, you know, four encryption algorithms?
• 21:58
  SPEAKER_00: And we'll talk about that and sort of how we feel like that's going to change how we do things like secure traffic between websites via SSL.
• 22:06
  SPEAKER_00: So it sort of spans the gamut, but sometimes we do find ourselves in deep technical discussion.
• 22:10
  SPEAKER_01: When you're talking with prospects, I'm wondering what makes a great prospect for you?
• 22:14
  SPEAKER_01: What are you looking for?
• 22:15
  SPEAKER_01: What are you looking to hear from them that would say, yeah, this team gets it, this team might be a good prospect?
• 22:20
  SPEAKER_00: So great question.
• 22:21
  SPEAKER_00: We have our quote unquote qualifying questions, uh, which we typically will try to address them in advance of a call, but on the first call, if we have the opportunity to, first one is absolutely do You handle sensitive data.
• 22:33
  SPEAKER_00: And if the question is an immediate yes, we ask them if they're comfortable sharing.
• 22:37
  SPEAKER_00: You know, what's the nature of that sensitive data?
• 22:39
  SPEAKER_00: And most people will because saying first name, last name is not actually sharing anything private, right?
• 22:43
  SPEAKER_00: But when the answer is no, things get really, really interesting, Andrew.
• 22:47
  SPEAKER_00: And the reason is once we get to a no, we say, well, you know, we notice your application, if it's like a SaaS app or a web UI that's publicly available, that you have some freeform text fields.
• 22:56
  SPEAKER_00: Did you know that most in many cases customers or users will actually input sensitive information in there?
• 23:01
  SPEAKER_00: And they're like, no, I didn't know that.
• 23:03
  SPEAKER_00: Do you track website sort of activity, like usage of your platform?
• 23:06
  SPEAKER_00: And they're like, yeah, we do.
• 23:08
  SPEAKER_00: Do you operate in EU?
• 23:10
  SPEAKER_00: Yes, we do.
• 23:10
  SPEAKER_00: But did you know that could be considered private?
• 23:12
  SPEAKER_00: No, we didn't.
• 23:13
  SPEAKER_00: So when people think sort of sensitive, confidential information, did you only think, oh, financial data, credit cards, bank account number, routing number, first name, last name, address, mothers made a name, but there's a list of 50 or 60 other data types or data classifications that are also considered sensitive.
• 23:30
  SPEAKER_00: And really understanding that is sort of creates a very interesting conversation with customers because it gives them a moment to really think deeply about wait, maybe I do have sensitive data.
• 23:39
  SPEAKER_01: And they're willing to have that discussion with you.
• 23:41
  SPEAKER_00: Yeah, absolutely.
• 23:42
  SPEAKER_00: Because then it becomes what you just said, it becomes a discussion versus, oh, I'm talking to this vendor because I feel like I have a problem or I got introduced to this vendor through a trusted peer and I have to listen to a quote unquote vendor pitch.
• 23:54
  SPEAKER_00: That's what we want to avoid.
• 23:55
  SPEAKER_00: We want it to very much become a discussion.
• 23:56
  SPEAKER_00: And we find that type of question sort of triggers a lot of thought and open dialogue.
• 24:01
  SPEAKER_01: When I think about the market, you know, obviously cybersecurity, there's a ton of there's what, 6,500 apparently, companies, vendors in the cybersecurity space right now.
• 24:09
  SPEAKER_01: In your submarket, though, would you say that it's crowded with lots of people trying to do encryption?
• 24:15
  SPEAKER_01: Or is it well enough defined that most people kind of get the fact that you guys are doing something a little bit different?
• 24:21
  SPEAKER_00: It's a fantastic question.
• 24:22
  SPEAKER_00: I've always wondered why Gartner has never created sort of like an encryption magic quadrant or a space or a focus area myself.
• 24:30
  SPEAKER_00: When I think about encryption in general, it means different things to different people.
• 24:34
  SPEAKER_00: Some people it means transit layer encryption, some people it means sort of at-rest encryption.
• 24:39
  SPEAKER_00: And people typically think of like legacy approaches and solutions, things that were developed 20 years ago, 15 years ago by the likes of RSA as an example, a great company that really pioneered a lot of the encryption that's in use today.
• 24:51
  SPEAKER_00: And what we find is that people don't know that there's a different approach out there.
• 24:57
  SPEAKER_00: A lot of security teams, especially at larger companies, appreciate like there's a gap in the existing approaches, highlight a company that's not actually a security company, MongoDB.
• 25:06
  SPEAKER_00: MongoDB several years ago sort of identified that there's a gap in the market with how encryption is done and that your traditional database encryption is not effective.
• 25:16
  SPEAKER_00: And they ended up spending two years and a ton of resources on developing a solution for their product that helps people perform application-like encryption.
• 25:24
  SPEAKER_00: So I think the market's sort of beginning to identify that there are solutions out there.
• 25:29
  SPEAKER_00: I think from a problem identification point of view, they've known for a while, especially the security teams, that what they used today is not good enough, but there was no alternative.
• 25:36
  SPEAKER_01: Yeah, the whole encryption area, I totally agree with you.
• 25:39
  SPEAKER_01: I mean, so many different things, different people and different use cases are in there.
• 25:42
  SPEAKER_01: It's kind of like say networking or something like that, right?
• 25:45
  SPEAKER_01: It's got uh many very different uses.
• 25:48
  SPEAKER_01: When you think beyond just uh what you're doing right now, though, and think about generally trying to rise above the noise in the market.
• 25:54
  SPEAKER_01: I'm wondering how you're thinking about the go-to-market so that you have a chance of getting the attention of a decent number of people out there who are bombarded already with different messages.
• 26:03
  SPEAKER_00: It's a tough question.
• 26:04
  SPEAKER_00: I think the answer changes probably every six to 12 months as you evolve as a company, as the market shifts.
• 26:10
  SPEAKER_00: And as you know, the security market shifts very rapidly, right?
• 26:13
  SPEAKER_00: Zero trust was a buzzword for, has been a buzzword for many years.
• 26:16
  SPEAKER_00: It's sort of like now everyone identifies it as a buzzword that few people truly understand what it means.
• 26:21
  SPEAKER_00: The next set of sort of buzzwords that I'm sort of observing are a lot of application security-related jargon or shifting left with security.
• 26:29
  SPEAKER_00: How do you sort of get what's been traditionally accomplished via an InfoSec team at an infrastructure layer, whether it's network or storage, or in some cases by an infrastructure team, and how do you sort of move that into the development process?
• 26:41
  SPEAKER_00: And I think there's a lot of talk about it, but there are few practical solutions.
• 26:44
  SPEAKER_00: And what I think about us as a company and the direction we're going in, sort of our immediate focus has been on app layer encryption.
• 26:50
  SPEAKER_00: Help organizations build encryption directly in the app, mitigate that big data theft risk, but then start to think about what other traditional security approaches and tools that are in use today and they've been in use for the last 10 or 20 years, can we deliver via an API?
• 27:06
  SPEAKER_00: And I think from a consumption point of view and how modern companies and modern technology is designed, like it's totally an API model.
• 27:14
  SPEAKER_00: I remember first sort of like becoming a user of Uber and using the app to call my first car in New York because that's where they launched.
• 27:21
  SPEAKER_00: I remember I was in New York.
• 27:22
  SPEAKER_00: Hailing a cab in New York is difficult at certain times of the day.
• 27:25
  SPEAKER_00: So I would open the Uber app, I'm like, man, this map looks really cool.
• 27:28
  SPEAKER_00: Like, this is awesome.
• 27:29
  SPEAKER_00: This is like on par with Google Maps.
• 27:30
  SPEAKER_00: Well, that's because they're using Google Maps API, right?
• 27:33
  SPEAKER_00: They're paying Google.
• 27:34
  SPEAKER_00: Because why should Uber engineer an application to do maps and GPS?
• 27:40
  SPEAKER_00: It doesn't make any sense.
• 27:41
  SPEAKER_00: And their payment infrastructure, like I'm putting in my credit card.
• 27:44
  SPEAKER_00: Well, they're not actually handling all that payment.
• 27:46
  SPEAKER_00: There's a payment gateway behind it called Stripe.
• 27:48
  SPEAKER_00: So the emergence of companies like Stripe and you know, Google moving to an API model, a lot of Amazon services being an API model, our thinking as a company from day one is can we deliver encryption via API?
• 27:58
  SPEAKER_00: And we proved that we could.
• 28:00
  SPEAKER_00: Now we're thinking about as we talk to more and more customers existing in perspective.
• 28:04
  SPEAKER_00: I can't tell you how often, Andrew, they're like, hey, we have this other problem that's sort of not encryption related, but it's this other domain insecurity.
• 28:12
  SPEAKER_00: And the existing solution that we have, it's appliances, it's multi-node clusters, then we have to patch them, maintain them.
• 28:20
  SPEAKER_00: There's a team that has to monitor the uptime.
• 28:22
  SPEAKER_00: Like, do you think the outcome that they're delivering could be delivering it via an API?
• 28:27
  SPEAKER_00: And you know, we do a little bit of discovery and we come back and say, yeah, we think, we think it could.
• 28:32
  SPEAKER_00: Then the next question is, would you be willing to build it?
• 28:34
  SPEAKER_00: And then we have to make a decision as a company.
• 28:36
  SPEAKER_00: Is that something that makes sense for us to sort of expand into is it tangential or is it super complementary?
• 28:42
  SPEAKER_00: Luckily, we haven't been pushed hard in that direction quite yet to move outside of something that's outside of what we sort of are core and where we want to focus on the company long term.
• 28:50
  SPEAKER_00: But there are definitely a few areas where it definitely makes sense.
• 28:53
  SPEAKER_00: So I totally see us expanding in that area.
• 28:55
  SPEAKER_00: Now, that'll present us a challenge because when you're a one product company, your website message, right?
• 29:00
  SPEAKER_00: Your hero message can be super clear because it's I do this one thing.
• 29:03
  SPEAKER_00: But as you start to expand beyond that one thing, that's when things can get really complex.
• 29:07
  SPEAKER_00: And as you know and I know, the larger security companies generally struggle with that because now they have a suite of things and their messaging becomes a little bit more high-level.
• 29:16
  SPEAKER_01: Well, uh, high level is a polite way of saying confusing and abstracted from reality.
• 29:22
  SPEAKER_01: I think that uh but it is a challenge though, right?
• 29:25
  SPEAKER_01: I mean, I think if you move from one to two to three, it's not like you'd be doing encryption and then empty malware and then, you know, I don't know, gateway appliances, right?
• 29:32
  SPEAKER_01: It's gonna be in the realm that you understand, so it's easier to do that.
• 29:36
  SPEAKER_01: Uh the larger companies definitely are challenging with how do we describe this in a manner that does actually mean something to someone.
• 29:42
  SPEAKER_01: There's a company out there right now that I don't think is doing a good job of that.
• 29:46
  SPEAKER_01: Let's say you can stare at their website for a day and still not figure out exactly what they do.
• 29:50
  SPEAKER_01: So uh I think they're missing the mark a little bit.
• 29:53
  SPEAKER_01: But yeah, it's an interesting challenge.
• 29:54
  SPEAKER_01: I think that uh you know the work that I do with companies is sometimes in this realm.
• 29:58
  SPEAKER_01: Like what are the words that we're gonna use in sales situations that means that people will lean in rather than lean out, that people will kind of understand and uh actually want to engage with as opposed to not want to engage with.
• 30:11
  SPEAKER_01: And yeah, too many companies are using a whole bunch of buzzwords and complex technical explanations of what they do and things like that when in reality what people are looking for is you know, what do you do for me?
• 30:21
  SPEAKER_01: And how do you do it?
• 30:22
  SPEAKER_01: And how do you do it different to someone else, right?
• 30:24
  SPEAKER_01: That I may have heard of or not.
• 30:25
  SPEAKER_01: So, you know, when you get that clarity that you have right now about application level security encryption, I think you've got a good foundation right there.
• 30:33
  SPEAKER_00: I appreciate it, Andrew.
• 30:34
  SPEAKER_00: I think back to as a kid, people still used to go door to door and sell things.
• 30:38
  SPEAKER_00: Like they'd come and try to sell you windows.
• 30:40
  SPEAKER_00: I forget the name of the vacuum company, uh, but there's a vacuum company that their salesman would come and then if you let them in their house, in your house, they'd actually use the vacuum on your mattress and be like, look at all this stuff that I got out of the mattress.
• 30:51
  SPEAKER_00: And that sort of was the compelling aha moment from a sales cycle point of view.
• 30:54
  SPEAKER_00: But the reason I bring that story up is because back then, I think as a general population, we had a larger attention span.
• 31:01
  SPEAKER_00: We were less distracted.
• 31:02
  SPEAKER_00: Email wasn't a thing.
• 31:03
  SPEAKER_00: Uh phones weren't a thing.
• 31:04
  SPEAKER_00: Well, smartphones weren't a thing.
• 31:06
  SPEAKER_00: We had home phones, but they're recorded and they're hung up in the kitchen and you there was a sort of length limitation on how far away you could go from the phone, but there were less distractions.
• 31:13
  SPEAKER_00: And that meant that people had more time to talk to you and sort of walk you through their sales process without you sort of knowing it.
• 31:20
  SPEAKER_00: But in a world that's sort of joke and say post-Twitter, where there's a character limitation, like you don't have time.
• 31:27
  SPEAKER_00: And people are so distracted with so many different things, not only at work, but balancing their work life because people are just more accessible now, that you don't have that time and the luxury of hours and hours to sort of get your message across.
• 31:39
  SPEAKER_00: And it's got to be short, it's got to be concise, it's got to be bite-sized, and people got to be able to get it really quickly, or be interested enough to be like, I think I get it, but this sounds interesting.
• 31:48
  SPEAKER_00: I definitely want to talk to these folks.
• 31:49
  SPEAKER_01: Well, in a similar vein, Wise, as you look at the next uh six to 12 months, what are the big decisions that you have to make on the go-to-market side that you're gonna be wrestling with?
• 31:59
  SPEAKER_00: For us, I think the biggest one is where do we focus our lead generation and demand generation efforts?
• 32:06
  SPEAKER_00: We have a number of distinct buyers depending on type of company, size of company, industry.
• 32:11
  SPEAKER_00: And because our customer base spans the largest of the largest and the companies you've never heard of, it's a different sort of motion to attract them to our solution, to help them better understand the problem that we solve and also increase their appreciation for the problem for those that aren't, that may not be aware.
• 32:28
  SPEAKER_00: I think that's the thing that we're sort of thinking through how best to do that.
• 32:31
  SPEAKER_00: Now, the good news is it's sort of in diagram.
• 32:34
  SPEAKER_00: There's overlap between education and awareness that'll span both the large companies and the companies that are sort of less aware of a problem.
• 32:41
  SPEAKER_00: But some of the more deliberate approach, direct to company approach, I think, is where I think we'll see a divergence and we'll have to figure out which one we want to sort of, as they say, place our bets on.
• 32:52
  SPEAKER_01: Yeah, I mean, it's interesting.
• 32:53
  SPEAKER_01: I think people are are suckered by the sexiness of going after the Fortune 50 or the Fortune 100 without realizing the demands that can place on the organization.
• 33:02
  SPEAKER_01: And you have to be ready for that, right?
• 33:04
  SPEAKER_01: Especially in the encryption world, right?
• 33:05
  SPEAKER_01: There's gonna be things that they'll need to have and see and think about processing the data and all sorts of things like that will put pressure on any company about how to deal with them.
• 33:13
  SPEAKER_01: But then you go too small and you think, well, we're doing all this work and we're only getting 50k deals.
• 33:18
  SPEAKER_01: 100k deals.
• 33:19
  SPEAKER_01: It can be frustrating from that standpoint.
• 33:21
  SPEAKER_01: And then the third thing, I guess, is you don't have the resources to go after everyone.
• 33:24
  SPEAKER_01: So where is the Goldilog zone for for UBIC?
• 33:28
  SPEAKER_01: That's the big question, I guess, right?
• 33:30
  SPEAKER_00: Yeah, absolutely.
• 33:30
  SPEAKER_00: And I think the answer to that changes as we learn more, as we talk to more customers and as they sort of you know share more use cases.
• 33:37
  SPEAKER_00: And you know, encryption is one of those things where people know about it.
• 33:40
  SPEAKER_00: Uh, it's been around for a long time.
• 33:42
  SPEAKER_00: They think they understand the space.
• 33:44
  SPEAKER_00: A new solution like ours sort of helps them revisit that thinking, which I think is also a good exercise that just happens very organically as part of our customer engagement.
• 33:53
  SPEAKER_00: But the other thing is for us, one of the things that we were super deliberate about is we will never ship the data back to our infrastructure.
• 34:01
  SPEAKER_00: So our SaaS backend, all customer data resides in their environment.
• 34:04
  SPEAKER_00: And that's a big, big first question that's asked.
• 34:07
  SPEAKER_00: It got asked so many times that we made it something that we spoke about immediately.
• 34:11
  SPEAKER_00: Like as soon as we got to this is what we believe the problem is, here's the solution.
• 34:15
  SPEAKER_00: By the way, the data stays with you because it kept coming up, right?
• 34:18
  SPEAKER_00: And that sort of goes back to what you said.
• 34:20
  SPEAKER_00: Listen to the customer.
• 34:21
  SPEAKER_00: And if it comes up often enough, it's likely going to be top of mind for other companies.
• 34:24
  SPEAKER_00: But sort of coming back to the core of what I wanted to share was use cases.
• 34:28
  SPEAKER_00: Once we're working with companies, understanding those use cases, the more they get comfortable with you, the more they share the use cases.
• 34:34
  SPEAKER_00: And because encryption is generally focused on sensitive data, companies may not be super excited to share details about use cases on the first call.
• 34:41
  SPEAKER_00: That's another learning that we had, right?
• 34:43
  SPEAKER_00: In the early days, we would talk about, and as part of our discovery, be like, what are your data encryption use cases?
• 34:47
  SPEAKER_00: And we sort of usually wouldn't see them do this, but like you could sense that.
• 34:51
  SPEAKER_00: They're like, uh, well, let's talk a little bit more about your solution first.
• 34:55
  SPEAKER_00: But those use cases, that process of that discovery of use cases helps us not only sort of help the customer get across the line with our, you know, sort of a customer position point of view, but once they are a customer, I can't tell you, Andrew, how often we have we have routine monthly checkpoints with most of our customers and how often we're coming up with new use cases.
• 35:16
  SPEAKER_00: And what that means for us is expanded, expanded usage.
• 35:20
  SPEAKER_00: And one of the other things we were super bullish on is we're gonna have a usage-based pricing model, very similar to the likes of Amazon, to the likes of Twilio, sort of a more modern way of doing business.
• 35:31
  SPEAKER_00: And that really resonates with customers because they're like, I don't want to buy stuff if I'm not using it.
• 35:36
  SPEAKER_00: And if I expand my usage, you benefit and I benefit because I'm solving more problems or the same problem in different areas.
• 35:43
  SPEAKER_01: Yeah, the use case expansion is where the opportunity lies, right?
• 35:47
  SPEAKER_01: I remember we were always thinking about starting use cases versus expansion use cases.
• 35:52
  SPEAKER_01: And sometimes if someone's thinking about 35 use cases, they get so confused and lost, at least to inaction.
• 35:57
  SPEAKER_01: So the art is really helping them narrow it down to two or three to get going with and then figure out how they expand from there.
• 36:03
  SPEAKER_01: It's almost like the scene for Braveheart where you stand there, you know, on the battlefield going, hold, hold the line.
• 36:08
  SPEAKER_01: You don't want them to just get too carried away and say, What about this?
• 36:12
  SPEAKER_01: What about that?
• 36:12
  SPEAKER_01: It's like, well, let's keep focused on these two or three right here and uh prove this out and work from there.
• 36:17
  SPEAKER_01: Absolutely.
• 36:18
  SPEAKER_01: Well, Weiss, I've really enjoyed the conversation this afternoon.
• 36:21
  SPEAKER_01: If someone wants to continue the conversation with you and uh get hold of you, what's the best way to do that?
• 36:26
  SPEAKER_00: Connect with me on LinkedIn.
• 36:27
  SPEAKER_00: Uh it's the easiest way.
• 36:28
  SPEAKER_00: Weiss, Isa, W-I-A-S, last name, ISSA, and I'm sure Andrew will include that in the podcast information.
• 36:35
  SPEAKER_01: Yeah, we'll do it for sure.
• 36:36
  SPEAKER_01: Well, listen, I'm rooting for you from over here in Colorado.
• 36:39
  SPEAKER_01: You're in a space that is highly, highly impactful when you see what it can do for organizations.
• 36:45
  SPEAKER_01: Wish you every success in 2022 and beyond.
• 36:48
  SPEAKER_00: Thanks, Andrew.
• 36:49
  SPEAKER_00: Wish you the same, and thanks again for having me.
• 36:51
  SPEAKER_01: Well, what a great guy Weiss is.
• 36:53
  SPEAKER_01: I just really enjoyed that conversation.
• 36:55
  SPEAKER_01: I found it to be very thoughtful and knowledgeable about the area and what he's building, which is just great.
• 37:00
  SPEAKER_01: I had three takeaways that I could have pulled out from the interview.
• 37:04
  SPEAKER_01: The first one was when he made the comment that how easy the product had to be to use for everyone, including developers.
• 37:12
  SPEAKER_01: He said, before a line of code was written, one of the design philosophies was how do we make this so easy that there's no friction in the process for someone adopting it?
• 37:21
  SPEAKER_01: I think that's such an interesting concept because often in cybersecurity, when we're thinking about enterprise products, you know, they're not always that, right?
• 37:28
  SPEAKER_01: Sometimes the ease of use comes secondary or even later in the thinking.
• 37:33
  SPEAKER_01: And yet it's such an important factor in people's willingness to engage with what we have if it's simply easy to use.
• 37:41
  SPEAKER_01: Remove all friction from users and in his case, developers.
• 37:45
  SPEAKER_01: Second takeaway was when I asked him about what he'd learned engaging with early customers, he said that they had to have a completely different story for enterprise versus mid-market prospects.
• 37:57
  SPEAKER_01: He said they give the example, you know, talking to a company with, I think he said 200,000 plus employees, and the one with 1,000, you know, the same story, the same value prop, the same way of describing what you do does not work because they have such different needs.
• 38:11
  SPEAKER_01: And his recommendation was to truly understand what each part of your market that you're targeting, what makes them tick, I think is what he said, what their needs are, how they're different, what they really need to get from the product to be able to use it.
• 38:24
  SPEAKER_01: So I thought that was a really thoughtful uh understanding and learning from him.
• 38:27
  SPEAKER_01: And the third one was that in this area, there's lots of different things you could be doing.
• 38:32
  SPEAKER_01: You know, API encryption as a service.
• 38:34
  SPEAKER_01: And he was saying it was so important to keep focused on what he's building right now and not get distracted and move off into different areas way too early.
• 38:42
  SPEAKER_01: Now, maybe at some point in the future he said that you might be ready for that.
• 38:45
  SPEAKER_01: But right now, keep focused on what you're building at the moment and the problems you're trying to solve at the moment for the target personas and ICP that he has at the moment.
• 38:53
  SPEAKER_01: So those are my takeaways.
• 38:55
  SPEAKER_01: You might have different ones.
• 38:56
  SPEAKER_01: I'd be interested to hear if you had any different ones that you want to share.
• 38:59
  SPEAKER_01: You can do that to me directly on andrew at unstoppable.do.
• 39:04
  SPEAKER_01: And with that, I wish Weiss and Ubik all the success for 2022 and 2023.