Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 147: Snir Ben Shimol, CSO at Cider, talks about market education & selling into the unknown

Transcript

147: Snir Ben Shimol, CSO at Cider, talks about market education & selling into the unknown · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: One of the hardest things a startup has to do in cybersecurity is communicate a message in a way that means they stand out in a crowded market.
• 0:41
  SPEAKER_00: Find out how Cybersecurity is doing this, and lots more with Ben Chimon, their chief strategy officer.
• 0:58
  SPEAKER_00: Welcome to the Sales Bluebird podcast, which exists because at cybersecurity startups, it's hard to get to repeatability and scale the business.
• 1:07
  SPEAKER_00: Sales Bluebird provides you with tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or 10 about building great cybersecurity companies.
• 1:18
  SPEAKER_00: I am your host, Andrew Monahan.
• 1:20
  SPEAKER_00: Our guest today is Sneer Ben Shimol, Chief Strategy Officer at Cider Security.
• 1:25
  SPEAKER_00: Ben, welcome to Sales Bluebird.
• 1:27
  SPEAKER_01: Thank you, Andrew.
• 1:28
  SPEAKER_01: It's a pleasure being here.
• 1:29
  SPEAKER_01: I love your podcast.
• 1:31
  SPEAKER_01: Listen to it every time in the gym.
• 1:33
  SPEAKER_01: So happy to be here.
• 1:34
  SPEAKER_01: It's a pleasure.
• 1:35
  SPEAKER_00: Well, it's great to have you on, and thanks for the kind words.
• 1:37
  SPEAKER_00: It's something I really enjoy doing, chatting to some great people and learning about all the latest, greatest uh companies out there in our space.
• 1:43
  SPEAKER_00: What I would do first of all is ask the listeners, if you too enjoy the podcast, enjoy the newsletter as well, please would you go to salesbluebird.com.
• 1:52
  SPEAKER_00: If you see in the top menu, there's an option that's called the Wall of Love.
• 1:56
  SPEAKER_00: And in there, you can not only see what others have said nice about the podcast, but also give your own testimonial and review in there as well.
• 2:03
  SPEAKER_00: Things like that really help drive the future of the podcast and the newsletter.
• 2:09
  SPEAKER_00: And it really makes a difference when we're attracting great guests and also more listeners down the line.
• 2:13
  SPEAKER_00: So salesbluebird.com and the top menu, there's the wall of love.
• 2:18
  SPEAKER_00: Ben, let's get back to you.
• 2:19
  SPEAKER_00: Before we get to business though, let's get to know the real you.
• 2:23
  SPEAKER_00: I have 35, believe it or not, questions on my list here.
• 2:28
  SPEAKER_00: The good news is I won't be asking you all 35.
• 2:32
  SPEAKER_00: What I'm gonna ask you to do is pick three numbers between one and 35, and I'll give you the question that it corresponds to.
• 2:38
  SPEAKER_00: Does that sound good?
• 2:39
  SPEAKER_00: Sounds great.
• 2:40
  SPEAKER_01: Yeah, so let's start with 12.
• 2:42
  SPEAKER_00: They say home is where the heart is.
• 2:45
  SPEAKER_00: Where is home for you?
• 2:48
  SPEAKER_01: Home is where my wife is currently in Jersey City, New Jersey.
• 2:53
  SPEAKER_00: How long have you been in Jersey City for?
• 2:55
  SPEAKER_01: Actually, I'm a newcomer.
• 2:56
  SPEAKER_01: I lived in the city for a few years, lived in Tel Aviv, and then moved five years ago to the state.
• 3:02
  SPEAKER_01: And I'm in Jersey City for one year, almost one year.
• 3:06
  SPEAKER_00: Yeah.
• 3:07
  SPEAKER_00: That's awesome.
• 3:07
  SPEAKER_00: All right.
• 3:08
  SPEAKER_00: Next number team, one in 35.
• 3:10
  SPEAKER_00: Let's go with 30.
• 3:11
  SPEAKER_00: High numbers.
• 3:13
  SPEAKER_00: 30.
• 3:13
  SPEAKER_00: Favorite vacation destination.
• 3:16
  SPEAKER_01: Whoo, definitely Costa Rica.
• 3:19
  SPEAKER_01: Oh, why Costa Rica?
• 3:20
  SPEAKER_01: I love to surf.
• 3:21
  SPEAKER_01: I like the nature.
• 3:22
  SPEAKER_01: I love the people.
• 3:23
  SPEAKER_01: So Costa Rica is one of my favorites.
• 3:27
  SPEAKER_00: You know, I've not been to Costa Rica, but I've heard great things about it.
• 3:30
  SPEAKER_00: A couple of folks in my world of doing sales consulting and training, they run a surf and sales event where I think two or three times a year they go down with a small group of salespeople to have a mini conference and do some surfing at the same time.
• 3:43
  SPEAKER_00: And it sounds like a really, really good idea.
• 3:45
  SPEAKER_00: And that's the safe surfing sales.
• 3:47
  SPEAKER_00: Well, sign me in, Andrew.
• 3:48
  SPEAKER_00: Yeah.
• 3:49
  SPEAKER_00: Last number of team, one in 35.
• 3:51
  SPEAKER_01: Let's take number five.
• 3:53
  SPEAKER_00: Number five, iOS or Android?
• 3:56
  SPEAKER_00: iOS for me.
• 3:57
  SPEAKER_00: All the way?
• 3:58
  SPEAKER_00: Have you ever diverted paths on that?
• 4:01
  SPEAKER_01: Yeah, I converted from Android.
• 4:03
  SPEAKER_01: So I'm a security guy.
• 4:05
  SPEAKER_01: I love to, you know, manipulate things.
• 4:07
  SPEAKER_01: So if I need to hack, I'd rather to hack an Android.
• 4:10
  SPEAKER_01: This is why I choose iOS, because in my job, I want to make everything like very complicated and go deep into the weeds.
• 4:19
  SPEAKER_01: But in my personal life, I'm tired.
• 4:22
  SPEAKER_01: I want everything to be more simple.
• 4:25
  SPEAKER_01: This is why I'm just using Apple.
• 4:27
  SPEAKER_00: Yeah, I think that rings true for a lot of people.
• 4:29
  SPEAKER_00: So yeah, it's easier.
• 4:30
  SPEAKER_01: Just easier.
• 4:30
  SPEAKER_01: It's not better, it's just easier for me.
• 4:32
  SPEAKER_00: Yeah, if you look at the specs, there's not too much difference as far as I can work out in terms of just simplicity and I guess what you're used to, right?
• 4:38
  SPEAKER_00: As well.
• 4:39
  SPEAKER_00: It just uh seems an obvious choice for many.
• 4:41
  SPEAKER_00: Well, let's talk about business then, Ben.
• 4:43
  SPEAKER_00: You're the chief strategy officer at Cider Security.
• 4:46
  SPEAKER_00: Why don't we start with where is Cider on their journey?
• 4:50
  SPEAKER_00: Anything you can share about size, number of employees really help us put this in a frame.
• 4:55
  SPEAKER_01: Yeah, of course.
• 4:56
  SPEAKER_01: Uh we're in a very exciting phase in the company.
• 4:59
  SPEAKER_01: We're just over 70 employees globally.
• 5:03
  SPEAKER_01: And we went out of sales like half a year ago, maybe slightly than half a year ago.
• 5:08
  SPEAKER_01: And this was right before our A round.
• 5:11
  SPEAKER_01: So we're backed by uh GlyLote and a Tiger Capital, and this is where we are very like hyper-growth type of phase.
• 5:19
  SPEAKER_00: And what does CIDR do?
• 5:21
  SPEAKER_01: Yeah, that's a big question.
• 5:22
  SPEAKER_01: So we're doing a lot, but at the end of the day, we are the first ever AppSecOS, application security operation system.
• 5:29
  SPEAKER_01: And everybody asks us what it means.
• 5:32
  SPEAKER_01: So basically, we're in 2022, application security with cloud security, it's like a huge scope is huge.
• 5:40
  SPEAKER_01: And everyone today to build their application security strategy, planning and operation needs in AppSecOS.
• 5:48
  SPEAKER_01: So, what we're doing is we're providing end-to-end visibility, asset inventory, risk detection, and orchestration to the entire engineering ecosystem, which include everything from your code and third parties and CICD system, build system, all the way to production.
• 6:06
  SPEAKER_00: So I've heard the phrase a lot recently: shift left, right?
• 6:10
  SPEAKER_00: People look wanting to do take more security in earlier in the cycle.
• 6:14
  SPEAKER_00: Is this analogous with that, or are you thinking about, well, let's do it properly, let's think bigger about this app sec OS that you mentioned?
• 6:22
  SPEAKER_01: Yeah, I will say the latter.
• 6:24
  SPEAKER_01: I think shift left is the right way to go, but as left as you go, the more questions you have.
• 6:31
  SPEAKER_01: In security, it's also as much as you see, and the many places you actually monitor and collate the information from, you have more knowledge in order to take action.
• 6:43
  SPEAKER_01: The problem with going all the way left is using the code.
• 6:46
  SPEAKER_01: The problem with not going all the way left and going all the way right is just I'm looking on production when you know the vulnerabilities and the risk are already in production, already affecting me and my customers.
• 6:59
  SPEAKER_01: So our idea and our approach is unique, and something that's very unique for us, like I believe that Cider is doing, is we're going all the way left, we're looking on the code, but we're doing the journey of your application security program in the code and from the code to the pipeline, from the pipeline to the build system, and also to the artifact management, and then to the container image, and then to the pod, all the way to the actual production system that's running that code that we're looking at.
• 7:35
  SPEAKER_01: So our idea is to do the shift left, but not only, because shift left is only going to solve some of the problems when you're looking on application and engineering ecosystem today.
• 7:47
  SPEAKER_01: They're complex, they're constantly changing.
• 7:50
  SPEAKER_01: Organization are buying and doing some MAs and getting some more developers that are using more languages and using more technologies that even the best security guys they don't understand how to secure.
• 8:02
  SPEAKER_01: You don't have best practices today for things like Jenkins and Circle CI and JFrog.
• 8:08
  SPEAKER_01: It's really, really hard to kind of have a list of what do I need to do in order to secure those systems.
• 8:14
  SPEAKER_01: So, what we're actually providing is we're actually doing the shift left.
• 8:18
  SPEAKER_01: We're looking on the code, but the code is not everything.
• 8:21
  SPEAKER_01: It's only a 30% person of the problems that security teams need to face when they're trying to do appsec in today's world.
• 8:30
  SPEAKER_01: In today's CICD, complicated supply chain, third parties type of situation.
• 8:37
  SPEAKER_01: So this is our take there.
• 8:39
  SPEAKER_01: Shift left is great, but it's only one piece of a puzzle.
• 8:43
  SPEAKER_00: One piece of it, yeah.
• 8:44
  SPEAKER_00: You talked a lot about that whole process right there.
• 8:47
  SPEAKER_00: What are people doing right now to try and control it all and get visibility into all, if anything?
• 8:53
  SPEAKER_01: Yeah, I think today we're finding ourselves with many organizations that don't even know where to look and why, but they actually have the questions that they want to get answers to, but they just don't quite understand how all the components are building in together to answer those questions.
• 9:12
  SPEAKER_01: So the good thing about cloud and application security in 2022, it's a lot of SaaS.
• 9:18
  SPEAKER_01: It's a lot of application and technology which are new, so no one actually knows correctly how to secure them, but on the same time, because it's new technology, the integration is very easy.
• 9:28
  SPEAKER_01: So because we have a very easy integration and it's very easy to integrate with those, you know, engineering ecosystem, CICD, SCM, build system, it's very easy for us to plug in all those systems and get the information we need.
• 9:43
  SPEAKER_01: Once we do that, after we have those integrations in place, our system knows how to calculate everything and present you how your engineering ecosystem looks like.
• 9:53
  SPEAKER_01: What's the interconnectivity, how the processes are running, how the code affects the build, affects the production, where are the risks, and if the risk actually a risk, right?
• 10:05
  SPEAKER_01: So I think everything starts with visibility and getting the visibility and know what to do with the information, it's the secret to us.
• 10:13
  SPEAKER_00: And how much of it when you talk to prospects is evangelizing the need to do anything, and how much of it is just fulfilling a desire they've already got to do something?
• 10:24
  SPEAKER_01: Wow, I love this question because it's going into one of the biggest challenges that we're really excited to kind of take on us and solve, which is market education.
• 10:36
  SPEAKER_01: Application security exists for many years.
• 10:38
  SPEAKER_01: As you well know, everybody knows that they need to scan their code, right?
• 10:42
  SPEAKER_01: Everybody knows that they need to run some vulnerability scanning.
• 10:45
  SPEAKER_01: SQL injection and XSS and all those vulnerabilities exist for like decades.
• 10:50
  SPEAKER_01: The problem today is those vulnerabilities are only a small portion of what organizations are facing.
• 10:57
  SPEAKER_01: And we are finding ourselves doing a lot of market education.
• 11:01
  SPEAKER_01: But not only that, we also enabling security experts, uh, understanding the risk of those new systems.
• 11:11
  SPEAKER_01: And much of our efforts are through the security community.
• 11:16
  SPEAKER_01: So every time we're talking to a prospect, the first question I will ask is: Did you see our top 10 CICD risk?
• 11:24
  SPEAKER_01: Have you heard about our top 10 CI CD risk project?
• 11:27
  SPEAKER_01: So what we actually did is even like during the time we were building the product, we built the top 10 risk landscape of the new age of engineering ecosystem, which based on not only the code, but also infrastructure as code and build systems like Jenkins and CircleCI and Git Actions and Artifact Management System and production system, how they actually presenting new vulnerabilities and new risks that no one actually heard about.
• 11:57
  SPEAKER_01: So we did this project with all the industry leaders, CISOs from the Silicon Valley all the way to Israel.
• 12:04
  SPEAKER_01: And we spent almost a year to build the top 10 CICD risks.
• 12:08
  SPEAKER_01: It's available to everyone.
• 12:09
  SPEAKER_01: You don't need to sign up, you don't need to provide your details.
• 12:13
  SPEAKER_01: We're actually providing it as a service to the security community to make sure everyone is aware of those risks.
• 12:19
  SPEAKER_01: Once you are aware of those new threat landscape that those environments represent, then you need to ask yourself, okay, so how can I protect them?
• 12:29
  SPEAKER_01: And this is where the conversation about our technology and our product become like this conversation will be easier and it will touch specific pain points.
• 12:38
  SPEAKER_01: Saying that, those are the new risks.
• 12:40
  SPEAKER_01: We also covering the risk that everybody knows, and a lot of pain points that application security, as we all know it, did not move forward as fast as threat detection and response or threat hunting technologies.
• 12:55
  SPEAKER_01: Application security kind of left behind for many years.
• 12:58
  SPEAKER_01: And now with all the attacks like Lock4J and Spring4Shell, organization are looking for answers.
• 13:04
  SPEAKER_01: And it's kind of boggling my mind that in 2022 we don't have that out-of-the-box technology to give us a simple answer.
• 13:11
  SPEAKER_01: Do I have this technology running in my production system?
• 13:15
  SPEAKER_01: So those are some of the core problems that we are solving.
• 13:19
  SPEAKER_00: Yeah, I imagine it sounded like from what you're saying, your top 10 risk is part education, but part you know thought leadership and using as a almost a marketing tool, right?
• 13:27
  SPEAKER_00: To help drive drive leads and drive business for you.
• 13:30
  SPEAKER_00: Exactly.
• 13:31
  SPEAKER_01: Yeah, you know, at the end of the day, technical marketing is key as well.
• 13:35
  SPEAKER_00: Yeah.
• 13:35
  SPEAKER_00: Well, let's take a shift over then to the the go-to-market side.
• 13:39
  SPEAKER_00: Interesting space.
• 13:40
  SPEAKER_00: Do you target the developers themselves or the leaders, or is it the security side that tends to bring you in?
• 13:47
  SPEAKER_01: Yeah, so it really depends on the size of go of the organization.
• 13:52
  SPEAKER_01: So if we're talking about mid-size and enterprise, they tend to have an application security manager, director of AppSec, or maybe even a product security manager.
• 14:03
  SPEAKER_01: Someone that, if you're a software company, a SaaS company, you have someone that's in charge that the products and the services you provide as a vendor are secure.
• 14:13
  SPEAKER_01: So this is more around mid-market and enterprise.
• 14:17
  SPEAKER_01: If you're looking more on like SB and growth segments in the smaller companies, like 100 people, startups, it's normally the CTO or VCO that in charge of everything engineering.
• 14:31
  SPEAKER_01: And sometimes it's even the VPRD, right?
• 14:34
  SPEAKER_01: The VPR and D that kind of like oversees the security.
• 14:39
  SPEAKER_01: And sometimes it's even the director of DevOps because most of the risk related to the DevOps system, the system that actually taking the code and deploying them into production.
• 14:49
  SPEAKER_01: So it's different from the size of the organization.
• 14:53
  SPEAKER_01: At the end of the day, it's most likely to be the CISO to sign the check and manage the software.
• 15:00
  SPEAKER_00: Yeah.
• 15:01
  SPEAKER_00: So different influencers and buyers, depending on the size of the organization, that must put a lot of stress on your team to say, well, how are we going to reach all these different types of people, which will have different messages?
• 15:11
  SPEAKER_00: I mean, the DevSecOps DevOps person is going to have a very different message than the AppSec manager or the CISO, I would imagine, right?
• 15:18
  SPEAKER_01: Yeah, and this is why you just nailed it.
• 15:20
  SPEAKER_01: Like, let's talk about the outbound, right?
• 15:22
  SPEAKER_01: So the outbound and the reach out, we divided it to different types of segments.
• 15:27
  SPEAKER_01: We also divide it to different types of roles.
• 15:29
  SPEAKER_01: Sometimes only the technical teams will kind of understand the pain and will lead the conversation.
• 15:35
  SPEAKER_01: And then from there, you will move up in the chain by the time you'll get to the CISO.
• 15:40
  SPEAKER_01: So those messaging are more around technical risk and so on.
• 15:44
  SPEAKER_01: So we have a dedicated messaging around that.
• 15:47
  SPEAKER_01: And we're also developing a lot of open source, a lot of security tools.
• 15:51
  SPEAKER_01: And the industry loves it when you use one of our security tools or you base your security on our top 10 CICD.
• 15:59
  SPEAKER_01: At the end of the day, we'll get around the table and the CISO will ask the engineer, who are those guys?
• 16:04
  SPEAKER_01: Cider.
• 16:05
  SPEAKER_01: Why are we using their methodology?
• 16:07
  SPEAKER_01: So the messaging is more technical to kind of do a bottom-up approach with the tech folks.
• 16:13
  SPEAKER_01: We have a dedicated messaging also for CISOs and more of like director level and above.
• 16:19
  SPEAKER_01: The conversation is also different because we're more talking about ROI and we're talking about operation challenges other than innovations around threat detection and response, which is also different.
• 16:35
  SPEAKER_00: Yeah, I'm really fascinated about the idea of providing open source or free tools to the technical folks to get a bit of a grand cell of knowledge and awareness about you.
• 16:45
  SPEAKER_00: On an engineering basis, was that carved out of something that you already did?
• 16:49
  SPEAKER_00: Or was that just a tool that was developed on the side for the technical buyers?
• 16:53
  SPEAKER_01: I think the notion that we have, it can sound very cheesy, but we're a big believer in the community.
• 17:00
  SPEAKER_01: Today, you know, selling cybersecurity, it's a lot about trust and it's a lot about value.
• 17:06
  SPEAKER_01: If you don't have the right technology or people are not trusting your capability to solve their problems because they're already smart enough, right?
• 17:14
  SPEAKER_01: They're very smart.
• 17:15
  SPEAKER_01: Security teams today are getting way more mature.
• 17:18
  SPEAKER_01: People know what they're doing.
• 17:19
  SPEAKER_01: So they need actually to think that you know something more than what they and their team and peers know.
• 17:26
  SPEAKER_01: The way we want to articulate and share this knowledge is to kind of share those, as an example, the top 10 CICD risk project.
• 17:35
  SPEAKER_01: Those open source tools, think about a way that I already know that you're using my open source.
• 17:41
  SPEAKER_01: I know that my open source is solving some of your problems.
• 17:46
  SPEAKER_01: So we already introduce our technology to you without even starting a sales cycle.
• 17:51
  SPEAKER_01: So it's kind of like building the trust and making you understand that we know what we are doing, we understand your pain points, and our core value is to solve your problems and not only sell you a security product.
• 18:07
  SPEAKER_01: Again, this is all about knowledge sharing, giving to the security community, supporting other open source projects.
• 18:14
  SPEAKER_01: Our research team is supporting a lot of scanning tools and open source projects out there.
• 18:19
  SPEAKER_01: And I think the trust of giving the community, the community will give back.
• 18:24
  SPEAKER_01: And the CISOs and AppSec experts and the DevSecOP experts know who you are.
• 18:30
  SPEAKER_01: They're using your tools, you're using your open source tool.
• 18:33
  SPEAKER_01: So we will start the self-cycle with more trust and they already understand your value when you start the conversation with them.
• 18:40
  SPEAKER_00: Yeah, that rings very true with me.
• 18:41
  SPEAKER_00: My first ever job in cybersecurity sales was selling PGP encryption in Europe back in 1998.
• 18:48
  SPEAKER_00: And in that world, I mean, the open version of PGP was free for people to use non-commercially.
• 18:54
  SPEAKER_00: But you know, inside organizations, of course, there's people, small teams, individuals who are who are starting to use it, build up knowledge, trust of how PGP works and really value what it did.
• 19:04
  SPEAKER_00: And when it came to actually selling larger transactions, not that large, but larger transactions, it was a lot easier when they already knew and trusted the stuff they've been using before.
• 19:13
  SPEAKER_00: It's such a compelling way to really, as you say, build trust and value with organizations versus just going uh hardcore outbound with a bunch of salespeople trying to convince people that there's trust and value, right?
• 19:25
  SPEAKER_00: There's definitely different ways to attack this.
• 19:27
  SPEAKER_01: Yeah, Andrew, that's a great example.
• 19:28
  SPEAKER_01: I always said like the proof is in the pudding.
• 19:31
  SPEAKER_01: I can show you 20 slides, I can show you 30 demos, but let's actually show you in your environment, or you're already using our tools in your environment and see how it's actually work.
• 19:42
  SPEAKER_01: Now you like it.
• 19:43
  SPEAKER_00: Yeah.
• 19:44
  SPEAKER_00: The existing sales team, what can you share about how many people you have and what type of roles they're doing?
• 19:49
  SPEAKER_01: Yeah, so currently we have a large presence in the United States.
• 19:54
  SPEAKER_01: The sales team is only smaller numbers.
• 19:57
  SPEAKER_01: Uh, we have around six sales guys, salespeople in the West Coast and East Coast.
• 20:02
  SPEAKER_01: So if we're looking on Silicon Valley, San Francisco, and also in Boston.
• 20:08
  SPEAKER_01: We also have a strong sales present also in Israel, where the founders started a company and we know the Israeli market pretty well.
• 20:18
  SPEAKER_01: So it's a very strong market for us as a startup company to work with our peers and the companies that we work with many years.
• 20:25
  SPEAKER_01: So this is the kind of structure of the sales team.
• 20:28
  SPEAKER_01: Everything is pretty flat.
• 20:30
  SPEAKER_01: We do have a sales director in the West Coast, and we have someone that's managing sales, head of sales of Israel in the surrounding.
• 20:38
  SPEAKER_00: And what role do partners play?
• 20:40
  SPEAKER_00: I think a traditional security channel or integrators, are there application development shops that you sell through as well?
• 20:47
  SPEAKER_00: I'm just intrigued how that works on this side of the business.
• 20:50
  SPEAKER_01: Yeah, I'm big on channel and partners, I think.
• 20:54
  SPEAKER_01: And by the way, my first approach as sales strategy is to try to sell as much using partners and channels.
• 21:02
  SPEAKER_01: I think most of sales leaderships understand the value in channel.
• 21:06
  SPEAKER_01: This is why someone just joined us on board, someone amazing, his name is uh Meir, and he's building our channel and partnership strategies.
• 21:15
  SPEAKER_01: And when we're looking on channels, we're looking on different types of aspects because we're doing so much in our platform.
• 21:22
  SPEAKER_01: So we are speaking not only with resellers that you know exist in the cybersecurity space, but we have also a lot of strong value building partnership with other vendors and technologies that can actually use our technology to provide it to their customers as well.
• 21:41
  SPEAKER_01: The big ones, for example, to be part of marketplace or some cloud provider marketplace.
• 21:47
  SPEAKER_01: The other ones like MSPs or companies that providing application security services and SDLC services, when they see our platform, this is like kind of a gold for them to understand: hey, you have like an open source marketplace.
• 22:03
  SPEAKER_01: Our customers don't need to kind of buy five different products for us to provide them a specific report.
• 22:10
  SPEAKER_01: We can plug them into your system and then we can kind of retrieve the reporting and the risk and the visibility from your system and provide it as a service.
• 22:21
  SPEAKER_01: So everything related to AppSec, MSPs is very relevant as well.
• 22:26
  SPEAKER_01: And this is where we're kind of putting a lot of effort and building those relationships today.
• 22:30
  SPEAKER_01: So by the way, if you're a listener.
• 22:32
  SPEAKER_01: Listener and you're one of those bottles, feel free to reach out.
• 22:35
  SPEAKER_00: Yeah, it feels like there's a whole ecosystem beyond the traditional security channel that we'd be very interested and very intrigued with what you're doing.
• 22:42
  SPEAKER_00: When I go back to what you said at the start, Ben, you use the phrase appsecOS.
• 22:48
  SPEAKER_00: And you know, when I hear people do that, I'm thinking here's a company trying to create a new category, trying to differentiate around category creation as opposed to feature wars.
• 22:57
  SPEAKER_00: Am I reading that right?
• 22:58
  SPEAKER_00: Is that what cybersecurity is trying to do here?
• 23:01
  SPEAKER_01: Yeah.
• 23:01
  SPEAKER_01: I think again, we're not trying to, there is a two, you can kind of use some kind of a buzzword and use that buzzword for marketing and sales, which I think it's even most of the time will work against you because no one knows that specific category and be a new category or do something completely different, especially in the beginning, that can cause you to lose traction and to kind of lose some of the traction of trends that everyone is familiar with.
• 23:29
  SPEAKER_01: We can easily say that we're doing supply chain security, which we are, but again, supply chain security is only 5% of the risks that we're handling.
• 23:38
  SPEAKER_01: We can also say that we're doing CICD security, but CICD security is only like 50-60% of the risks.
• 23:45
  SPEAKER_01: We can always say that we're doing application security at code and SAS, but it's only like a couple of percentages of the risk as well.
• 23:53
  SPEAKER_01: And we didn't kind of quite find something to represent our entire value proposition.
• 23:58
  SPEAKER_01: And this is something our amazing CTO Daniel came up with is like this is an operation system.
• 24:05
  SPEAKER_01: You're not only looking on the code, you're not only managing your code and your developers, you're not only managing your CICD, your build system, your asset inventory.
• 24:14
  SPEAKER_01: So it's not only CICD security, you're not only doing supply chain because we are looking on third parties, we are looking on S-BOM and packages, but it's not everything.
• 24:23
  SPEAKER_01: And we also provide you like SOAR and orchestration.
• 24:26
  SPEAKER_01: So we're not just a shift-left type of tool or orchestrator.
• 24:31
  SPEAKER_01: So we kind of like operation system because we're touching all those points and we're providing you the capability to build your entire application security program.
• 24:41
  SPEAKER_01: So this is where I think the appsecoist came.
• 24:45
  SPEAKER_01: We're still using the same kind of pain points and the terminologies that everyone are using.
• 24:51
  SPEAKER_01: For example, you know, dependencies and S-BOM and supply chain, which you know, everybody knows it.
• 24:57
  SPEAKER_01: So it's good for sales, it's good for marketing.
• 25:00
  SPEAKER_01: But on the same time, this is not everything.
• 25:03
  SPEAKER_01: You need an operation system.
• 25:05
  SPEAKER_01: In order to manage and kind of, you know, take control of this massive scope, you do need to use an AppSecOS.
• 25:12
  SPEAKER_01: And this is where it's kind of came from.
• 25:14
  SPEAKER_00: I love that approach.
• 25:15
  SPEAKER_00: I mean, I feel like in the noisy world that we're in and in general in cybersecurity, too many times we default to less ambitious or less, I don't know what, aggressive kind of naming and trying to take control of areas.
• 25:28
  SPEAKER_00: And when I see companies that actually want to go do that, it's very encouraging.
• 25:32
  SPEAKER_00: I think from the the marketing and from the company positioning side, it makes a ton of sense.
• 25:36
  SPEAKER_00: It can be a little bit challenging on the sales side because it sometimes means the sales team becomes dependent on using the buzzword, becomes a buzzword as opposed to a positioning, right?
• 25:45
  SPEAKER_00: And I'll be interested to see if you got any learning so far about how the sales team should use the phrase, given that no one knows what it means this early on in your development, right?
• 25:55
  SPEAKER_01: Yeah, I think one of the biggest challenges we had, and I think every company, early stage company, hypergrowth company has is to build the right messaging.
• 26:05
  SPEAKER_01: So things that I'm doing a lot is A-B testing with our messaging.
• 26:09
  SPEAKER_01: So we don't want to give up on the AppSecOS because it's actually something that define us, and I think something that everyone should have an operation system.
• 26:18
  SPEAKER_01: Today you have a computer, you need to have an operation system to walk.
• 26:21
  SPEAKER_01: Without the operation system, you cannot walk.
• 26:23
  SPEAKER_01: It's a commodity, it's not something that only the rich enterprises will have.
• 26:27
  SPEAKER_01: We want CIDR to be your operation system.
• 26:29
  SPEAKER_01: So this is something we believe in.
• 26:31
  SPEAKER_01: The problem is exactly like you mentioned, how you build your messaging around something that it's new, it's not exist.
• 26:38
  SPEAKER_01: At the beginning, it's kind of was a little bit negative because it was very hard to get traction and people didn't know if AppSecOS actually is a security tool or it's more like a DevOps tool or engineering tool.
• 26:51
  SPEAKER_01: What does it mean?
• 26:52
  SPEAKER_01: It's an operation system.
• 26:54
  SPEAKER_01: So when you build your messaging to complement, this is more from the marketing side of the story.
• 27:01
  SPEAKER_01: We identify that if you complement the new term that you want to build by using known terms in the market, the new term will make sense and people will be curious about it.
• 27:14
  SPEAKER_01: Because you explain something new with kind of like known trends and known topics.
• 27:22
  SPEAKER_01: And this is how we found that sweet spot that people say, I do need an appsecOS because I do have all those type of pieces of puzzle that today I'm trying to kind of fit together.
• 27:34
  SPEAKER_01: So the AppSecOS sounds about right.
• 27:37
  SPEAKER_01: So you're doing it from the end to the beginning.
• 27:39
  SPEAKER_01: You're not explaining what is an appsec OS.
• 27:43
  SPEAKER_01: You kind of explain this is the situation, and this is why you need the AppSec OS to make sure the situation is being handled.
• 27:53
  SPEAKER_00: Yeah, I like that.
• 27:54
  SPEAKER_00: So what you're saying, I think my thinking is you're grounding in what they know already, right?
• 27:58
  SPEAKER_00: And recognizing that they don't care about the naming until they care about their own problems and how they're solved.
• 28:04
  SPEAKER_00: But then you lead them towards the thing you want them to stick, which is AppSec OS, right?
• 28:09
  SPEAKER_00: So, you know, we have these use cases, we solve these problems and we do it in a certain way, and we hand to call it AppSec OS, as opposed to saying, well, we have this thing called AppSec OS, right?
• 28:18
  SPEAKER_00: And then having to defend the use of what people will probably view as a some sort of buzzword at the start, right?
• 28:23
  SPEAKER_01: Exactly.
• 28:23
  SPEAKER_00: Yeah, it's a really interesting area.
• 28:25
  SPEAKER_00: And I think I hope to see more companies getting so creative and so thoughtful about how they're going to market around something like that.
• 28:31
  SPEAKER_00: Because you know, with 6,400 vendors in the community, we need something a little bit different than more of the same in terms of the wording and the buzzword.
• 28:37
  SPEAKER_00: So that's that's great to hear.
• 28:39
  SPEAKER_00: As the chief strategy officer at CIDR, then, as you look at over the next three to five years, how do you see the company and the market evolving around this area?
• 28:49
  SPEAKER_01: Yeah, so it's very hard to predict.
• 28:52
  SPEAKER_01: We're trying to predict kind of a year in advance because you just mentioned the appsec trends and the appsec kind of industry.
• 29:00
  SPEAKER_01: Now it's growing every other week.
• 29:03
  SPEAKER_01: You have new companies, new startups, new vulnerabilities, new attacks, new risks.
• 29:08
  SPEAKER_01: Um if you're looking for a prediction, I see the appsec market growing even faster than the trade detection response market.
• 29:17
  SPEAKER_01: So if you're looking on uh everyone bought a sim and then they needed some kind of like orchestrator, and then they wanted some out-of-the-box trade detection response, and then EDL that became MDL.
• 29:31
  SPEAKER_01: So we are already doing kind of like the MDL for OPSEC.
• 29:35
  SPEAKER_01: Um I think you will see a lot of consolidation of many companies that kind of developing a point solutions, and we're already seeing it today.
• 29:45
  SPEAKER_01: And the companies that go in wider will probably go to kind of digest the smaller companies that are doing more features.
• 29:54
  SPEAKER_01: So I think the this industry is going into a consolidation, but on the same time, the growth is insane because more and more technology has been involved.
• 30:04
  SPEAKER_01: So we will see more and more startup companies that providing solution to new technologies that no one knows how to kind of protect.
• 30:13
  SPEAKER_01: So it's going to be a new type of segment, the application security for sure.
• 30:18
  SPEAKER_00: Have you sensed any slowdown in startups starting because of the current state of the VC world?
• 30:25
  SPEAKER_01: Yeah, uh, this is something that everyone talking about.
• 30:29
  SPEAKER_01: I do think that now it's not as uh glowing and as amazing like it used to be, that everyone with an idea and promise can get the funding he wants.
• 30:41
  SPEAKER_01: And if he's not kind of achieving the goals, or if he don't have the right intellectual property, or if his technology is not as good as he promised, he will still get the money.
• 30:52
  SPEAKER_01: I think now the market realizes that it's not all about promises, and startup companies understand that they need to show value, they need to present the numbers.
• 31:02
  SPEAKER_01: And by the way, this is my kind of like the reason I joined, and the reason I was like now leading the go-to market is when you have a good product that solves problems that it's almost impossible to solve manually or by the other products within the market.
• 31:19
  SPEAKER_01: This is the point when specific startup companies enjoy these specific kind of you know financial changes, while some of the startup companies, I think most of them are their early, later stages, kind of feel the pressure to show profit and show value.
• 31:39
  SPEAKER_01: So I think now, again, the proof in the pudding, you need to have the technology as a startup company, you need to build your technology fast enough to align with the trends in the market, and you need to make sure to execute and to define your KPIs for sales, to understand your ICP, and to build the right type of strategy because the market will not forgive you if you'll do too many mistakes, even if you're a startup company.
• 32:08
  SPEAKER_00: Yeah, and I hate to say it, but I think there's gonna be a flushing of some of the ones that are still searching for that product market fit.
• 32:14
  SPEAKER_00: They're still searching for the real value that they can deliver, which I guess is part of it is natural cycles, right?
• 32:20
  SPEAKER_00: But it does mean that the ones that come out the other side are gonna be stronger and well positioned.
• 32:24
  SPEAKER_00: So, Ben, with that, uh, I want to thank you very much for joining us today.
• 32:28
  SPEAKER_00: Really enjoyed the conversation.
• 32:29
  SPEAKER_00: If someone wants to continue the conversation or talk about any open positions that you have at CIDR, what's the best way to get hold of you?
• 32:36
  SPEAKER_01: Oh, we do have a lot of open positions.
• 32:38
  SPEAKER_01: So I think for open position, the best thing is to go to our website, cidersecurity.io.
• 32:44
  SPEAKER_01: Also for the top 10 CICD risk to review it.
• 32:48
  SPEAKER_01: It's all in our website.
• 32:49
  SPEAKER_01: Feel free to reach out.
• 32:51
  SPEAKER_01: I think the best platform for me is LinkedIn.
• 32:53
  SPEAKER_01: So Sneer Ben Shimol in LinkedIn.
• 32:56
  SPEAKER_01: You'll find me there.
• 32:57
  SPEAKER_01: And feel free to reach out and be happy to help.
• 33:01
  SPEAKER_00: Well, thanks again, Ben.
• 33:02
  SPEAKER_00: I wish you every success for 2022 and 2023 for yourself and the whole company.
• 33:07
  SPEAKER_01: Thank you so much, Andrew.
• 33:08
  SPEAKER_01: It was a pleasure.
• 33:10
  SPEAKER_00: So, this is one of my favorite conversations from the recent round of interviews that I've done with senior leaders at startups.
• 33:18
  SPEAKER_00: All of them have been really fascinating for me.
• 33:21
  SPEAKER_00: This one, a little bit different though.
• 33:22
  SPEAKER_00: Chief Strategy Officer and Ben thinking about how to differentiate in the marketplace, how to change the game a little bit, both from a product side but and also from a go-to-market side.
• 33:32
  SPEAKER_00: Three takeaways from me.
• 33:34
  SPEAKER_00: One was the importance of market education.
• 33:36
  SPEAKER_00: He said the company is focused on that.
• 33:38
  SPEAKER_00: They're thinking about that a lot, about how to educate in a way that raises the need or shines a light on the need for organizations to want to do application security and do it in a manner in which is done, in their view, properly with a more encompassing tool like CIDR.
• 33:56
  SPEAKER_00: So that was one, and very closely related was the idea that it's so important to build trust and value with prospects.
• 34:03
  SPEAKER_00: And one of the ways that they're doing that is by providing open source tools.
• 34:08
  SPEAKER_00: They're providing tools to the community that individual engineers can use to help advance their own positions and be more effective, and then it translates into building the trust with those people, which then, as the word gets out, builds awareness and usage and deals for them in their other paid-for tools as well.
• 34:28
  SPEAKER_00: So that idea of bringing open source tools to the marketplace is a good way to build trust and value.
• 34:34
  SPEAKER_00: And the final thing, when we touched on the idea they're building a category around app sec operating systems, application security operating system.
• 34:43
  SPEAKER_00: You know, the danger always in these when you're doing that is what becomes a nice idea and phrase is devalued into being just another buzzword.
• 34:52
  SPEAKER_00: And how you go about messaging that with your target audience is actually pretty crucial.
• 34:57
  SPEAKER_00: And he talked about the idea that he learned that you have to complement the new wording, the new phrase, such as application security operating system, with words and use cases and phrases that people know already, right?
• 35:11
  SPEAKER_00: So you've got to give it context, give your prospect something that they'll latch on to go, yeah, I understand that.
• 35:17
  SPEAKER_00: And then you kind of build on the idea that of this other word or phrase to describe what you do.
• 35:23
  SPEAKER_00: It's a hard thing to do, but with the market so crowded right now, I think it is so important to think about these things and do differentiation in a manner, which truly does enable you to stand out above the garage.
• 35:35
  SPEAKER_00: So those are my three takeaways.
• 35:37
  SPEAKER_00: I'm curious what yours are.
• 35:38
  SPEAKER_00: It was a fascinating conversation for you.