Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / EMEA Expansion, AI Experiments & Channel Secrets: Inside Legit Security’s 2025 Strategy
Transcript
- 0:41SPEAKER_02: Welcome to another episode of the Cybersecurity Go to Market podcast from the RSA Conference 2025.
- 0:49SPEAKER_02: We're sitting here in the Marriott, which many people will know.
- 0:54SPEAKER_02: Uh in the atrium is a hub of activity going around.
- 0:57SPEAKER_02: I think breakfast is over, so we're not going to hear too many dishes and plates getting smashed, but uh it's a packed room and there's a lot of good conversations happening.
- 1:04SPEAKER_02: We are here with Dave Howell, the CMO at Legit Security.
- 1:08SPEAKER_02: Dave, welcome to the podcast.
- 1:09SPEAKER_02: Thank you so much.
- 1:10SPEAKER_02: Good morning, and I appreciate being on the show.
- 1:11SPEAKER_02: Yeah, it's gonna be fun.
- 1:12SPEAKER_02: I'm kind of interested about this because you're in a potentially noisy space looking from the outside.
- 1:18SPEAKER_02: A lot of uh four-letter acronyms kicking around, try to describe what you do or don't do, or others do, and they're you know, a lot of bleed over in different areas.
- 1:26SPEAKER_02: Um, how would you describe what Legit does and what does your thinking as a CMO mean in terms of how you position the company to try and help people make sense of all this?
- 1:36SPEAKER_02: Yeah.
- 1:36SPEAKER_00: So well, so the the general market that we play in is application security posture management, ASPM.
- 1:41SPEAKER_00: And at the end of the day, what we were attempting to do is help customers to make sense of the reams of vulnerability data that they have so they can really understand which issues have to be prioritized for removation.
- 1:51SPEAKER_00: The way we think about it though is what are the problems you're trying to solve?
- 1:55SPEAKER_00: And that could come in from many different angles.
- 1:57SPEAKER_00: Number one would be I just want to understand what my entire software development factory looks like, and I want to understand the state of security.
- 2:04SPEAKER_00: So it could be a discovery play.
- 2:06SPEAKER_00: The second could be if you're more mature and you already have a bunch of tools in place, how do I understand of all those vulnerabilities that I have, which really matter to the business?
- 2:15SPEAKER_00: And so we bring the context around that to help you really understand of the hundred thousand backlog issues, these are the ones that you need to prioritize because they're creating business risk.
- 2:24SPEAKER_00: So for us, we do believe we need to use the ASPM acronym because it's what's um becoming more understood.
- 2:29SPEAKER_00: It's how um customers compare us to others in the space, but it's getting to that real problem that they're trying to solve, via discovery, prioritization, automated remediation, and things of that nature.
- 2:39SPEAKER_02: As a marketer, does it uh give you a good feeling about having to use ASPM, or do you kind of feel a bit uncomfortable because it is just another four-letter acronym out there?
- 2:49SPEAKER_00: So it's funny.
- 2:50SPEAKER_00: We were having this conversation with colleagues yesterday, and I'll say it's a little bit of both.
- 2:53SPEAKER_00: So I think the positive of it is that it gives prospects and customers a common um focal point to compare solutions and products in the market.
- 3:03SPEAKER_00: And so as ASPM becomes more well understood and the capabilities become more clearly defined and agreed upon, it's easy to kind of center the cognitive recognition on where we play.
- 3:13SPEAKER_00: That said, if you had talked to Gartner, there are probably 20 to 30 vendors that play in the space, all have very different definitions.
- 3:21SPEAKER_00: And because ASPM is such a broad category, it's pretty easy to position yourself in that uh pocket of technology, even if you only have a subset of those capabilities.
- 3:30SPEAKER_00: So there are pros and cons.
- 3:31SPEAKER_00: I think pros are recognition and awareness, cons are then really just finding what we do and how we do it differently and better than our competitors.
- 3:38SPEAKER_02: It's hard to have a conversation about this area and not talk about any potential effect Wiz might have had.
- 3:43SPEAKER_02: Have they dived into ASPM at all?
- 3:45SPEAKER_02: Are they a viable competitor for you?
- 3:47SPEAKER_00: So they certainly could be should they chose to go there.
- 3:51SPEAKER_00: They acquired Daz several months ago.
- 3:54SPEAKER_00: When you look at DAS's capabilities, though, they were really much more focused on kind of centralized ticketing and remediation.
- 4:01SPEAKER_00: We take a much broader approach to ASPM in terms of giving customers a full view of the software factory, what are all the different assets that developers are using, where are there potentially uh misconfigurations or other issues in the environment?
- 4:13SPEAKER_00: And then how does that line up with your current app sec posture?
- 4:17SPEAKER_00: So our goal is to provide all that context across both the software factory and the applications as they're being developed, which is very different than what Daz does.
- 4:25SPEAKER_00: Now, that said, because DAS, like many others, are positioning themselves as ASPM, it does mean we have to get into some more further explanation in terms of how we are different and where we're similar.
- 4:35SPEAKER_02: And from a sales team side, whenever you've got that environment, my experience is that people start to say, what I really mean is, and let me, you know, and they could have almost like have to justify even saying the thing in the first place.
- 4:47SPEAKER_02: How are you encouraging the sales team to handle that conversation?
- 4:51SPEAKER_00: So we really have centered them on approaching this by using kind of three key pillars of messaging, and it centers on this notion of find, fix, and prevent.
- 4:59SPEAKER_00: So you want to find everything related to your software factory, how apps are being developed, and those applications themselves.
- 5:06SPEAKER_00: You then need to be able to prioritize the issues that are most important to fix them.
- 5:10SPEAKER_00: And then you need to get into the uh motion of preventing um bad issues from occurring in the future by putting guardrails and other preventative measures in place.
- 5:18SPEAKER_00: So for us, again, it's really about find, fix, prevent, which is a simplified way of kind of describing what we do.
- 5:24SPEAKER_00: Okay.
- 5:24SPEAKER_02: And is most of the growth driven by uh the sales and marketing team, or have you got partners or um someone else who brings brings deals most of the growth for you?
- 5:33SPEAKER_00: So we are channel first all the way, and we were one of the first ASPMs to to go 100% through the channel.
- 5:39SPEAKER_00: And so we are partner-led.
- 5:42SPEAKER_00: Um that said, we're also bringing leads and opportunities through our marketing efforts, our direct sales efforts, but regardless of where those come from, we will always get a partner involved because we believe that's really core to our business.
- 5:53SPEAKER_00: What's an ideal partner for So an ideal partner would have three or four characteristics.
- 5:57SPEAKER_00: Number one, we they would must have app set capabilities.
- 6:01SPEAKER_00: Um, number two, they need to have this desire to really get into the ASPM space and work with a partner like us.
- 6:07SPEAKER_00: And number three is right now we're not looking for volume partners.
- 6:11SPEAKER_00: We're working for partners that have the real kind of consultative selling and engagement aptitude so that we can go deep.
- 6:17SPEAKER_00: We're selling to the largest enterprises in the world.
- 6:19SPEAKER_00: Some of our customers are very well-known household brands.
- 6:22SPEAKER_00: And so this isn't a transactional play.
- 6:24SPEAKER_00: We need to build relationships, we need to help customers understand how to use the technology, how to deploy it.
- 6:29SPEAKER_00: And so we're looking for partners that can help with that.
- 6:31SPEAKER_02: What would be an example then of a partner that is not a transactional, but really a value play and a solution play?
- 6:37SPEAKER_00: Well, Guidepoint for sure has been our top domestic partner um over the past year, year and a half.
- 6:43SPEAKER_00: And so we lean heavily into guidepoint, uh, partnering with them on events, um, direct selling motions, bringing them into deals, and likewise that they bring us into deals.
- 6:51SPEAKER_02: So Skip Shaw is the GuidePoint rep in Columbus, Ohio.
- 6:55SPEAKER_02: If I'm Skip, how would I engage with Legit?
- 6:58SPEAKER_02: How do how do I make money together with you?
- 7:00SPEAKER_00: Well, the first thing I tell Skip is that when you look at our customer retention rates, they're outstanding.
- 7:04SPEAKER_00: So partners that work with legit and win deals to Legit are likely to retain those over time, which is a net positive from a revenue standpoint.
- 7:11SPEAKER_00: Um, number two is we have industry leading margins.
- 7:14SPEAKER_00: And so we're looking to bring on partners who really want to work with us, go deep, and help us to build our business as we build theirs.
- 7:23SPEAKER_02: Um and if I'm skip, I'm worried about uh, I'm not worried about thinking about how do I make money.
- 7:27SPEAKER_02: So uh is this deal reg's what sort of margin you said healthy?
- 7:31SPEAKER_00: Deal regges.
- 7:32SPEAKER_00: Um, we have some of the highest margins um available.
- 7:36SPEAKER_00: We're comp neutral, so there's fully encouraging our sales reps to bring partners involved.
- 7:41SPEAKER_00: Um, and we do everything we can to incentivize them.
- 7:44SPEAKER_00: The other thing we focus on with um our partners are looking for those that have pockets of expertise in certain regions.
- 7:51SPEAKER_00: And for those, we will go deep.
- 7:52SPEAKER_00: We'll send our field CTO, our SCs out and do one-on-one trainings with those groups.
- 7:57SPEAKER_00: We're not relying on more transactional sort of enablement such as portals and the like.
- 8:01SPEAKER_00: We'll get there eventually.
- 8:01SPEAKER_00: But right now, we really want to work hand in hand with these partners to make sure they understand what we're selling.
- 8:07SPEAKER_00: They understand the value prop, they understand the ICP and the right personas, and then they're really well positioned to walk into these accounts and make a solid pitch for themselves and legit.
- 8:16SPEAKER_02: Partners are always looking for ease of doing business, right?
- 8:19SPEAKER_02: Because they've got 3,800 vendors trying to get their attention.
- 8:23SPEAKER_02: I'm wondering what you're doing with your program and how you communicate with them to try and help them see that you're actually a good option in terms of doing some business.
- 8:30SPEAKER_00: Yeah, I mean, I think it's probably a roll-up of what I've described before.
- 8:33SPEAKER_00: So number one is making sure it's comp neutral so that our reps are fully incentivized to involve a partner and there's no um disincentive to do so.
- 8:41SPEAKER_00: Number two, to understand that you as a rep or as a partner organization, what do your sellers need in order to better position and understand what we're doing?
- 8:49SPEAKER_00: And then number three, delivering margins that are some of the best in the industry so that you will make money over time.
- 8:54SPEAKER_00: Um and so that's what we intend to do.
- 8:57SPEAKER_00: We um make it very easy to partner with us on marketing programs.
- 9:00SPEAKER_00: We're pretty flexible.
- 9:01SPEAKER_00: We're a you know, we're a smaller organization, less than a hundred employees, so we're able to be quite nimble and kind of pivot as the partners need us to.
- 9:08SPEAKER_02: Uh what are other growth areas are there for you in 2025 that you're looking to grow the business with?
- 9:15SPEAKER_02: So um, in terms of channels or initiatives, programs?
- 9:20SPEAKER_00: Yeah, so there are a couple.
- 9:21SPEAKER_00: So number one, we just recently brought on board a small team in the UK to really help with our AMEA focus.
- 9:28SPEAKER_00: So for the past couple of years, we've been primarily focused on the North American market, US and Canada.
- 9:33SPEAKER_00: We are starting to see some really interesting business opportunities in um the UK in particular, um, and that that warrants um additional investment.
- 9:42SPEAKER_00: We recently won a deal in South Africa, for example.
- 9:45SPEAKER_00: So we're seeing more and more desire for the ASPM capabilities pop up in other regions.
- 9:49SPEAKER_00: Um, the other thing that we're looking at really closely is how we can um leverage partners to better kind of scale our outbound efforts.
- 9:57SPEAKER_00: And so while we don't believe it's a volume play yet, we're starting to see that the market is getting there, where more and more companies are understanding that I have these reams of data that I need to deal with.
- 10:07SPEAKER_00: I don't know how to deal with it from a vulnerability standpoint, and I need a way to manage that.
- 10:11SPEAKER_00: And that is going from the largest organizations down into the mid-market.
- 10:14SPEAKER_00: And so we're looking at how we can organize our teams to support that.
- 10:17SPEAKER_02: Is that uh rep by rep or is it more of a program that you're looking to do with partners to drive that that in mind?
- 10:23SPEAKER_00: It wouldn't be rep by rep at this point, but I think as the year goes by, we'll look at how we can expand and program make it more programmatic over time.
- 10:30SPEAKER_02: Yeah.
- 10:30SPEAKER_02: Uh always a European expansion is interesting.
- 10:33SPEAKER_02: I'm originally from the UK, so I always think about like how how companies are doing that.
- 10:36SPEAKER_02: Any uh anything you've learned about that that you're kind of surprised about that you weren't expecting?
- 10:41SPEAKER_00: Well, I think you know, we we were very much taking a a let's let's test and experiment and then invest if it works.
- 10:48SPEAKER_00: And so we brought a consultant on for about um half a year part-time to start doing some initial discovery work in the market, talking to partners, talking to prospects, going to events to really make sure we had a handle on is it time to go in um deep?
- 11:02SPEAKER_00: And I think what we learned through this is that that approach is really the right way to take it when we're looking outside of the US and we don't have a uh large team to focus on that market.
- 11:11SPEAKER_00: So I think that's how we'll probably continue to evolve as we expand into other regions.
- 11:16SPEAKER_02: AI, hot topic in all sorts of ways this week.
- 11:20SPEAKER_02: Very much so.
- 11:20SPEAKER_02: Um but in terms of go to market, where do you see what where are you most excited about what AI can bring to what the go to market team is doing at legit?
- 11:29SPEAKER_00: Uh so I'm very excited about some of the new capabilities we're seeing um from an AI standpoint, supporting marketing operations, revenue operations, sales, et cetera.
- 11:38SPEAKER_00: We have, for example, brought in a new tool that helps us to better analyze the um the potential productivity of accounts in our pipeline.
- 11:48SPEAKER_00: Oh.
- 11:48SPEAKER_00: And so rather than using basic um ICP data, your revenue size, employee account, vertical, which all matter, it looks beyond that.
- 11:57SPEAKER_00: So are there other characteristics?
- 11:59SPEAKER_00: How does the company talk about themselves?
- 12:00SPEAKER_00: What sort of key initiatives do they have as an organization?
- 12:04SPEAKER_00: Um, how do they talk about digital transformation and other investment areas?
- 12:08SPEAKER_00: Who are they hiring?
- 12:09SPEAKER_00: And all those sorts of there's about 150 different characteristics that they can really triangulate around and say, based on who you've won in the past, these accounts are likely going to be really good for you or likely not very good for you.
- 12:22SPEAKER_00: And it's interesting when you stand that up against what you would consider from an ICP standpoint, there may be a very significant variant.
- 12:28SPEAKER_00: So looking at those tools, again, experimenting, see how it works and moving on.
- 12:32SPEAKER_00: And the others, I think, are a little more um uh, I would say kind of uh team scale.
- 12:36SPEAKER_00: So, how can we use AI to better scale a delivery of content?
- 12:40SPEAKER_00: How can we take this pieces of content we've developed as a team and repurpose it using AI more quickly?
- 12:45SPEAKER_00: Um, and really we're just very open to talking to um any of those newer startups in the space.
- 12:50SPEAKER_00: Um, most of the tools that we brought on are very early stage, even seed.
- 12:55SPEAKER_00: Um, but our goal is to get in early and test them and see what works and help us grow.
- 12:58SPEAKER_00: I am a sucker for a good new tool coming out.
- 13:01SPEAKER_00: Can you give me some names of some of the ones you're excited about?
- 13:03SPEAKER_00: Well, so yeah, Revic, R E V I C is the tool that we're using for account prioritization.
- 13:08SPEAKER_00: Um what's interesting, if you ever talk to them, generally they're selling to RevOps.
- 13:12SPEAKER_00: And I think I was probably one of the early ones to be interested from a marketing standpoint, because what I see is that even if we aren't ready to fully grab and hold on to that data from a from a sell sales standpoint, let's start running some campaigns and see how it plays out to see if it helps us to either um justify or argue against the capabilities of the tool.
- 13:31SPEAKER_00: Um, the other that we use is a tool called Tofu, T O F U, which helps us to do a couple of things.
- 13:37SPEAKER_00: One, it helps with scale of personalization.
- 13:40SPEAKER_00: So everything from emails to landing pages, et cetera, for our various campaigns.
- 13:44SPEAKER_00: And it also has a play in terms of content repurposing.
- 13:47SPEAKER_00: So those are the two ones that we've been uh most deeply embedded with.
- 13:50SPEAKER_00: There are others we've tested and moved away from.
- 13:52SPEAKER_00: I won't mention those.
- 13:53SPEAKER_00: Um so we'll leave it at those two.
- 13:54SPEAKER_02: It feels like in six months' time, you might have a different answer, right?
- 13:57SPEAKER_02: I may.
- 13:57SPEAKER_02: It's moving so fast.
- 13:59SPEAKER_02: I may, yeah.
- 14:00SPEAKER_02: Um, hot topic as well is SDR, BDR.
- 14:03SPEAKER_02: Does that fit in marketing at legit?
- 14:04SPEAKER_00: Or do you have SDRs, BDRs?
- 14:06SPEAKER_00: We we do.
- 14:07SPEAKER_00: We have BDRs and they are both um hunters and farmers.
- 14:10SPEAKER_00: So they're managing both outbound as well as um managing inbound leads.
- 14:15SPEAKER_00: Um we have a small team, they sit in marketing now.
- 14:18SPEAKER_00: They were previously in sales.
- 14:19SPEAKER_00: From my point of view, I'm less concerned about what they where they reside from an organizational standpoint and more concerned with do we have alignment across sales, marketing, and the executive leadership team in terms of their responsibilities, their KPIs, what their day-to-day looks like.
- 14:35SPEAKER_00: So um, I don't think much has materially changed since they moved under marketing.
- 14:39SPEAKER_00: Um and we can move them back later if it seemed to make more sense.
- 14:42SPEAKER_02: What was the reason behind the move then?
- 14:43SPEAKER_00: There was just an overall organizational um change.
- 14:46SPEAKER_00: Yeah.
- 14:46SPEAKER_00: All right, yeah.
- 14:47SPEAKER_02: Well, good.
- 14:48SPEAKER_02: Dave, thanks so much for joining us.
- 14:49SPEAKER_02: It's been a good discussion.
- 14:50SPEAKER_02: All right.
- 14:50SPEAKER_02: Sight and time for the company.
- 14:52SPEAKER_02: Uh RSA is always uh an energizing moment for many, not a de-energizing moment.
- 14:57SPEAKER_02: It is.
- 14:57SPEAKER_02: And I wish you and the team every success for the rest of the year.
- 14:59SPEAKER_02: Thank you so much, Angela.
- 15:00SPEAKER_02: I appreciate it.
- 15:03SPEAKER_02: All right, it's time for another episode of Visionary or Smoking Crack.
- 15:07SPEAKER_02: Introduce yourself.
- 15:09SPEAKER_01: I'm Joe Silva, co-founder, CEO of Spection.
- 15:11SPEAKER_02: All right, Joe.
- 15:12SPEAKER_02: I am gonna throw out some bold predictions at you right here about the future of cybersecurity, cybersecurity sales.
- 15:19SPEAKER_02: You tell me, am I a deep thinking, insightful visionary, or did I inhale a little bit too deeply walking through the tender line on the way to our meeting this morning?
- 15:28SPEAKER_02: All right, you ready for the first one?
- 15:30SPEAKER_02: Let's do it.
- 15:31SPEAKER_02: By 2030, 80% of cybersecurity purchases under 100K will happen without a human seller or a human buyer.
- 15:40SPEAKER_02: There'll be AI agents doing the all the work.
- 15:44SPEAKER_02: Visionary, tell me more.
- 15:45SPEAKER_01: Well, one, I increasingly see just relationships and sales and security being devalued.
- 15:52SPEAKER_01: Uh, I see, you know, accounts get shifted around from rep to rep, which is already kind of dehumanizing sales.
- 15:58SPEAKER_01: I just think there's an opportunity for disintermediation in security sales like there is in everything else.
- 16:02SPEAKER_01: I think the nature of cybersecurity sales in general is gonna change because it's so different than other IT sales.
- 16:08SPEAKER_01: Uh, I think we're gonna move more towards a model of you're either you're either buying it online through agents or you're maybe buying it through a single reseller.
- 16:18SPEAKER_02: Love it.
- 16:18SPEAKER_02: All right, next one.
- 16:19SPEAKER_02: In five years, within five years, more CISOs will report to the CFO than they do to the CIO or CEO.
- 16:27SPEAKER_02: I think you're high as a kite, my man.
- 16:30SPEAKER_01: Tell me more.
- 16:31SPEAKER_01: Well, um, you know, the as a CISO, you're managing security risk, cybersecurity risk for the organization.
- 16:38SPEAKER_01: As a CFO, you're managing financial risk for the organization.
- 16:43SPEAKER_01: I don't see the overlap in competencies there.
- 16:47SPEAKER_01: And to to say that statement is even somewhat on point, you would have to see a path for someone to go from being the CISO and then their next role would be the CFO in the company.
- 16:57SPEAKER_01: And as opposed to right now, what's the role above a CISO that someone shoots for you?
- 17:00SPEAKER_01: You could be a CIO, which you know is not very common, but it's increasingly common.
- 17:04SPEAKER_01: Increasingly, we see a lot of CISOs who are actually taking on infrastructure within their portfolio.
- 17:09SPEAKER_01: Ultimately, you're a technology professional with a concentration on managing security risk.
- 17:14SPEAKER_01: You're not a financial professional where on one day I'm managing cybersecurity risk, and then the next day, or maybe a year from now, I'll be managing 4x risk for a business.
- 17:24SPEAKER_02: Okay.
- 17:25SPEAKER_02: Um next one.
- 17:27SPEAKER_02: Uh the most successful cybersecurity salespeople in the next five years won't come from a sales background.
- 17:35SPEAKER_02: There'll be former practitioners who also know the business of cyber really well.
- 17:40SPEAKER_02: Am I a visionary or am I smoking crack?
- 17:42SPEAKER_01: I think you're you're probably hitting the pipe there, Andrew.
- 17:45SPEAKER_01: I mean, ultimately, like, you know, going back to your first question, a lot of sales is going to get disintermediated, dehumanized.
- 17:53SPEAKER_01: The core competency of sales is still your ability to connect with another person.
- 17:57SPEAKER_01: So those sales folks that are left where person-to-person sales uh is going to continue to be common.
- 18:04SPEAKER_01: It's going to be because you have the ability to make a connection with another person, understand their problems.
- 18:09SPEAKER_01: And then, of course, a competency that you need to have is to have some ability to connect that back to the technical problems and solutions.
- 18:17SPEAKER_01: But ultimately, the reason sales will continue to exist is because people want to connect with another person who can understand and empathize with them.
- 18:25SPEAKER_01: Yep.
- 18:25SPEAKER_01: Are you a college football fan?
- 18:27SPEAKER_01: Uh I am.
- 18:28SPEAKER_01: Go Knolls, although last year was painful.
- 18:30SPEAKER_02: So by 2030, Shadur Sanders will have won a Super Bowl.
- 18:34SPEAKER_02: Visionary or smoking crack?
- 18:36SPEAKER_01: I would say, I wouldn't say you're a visionary, but there's a lot of guys who won the Super Bowl sitting on the bench.
- 18:43SPEAKER_01: But I no indication, no indication that he's gonna be a starter.
- 18:47SPEAKER_02: Okay.
- 18:47SPEAKER_02: You'd have to move to a different team, right?
- 18:50SPEAKER_01: That's right.
- 18:50SPEAKER_01: I I like I would definitely say you're smoking crack if you're telling me the Browns will win the Super Bowl anytime in my lifetime.
- 18:55SPEAKER_02: Yeah, that was a little bit too obvious.
- 18:57SPEAKER_02: All right, last one.
- 18:58SPEAKER_02: So recently Google announced they were acquiring Wiz and some hacks in the industry called the combination G Wiz.
- 19:06SPEAKER_02: So within 12 months, CrowdStrike will buy Island, and the new name of the company will be Hong Kong because it's a crowned island.
- 19:17SPEAKER_02: Visionary or smoking crack?
- 19:19SPEAKER_01: I think you're smoking crack, but A for creativity.
- 19:22SPEAKER_01: I like it.
- 19:22SPEAKER_01: Love it.
- 19:23SPEAKER_01: Well, thanks for joining us, Joe.
- 19:24SPEAKER_01: Hey, thanks for having me, Andrew.
- 19:25SPEAKER_01: It's been fun.