Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 135: Giora Engel, Co-Founder and CEO of Neosec, talks unique ways to tackle API security
Transcript
- 0:33SPEAKER_01: As a society, we are so much more connected today technologically than we've ever been in the past.
- 0:39SPEAKER_01: And that's also true in the business world specifically.
- 0:42SPEAKER_01: APIs and other means of passing data around are so common and they've become so important for business.
- 0:48SPEAKER_01: They also present a unique challenge for security teams, though.
- 0:51SPEAKER_01: Neosec has been selected as a finalist in the RSA Innovation Sandbox for the unique way they tackle API security.
- 0:59SPEAKER_01: Find out what they're doing differently in this interview with Giora Engel, their CEO.
- 1:14SPEAKER_01: Welcome to the Sales Bluebird podcast, which exists because at B2B startups it's hard to get consistent traction and scale the sales team.
- 1:23SPEAKER_01: Sales Bluebird provides you tips, tricks, experiences, examples, inspiration, and ideas from people who know a thing or ten about building startups.
- 1:32SPEAKER_01: I'm your host, Andrew Monahan.
- 1:34SPEAKER_01: Our guest today is Giora Engel, the CEO at Neosec.
- 1:38SPEAKER_01: Giora, welcome to Sales Bluebird.
- 1:40SPEAKER_00: Thanks for having me.
- 1:41SPEAKER_01: Yeah, I'm looking forward to this conversation because Neosec was selected as part of the RSA Innovation Sandbox, which I guess by default means you're doing something super innovative.
- 1:50SPEAKER_01: So I'm keen to learn what that's all about and bring that to the audience.
- 1:53SPEAKER_01: But before we get into the business side of this, Giora, I've got 15 questions here to get to know the real you.
- 1:58SPEAKER_01: We're going to do three of them, and I want you to pick a number between one and 15 to get us going.
- 2:03SPEAKER_01: Uh let's say two.
- 2:05SPEAKER_01: Two.
- 2:06SPEAKER_01: Do you prefer a suite of the four seasons or a cabin in the woods?
- 2:10SPEAKER_01: Cabin in the woods for sure.
- 2:11SPEAKER_01: Another number between one and fifteen?
- 2:13SPEAKER_01: Three?
- 2:14SPEAKER_01: Three is do you prefer a trick tight Jeep or German car with all the gadgets?
- 2:19SPEAKER_01: German car with all the gadgets.
- 2:21SPEAKER_01: Cool.
- 2:22SPEAKER_01: All right, one more number.
- 2:24SPEAKER_01: Uh let's say five.
- 2:25SPEAKER_01: Five.
- 2:26SPEAKER_01: iOS or Android?
- 2:27SPEAKER_01: iOS for sure.
- 2:28SPEAKER_01: I mean, only go with the best, right?
- 2:30SPEAKER_01: I mean in our world, right?
- 2:32SPEAKER_01: Some people like to do your own things, right?
- 2:35SPEAKER_01: Build your own, integrate your own.
- 2:37SPEAKER_01: Your phone needs to be a phone and your watch needs to be a watch.
- 2:39SPEAKER_00: So that's like the most important thing.
- 2:41SPEAKER_00: You know what I mean?
- 2:41SPEAKER_01: Yeah.
- 2:42SPEAKER_01: Well, let's get on to the business side.
- 2:44SPEAKER_01: So NeoSec's bringing something to market right now, obviously getting a lot of recognition.
- 2:48SPEAKER_01: I'll set the scene like this.
- 2:49SPEAKER_01: I'm a sales guy and I'm from Scotland, and we're simple people, right?
- 2:53SPEAKER_01: Explain to me what Neosec is all about using language that I would understand.
- 2:56SPEAKER_00: Everything that companies sell today is a digital product, regardless if you're a you know a brick and mortar store or any other uh type of business.
- 3:02SPEAKER_00: I mean, at the end of the day, all of your back end, all of your customer interaction, partner interaction is all digital.
- 3:08SPEAKER_00: It turns out that you know these B2B products are not really protected on the application level.
- 3:12SPEAKER_00: You know, there was a lot of work done in the last years on the infrastructure, but when it comes to the actual applications and APIs, you know, the security teams are completely blind.
- 3:20SPEAKER_00: So NeoSec helps security organizations to discover APIs, to find vulnerabilities, and also to stop abuse, which is kind of the ultimate goal.
- 3:28SPEAKER_01: And what stage are you guys at in your journey?
- 3:31SPEAKER_01: What size are you at?
- 3:31SPEAKER_01: What can you share with us?
- 3:33SPEAKER_00: Yeah, so we're a Series A company.
- 3:35SPEAKER_00: We are already past the 50 employee count, growing very, very fast.
- 3:39SPEAKER_00: I mean, it's a fast growing market.
- 3:40SPEAKER_00: And we got a lot of you know great recognition from the industry just in the last few months, but about throughout the period.
- 3:45SPEAKER_00: Yeah.
- 3:46SPEAKER_01: So what is it that uh Neosec is doing different to others in the same bit of the market is getting the recognition and getting you the accolades such as the innovation sandbox?
- 3:56SPEAKER_00: So maybe to explain that, I um I kind of referred to my previous run.
- 3:59SPEAKER_00: You know, previously I started a company called Light Cyber, and Light Cyber was the inventor of XDR, what's known today as XDR.
- 4:05SPEAKER_00: And today is a pretty big market.
- 4:06SPEAKER_00: We eventually got acquired by Palo Networks and built that over there.
- 4:10SPEAKER_00: And Neilsec is practically like an EDR or an XDR for APIs.
- 4:14SPEAKER_00: And uh that's kind of the core of our innovation.
- 4:16SPEAKER_00: It means that unlike you know, kind of uh old methods of inspecting single requests and looking for signatures, we go much, much deeper and analyze user behavior over time.
- 4:27SPEAKER_00: And you can always go back in time and investigate and threat hunt and all these things that you typically do with an EDR.
- 4:32SPEAKER_00: We kind of brought a very innovative approach to a new market based on some proven success before on you know building the same technologies in an adjusted market in security.
- 4:40SPEAKER_01: So I would imagine then take the situation where, tell me if I'm wrong, right?
- 4:44SPEAKER_01: You baselined what's usual inside a given API.
- 4:47SPEAKER_01: If it suddenly becomes non-usual, different behaviors, different things like that.
- 4:51SPEAKER_01: Is that you identified that and triggered that somehow?
- 4:53SPEAKER_00: Yeah, because I think in the application world, the riskiest access is actually the authorized access.
- 4:58SPEAKER_00: If it's unauthenticated, it's unlikely that you can actually do anything because you know without passing the authentication, you know, the systems don't even uh get your traffic.
- 5:06SPEAKER_00: But once you're authenticated, you can actually do a lot of things, you know, much more than what you uh you know strictly need to do for your process.
- 5:12SPEAKER_00: And I think this is really where the differentiation uh is significant.
- 5:16SPEAKER_00: Because if it's just you know simple attacks, any type of you know, WAF can can do that.
- 5:20SPEAKER_00: You know, people use the OWASP top 10 categories to you know to categorize vulnerabilities.
- 5:25SPEAKER_00: So there are some different uh technologies that can handle some of that.
- 5:27SPEAKER_00: But when it goes to your business logic and abusing that specific business logic, you know, there it really it's really really important to do uh user behavior analytics because there's really no other way that you can you know differentiate between uh you know something that looks legit from a technical perspective, but actually is trying to do something that is not good for your business.
- 5:45SPEAKER_00: So that's kind of the importance of you know of up-leveling that behavioral analytics and analysis process.
- 5:50SPEAKER_01: Right, right.
- 5:51SPEAKER_01: It seems to me in the general scheme of things, API security is relatively new as a concept.
- 5:56SPEAKER_01: I'm wondering how much evangelism that you have to do to help people really understand what the risk is and the depths, let's say, of the differentiation versus the headlines.
- 6:05SPEAKER_00: Yeah, I think when we started the company in 2020, I spoke to a lot of different CISOs and kind of got their take on what are the challenges.
- 6:13SPEAKER_00: So back then we you know we still had to evangelize, but I think at this point in time, everybody knows that it's something that needs to be taken care of.
- 6:20SPEAKER_00: It's still a very nascent market.
- 6:22SPEAKER_00: I mean, let's be honest.
- 6:23SPEAKER_00: I mean, the market doesn't become mature in two years from scratch.
- 6:26SPEAKER_00: But I think you know, people are actually looking to be educated.
- 6:29SPEAKER_00: Sometimes they're actually looking at you know different products, and you know, we're part of a bake-off.
- 6:33SPEAKER_00: Sometimes it's uh one of the first discussions, but they already know that they need to do something about it, which is you know is a great point in time.
- 6:38SPEAKER_01: And are they mature enough in their thinking to understand and maybe have examples of the big impacts that happen if they don't figure this out?
- 6:46SPEAKER_01: Or is it still a little bit, you know, it seems like a good idea?
- 6:48SPEAKER_00: Yeah, I think people realize today, I mean, it's something that is kind of easy to explain in this case.
- 6:52SPEAKER_00: I mean, sometimes security becomes very, very technical and you don't need to understand what's the impact.
- 6:56SPEAKER_00: But here the impact is actually pretty clear because if you're not protecting your APIs, that's a direct product to your most sensitive business logic, right?
- 7:03SPEAKER_00: So all the PII and customer information and transactions, this is all you know exposed to APIs by design because you have some kind of digital process for selling your product or services.
- 7:13SPEAKER_00: So if you don't protect these APIs, if you don't have an inventory, if you don't stop abuse, you know, that directly you know hits your core business.
- 7:20SPEAKER_00: And there are always people that want to play with your core business in different ways.
- 7:23SPEAKER_00: You have to do that.
- 7:24SPEAKER_00: There's no other option.
- 7:25SPEAKER_01: So they might understand the impact.
- 7:26SPEAKER_01: Is there anything you have to do with people to think about urgency?
- 7:31SPEAKER_01: You know, they've been going for years, right, without having this figured out.
- 7:34SPEAKER_01: What's gonna cause them to actually make a move right now and buy something?
- 7:38SPEAKER_00: So, first of all, I I think there are some things that we're going for years, but I think there is an inflection point here.
- 7:43SPEAKER_00: There's a reason why it becomes so relevant now as opposed to five years ago.
- 7:48SPEAKER_00: The reason is that the number of new B2B APIs uh that people are developing and exposing to the outside is skyrocketing.
- 7:55SPEAKER_00: I mean, it used to be close to zero five years ago.
- 7:58SPEAKER_00: With today's way of doing business and partnerships and integrating between systems, that's the new network, so to speak.
- 8:04SPEAKER_00: I'll give you an example.
- 8:05SPEAKER_00: Let's say a financial institution, you know, they have a web application.
- 8:07SPEAKER_00: You know, they had that web application for many years, let's say 20 years or 15.
- 8:11SPEAKER_00: So that is not new.
- 8:13SPEAKER_00: They have some security controls there.
- 8:14SPEAKER_00: There's always things to improve, you know, everything is becoming APIs today.
- 8:18SPEAKER_00: So that's great.
- 8:19SPEAKER_00: That's one use case.
- 8:20SPEAKER_00: But in addition to that web application today, they have like a hundred different B2B channels that they opened in the last couple of years for all sorts of new digital products and partnerships and other integrations.
- 8:31SPEAKER_00: So these hundred channels are all of a sudden like you know, many more compared to the one web application that they know how to protect.
- 8:38SPEAKER_00: And interestingly enough, B2B channels cannot be protected using like web protection technologies.
- 8:43SPEAKER_00: They don't really map, even though it's very similar from a technical perspective.
- 8:46SPEAKER_00: There are differences that make it impossible to just use the same thing.
- 8:49SPEAKER_00: So this is really why it's becoming so critical today, because you know, all of a sudden you realize that your whole business is running through these APIs, but you know, you don't even have the slightest visibility from a security perspective.
- 8:59SPEAKER_01: And I imagine if you ask them the question, you know, do you see yourself having more APIs or less APIs in five years' time, it might uh give them some urgency as well, right?
- 9:08SPEAKER_00: Yeah, I think they know, I mean, that's part of the business strategy that are going to have like 10x more than they ever had like in a few years, just because you know that's how people develop their businesses today.
- 9:17SPEAKER_00: That you know, the digital transformation is key for any type of business.
- 9:20SPEAKER_00: So that's why the security team knows that if they want to be relevant and actually protect their business, they have to be very deep in that product security, application security area.
- 9:29SPEAKER_00: And therefore, API security is an essential part of their future as opposed to infrastructure security that they've you know they led in the past.
- 9:37SPEAKER_01: I'm wondering if there's certain types of companies or types of persona that you target that you look for, right?
- 9:44SPEAKER_01: These, if they're like this, they're much more in tune with the need than others.
- 9:48SPEAKER_01: Do you have like mapped out like that?
- 9:50SPEAKER_00: Yeah, for us, it's typically on the security side, not so much on the developer side.
- 9:54SPEAKER_00: Even though developers have you know a lot of benefits of using our platform, they're typically not the project owners.
- 9:59SPEAKER_00: On the security side, we noticed that in on many cases, it's really the top leadership, like you know, the CISO or one of their directory ports that are interested specifically in that topic because it's a new topic.
- 10:10SPEAKER_00: I mean, it's not something that is just an addition to what they had, it's a new um knowledge that they need to build and so on.
- 10:16SPEAKER_00: So it really comes, you know, from in many cases from the top.
- 10:18SPEAKER_00: Uh, plus the application to the business processes is kind of very direct.
- 10:22SPEAKER_00: So in many cases, we start the discussion that way.
- 10:24SPEAKER_00: And of course, as we go through the process, we work with the security engineering team and you know, kind of a standard enterprise security sale type of thing.
- 10:30SPEAKER_01: Is there any verticals that are more up to speed than others?
- 10:34SPEAKER_00: Oh, yeah.
- 10:34SPEAKER_00: So interestingly, we we see a lot of demand you know, from different verticals and different sizes of companies.
- 10:40SPEAKER_00: Like on one hand, there are those giant, you know, largest companies, largest healthcare, largest financial institutions, you know, that need a solution because they have so many of these new services that they're developing right now.
- 10:51SPEAKER_00: So this is like one type of interest that we get.
- 10:53SPEAKER_00: And we actually get a lot of inbounds of that kind, you know, because they have they marked it as an area that we need to work on to improve on.
- 10:59SPEAKER_00: That's one of them.
- 11:00SPEAKER_00: In addition to that, we also get a lot of uh other companies like you can imagine all these digital native companies delivering only a digital product and kind of focusing on one type of product.
- 11:09SPEAKER_00: So there are many, many of those.
- 11:10SPEAKER_00: Typically, those companies were not considered enterprise companies, you know, from a security perspective, because you know, they don't have a huge workforce, you know, they don't have a huge data center, uh, they're all in the cloud.
- 11:21SPEAKER_00: But from an API perspective, sometimes the digital native company is actually bigger than kind of a big brick and mortar company because you know they have all of their businesses digital, everything is going through APIs.
- 11:32SPEAKER_00: So that sometimes it's actually, I mean, the size of the company in terms of people is not necessarily the size of the problem.
- 11:37SPEAKER_01: Yeah, in fact, I imagine it's probably misleading in many ways, right?
- 11:40SPEAKER_01: Big might not be that good.
- 11:42SPEAKER_01: Talking about uh sales teams, have you started building the team already?
- 11:45SPEAKER_01: And how did you decide to get going with a go to market team?
- 11:48SPEAKER_00: Yes, one of the decisions that we made early on is to focus on the US market because you know the demand is you know the strongest and you know the most clear in the US market.
- 11:56SPEAKER_00: You know, therefore, most of our focus today is really on the US market.
- 12:00SPEAKER_00: I think the benefit of doing it that way is that you can really focus the product market fit on the lead-in market.
- 12:05SPEAKER_00: We all know that if we win the US market, we win in any market.
- 12:08SPEAKER_00: I mean, at the end of the day.
- 12:09SPEAKER_00: So that's really one decision that we made.
- 12:11SPEAKER_00: And it also enabled us to make you know other great decisions on the product side, you know, to support the best growth for US market.
- 12:17SPEAKER_00: And what was the first hire then in the sales team?
- 12:20SPEAKER_00: We hired sales leaders for you know for different regions in the US in a VP of sales, yeah.
- 12:25SPEAKER_01: Okay, so you started with leadership and then kind of came down from there, it sounds like.
- 12:28SPEAKER_01: I'm just interested because people approach it from different angles.
- 12:30SPEAKER_00: Yeah, I think my approach is that you need to see that it's actually working, you know, before you're you're bringing just people managers and just hiring people.
- 12:38SPEAKER_00: You can always hire, but if you hire the wrong people and if you don't really know the sales process, which you you can never guess it without doing it yourself.
- 12:45SPEAKER_00: So I think it's really important to start it the right way.
- 12:48SPEAKER_00: Because you know, otherwise you can build like a whole pyramid of like a whole big organization like worldwide, hire uh you know CROs and VPs and different countries and all of that.
- 12:57SPEAKER_00: You know, it looks nice on the PR side, but if you actually look at the efficiency, it will be zero in most places because whatever works in one company doesn't work exactly the same in another company.
- 13:06SPEAKER_00: I mean, I have so many examples from my previous run, you know, versus Neosec, even though it's the same type of buyer, things are just different.
- 13:12SPEAKER_00: The market is different and you know, the product is different, the problem space is different.
- 13:16SPEAKER_01: Have you seen then between the two companies things speed up or slow down?
- 13:19SPEAKER_01: Or what's the difference then between a few years ago?
- 13:22SPEAKER_00: So I think one big difference is that you know the API security market is growing much, much faster than you know what the NDR and XDR market that we built in in Night Cyber.
- 13:31SPEAKER_00: You know, just in a matter of calendar time, it's like you know, within two years it became one of the hottest topics in security and so much uh healthy competition on the space and so on, and partner coverage and everything of that kind.
- 13:42SPEAKER_00: So I think the market is definitely moving faster.
- 13:45SPEAKER_00: It's great for us that it's also moving in in our direction, like in the end of the day.
- 13:49SPEAKER_00: Another thing is that you know people are working differently today.
- 13:52SPEAKER_00: I mean, people work remotely.
- 13:54SPEAKER_00: And uh it's interesting because you know you used to have to be you know physically meeting with people before and implementing it on site, even though it's a kind of a cloud delivered product, but still, you know, you need to have these meetings and so on.
- 14:05SPEAKER_00: Today, most people actually prefer to do it remotely, which actually makes it easier for us to you know to cover more grounds.
- 14:12SPEAKER_00: I mean, we always prefer to have a personal interaction if we can, because we believe in personal interactions, but you know, the the reality is that you know most of the things are remote today because for the customer it's better.
- 14:23SPEAKER_01: Yeah.
- 14:23SPEAKER_00: And there are many other differences as well.
- 14:25SPEAKER_01: Sure.
- 14:25SPEAKER_01: Do you remember your first customer in the US when you won that first deal?
- 14:29SPEAKER_01: Oh, of course.
- 14:29SPEAKER_01: I mean, that how can you forget that?
- 14:31SPEAKER_01: Maybe not mention the name, but uh do you remember what source it came from, how you found it, and how it progressed?
- 14:37SPEAKER_00: So for us, it came from the channel.
- 14:38SPEAKER_00: You know, we're a channel company, we work very, very closely with our channels, you know, we don't undercut our channels.
- 14:43SPEAKER_00: So, you know, it was a classical case.
- 14:44SPEAKER_00: It came from one of the channels that was also our um our first US channel in my previous company, happened to be.
- 14:50SPEAKER_00: And by the way, interestingly, you know, great channels that we worked with before are not necessarily great for this company.
- 14:55SPEAKER_00: It's not always the same.
- 14:56SPEAKER_00: Sometimes it is the same, sometimes not.
- 14:58SPEAKER_00: Today we actually get a lot of uh traction from other channels, some of the biggest channels.
- 15:03SPEAKER_00: I mean, it's it's just different.
- 15:04SPEAKER_00: But yeah, I mean it came from a channel, and I think it's a good testament for our type of business and what we're building.
- 15:08SPEAKER_00: I think this is exactly the kind of a good model for other uh customers as well.
- 15:12SPEAKER_01: It really is.
- 15:13SPEAKER_01: I mean, I think one of the things that people have believed to be true in the past is you can't rely on channel to help you build a market or build your business early stage, right?
- 15:20SPEAKER_01: They tend to react as opposed to be proactive, but maybe not in this case, it sounds like.
- 15:25SPEAKER_00: I think it's a combination, right?
- 15:26SPEAKER_00: I mean, we can't rely just on the channel, but we always work and fulfill through the channel because we believe that this is the you know, this is the long-term plan.
- 15:33SPEAKER_00: So even if we source the deal, we'll make sure that you know the channel gets involved in the right time.
- 15:37SPEAKER_00: Good, good.
- 15:38SPEAKER_00: Are you hiring right now at uh Neosec Euro?
- 15:41SPEAKER_00: Oh yeah, for sure.
- 15:41SPEAKER_00: You know, both in RD and sales and marketing everywhere.
- 15:44SPEAKER_01: Is the best place just to go to careers at uh neosec.com?
- 15:48SPEAKER_01: Yeah.
- 15:48SPEAKER_01: And if someone wants to get hold of you to talk further, how do you encourage them to do that?
- 15:52SPEAKER_00: Someone like a customer or like anybody?
- 15:54SPEAKER_00: I mean, actually, you know, LinkedIn is probably the best way.
- 15:57SPEAKER_00: Okay.
- 15:57SPEAKER_00: I'm pretty active on LinkedIn.
- 15:58SPEAKER_00: And by the way, I mean, I actually would love to share that.
- 16:01SPEAKER_00: I actually use LinkedIn even to connect to CISOs because you know I learned so much from these people and I really you know respect you know what they do and how they think about things.
- 16:08SPEAKER_00: I make sure that I always you know connect with people that I believe are you know have something interesting to share or some opinion about what we're doing or their problem and so on.
- 16:17SPEAKER_00: So I I'm also you know very happy to connect to people that are not, you know, that are not like automated sales bots.
- 16:22SPEAKER_00: Uh I mean we we all get you know all these uh automated emails, but you know, when it's an actual person speaking to you, I think that you know LinkedIn is actually a great way to it is much better than email, right?
- 16:31SPEAKER_01: From that standpoint.
- 16:31SPEAKER_00: Yeah.
- 16:32SPEAKER_01: Well, listen, Giora, I've enjoyed our conversation.
- 16:34SPEAKER_01: I wish you every success uh with the innovation sandbox this year, but also for 2022 and beyond.
- 16:39SPEAKER_01: Sounds like you're on a great trajectory in a great spot.
- 16:42SPEAKER_01: Thank you.
- 16:43SPEAKER_01: I enjoyed that conversation with Giora.
- 16:45SPEAKER_01: Clearly, he's experienced in the entrepreneurial world uh with his prior success with Lightsaber and his learnings from that, and super focused right now in API security.
- 16:55SPEAKER_01: My three takeaways from talking with him were first of all, that he learned a lot from working with Lightsaber, which was in the XDR MDR world, and he brought some of those learnings and some of the important aspects of that to the world of API security.
- 17:11SPEAKER_01: So I took that as a takeaway that was really interesting.
- 17:13SPEAKER_01: Secondly, he was saying the number of APIs is skyrocketing right now, and that people, buyers, economic buyers, they intuitively know that.
- 17:22SPEAKER_01: But what that's giving them is the why now for people to actually spend some money, right?
- 17:28SPEAKER_01: If buyers are aware that the APIs are there and they're growing so much, it almost puts them in a spot where they have to do something right now before it gets completely out of hand.
- 17:36SPEAKER_01: So I thought that was interesting how Jura explained that.
- 17:39SPEAKER_01: And then finally, you know, he tackled the US market first from a sales perspective.
- 17:42SPEAKER_01: You know, he viewed it as the most advanced market that there was that there is, and if he can do it here, he can do it anywhere.
- 17:49SPEAKER_01: So those were my three takeaways.
- 17:51SPEAKER_01: You may have different ones, but I wish Jura and Neosec the best of luck and success in the innovation sandbox and for the rest of twenty two and twenty three.