Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 138: Vladi Sandler, Co-Founder and CEO at Lightspin talks protecting cloud and Kubernetes environments from unknown risks

Transcript

138: Vladi Sandler, Co-Founder and CEO at Lightspin talks protecting cloud and Kubernetes environments from unknown risks · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:34
  SPEAKER_01: Any software that does a whole lot of work behind the scenes to then make a user's life simple is going to be attractive as an operational efficiency driver.
• 0:44
  SPEAKER_01: Flatie Sandler, the co-founder and CEO at LightSpin, joins me to explain today how they do just that.
• 1:02
  SPEAKER_01: Welcome to the Sales Bluebird podcast, which exists because at B2B startups it's hard to get traction and scale the sales team.
• 1:11
  SPEAKER_01: Sales Bluebird provides you with tips, experiences, ideas, examples, and inspiration from people who know a thing or 10 about getting traction and building startups.
• 1:22
  SPEAKER_01: I am your host, Andrew Monahan.
• 1:24
  SPEAKER_01: Our guest today is Vladdy Sandler, the co-founder and CEO at LightSpin.
• 1:29
  SPEAKER_01: Vladdy, welcome to Sales Bluebird.
• 1:31
  SPEAKER_00: Thank you for inviting.
• 1:32
  SPEAKER_00: Appreciate it.
• 1:33
  SPEAKER_01: Yeah, I'm looking forward to our conversation, Vladdy.
• 1:35
  SPEAKER_01: You are a finalist in the innovation sandbox at RSA, which is quite an honor, right?
• 1:41
  SPEAKER_01: Very few companies get that far, so it's a great spot to be in.
• 1:44
  SPEAKER_01: I'm keen to learn what you've got going on and what maybe caught the eye of the panelists to say that you were going to get uh all the way through to the finalists.
• 1:52
  SPEAKER_01: But Vladdy, before we get into the business side of this, I do want to learn a little bit more about you.
• 1:57
  SPEAKER_01: I got a new way of doing that right now where we use a spin the wheel option here.
• 2:04
  SPEAKER_01: I'm delaying just while I pull on the screen here so you can see it.
• 2:06
  SPEAKER_01: I'm gonna spin this wheel and there's 15 questions and we're gonna do it three times.
• 2:11
  SPEAKER_01: So whatever question pops up is the one that we'll ask you to answer.
• 2:15
  SPEAKER_01: Sound good?
• 2:16
  SPEAKER_00: Sounds like a plan for me.
• 2:17
  SPEAKER_01: All right, let's go.
• 2:21
  SPEAKER_01: What's one great airport that you've been through?
• 2:25
  SPEAKER_01: Munich.
• 2:25
  SPEAKER_01: Munich?
• 2:26
  SPEAKER_01: It's huge.
• 2:27
  SPEAKER_01: I've never been to Munich, I don't think.
• 2:29
  SPEAKER_00: Yeah, I'm really surprised to see how big it is.
• 2:32
  SPEAKER_01: Yeah, I've not been there.
• 2:33
  SPEAKER_01: I'll have to add that to my my list of ones to go through.
• 2:35
  SPEAKER_01: It's not a common one from the US to fly through.
• 2:38
  SPEAKER_01: So all right, Munich Airport, next one.
• 2:42
  SPEAKER_01: What's one event in the world that you haven't been to yet, but you would love to go and attend?
• 2:51
  SPEAKER_00: Oh wow, there's a lot of events in that.
• 2:53
  SPEAKER_00: Actually, it's funny because we had some preparation for RSA and I mentioned that I never been known Blackett known in RSA because every time there is a conference, you as a founder, you close to the conference in some meetings.
• 3:07
  SPEAKER_00: So I would love to probably go to RSA or Blackett and actually to exhibit or I don't know, or to some lecture or two.
• 3:14
  SPEAKER_01: Yep.
• 3:14
  SPEAKER_01: Alright.
• 3:15
  SPEAKER_01: Next last one.
• 3:19
  SPEAKER_01: Do you prefer window or aisle?
• 3:21
  SPEAKER_00: Oh, no.
• 3:22
  SPEAKER_01: I hate window.
• 3:24
  SPEAKER_01: You hate window, that's a strong word.
• 3:26
  SPEAKER_01: What is by the window you don't like?
• 3:28
  SPEAKER_00: I will tell you, when you're in an airplane and you want to go to the toilet or something, it's a problem when you're the you every time you need to convince the others to wake up for a moment because you need to pass, right?
• 3:38
  SPEAKER_00: I don't like it.
• 3:39
  SPEAKER_00: Sometimes it's at night, sometimes you don't feel comfortable to wake people.
• 3:43
  SPEAKER_00: So I prefer to be on the side, don't bother no one.
• 3:46
  SPEAKER_00: You can wake up when stand up whenever I want, go whenever I want.
• 3:49
  SPEAKER_00: So yeah, definitely.
• 3:51
  SPEAKER_01: I think on the same idea.
• 3:52
  SPEAKER_01: I think on short flights I prefer the window because I just gotta, you know, for a couple hours I can hide away in the corner, but for longer flights, I do like to be able to get up and whatever, and it's tough to do that if you're stuck away against the window.
• 4:03
  SPEAKER_01: All right, let's talk about business then.
• 4:05
  SPEAKER_01: So light spin in a unique uh spot, a lot of uh attention right now because of RSA.
• 4:11
  SPEAKER_01: So, Vladdy, I'm a simple person from Scotland.
• 4:14
  SPEAKER_01: We're a simple people, not very technical.
• 4:16
  SPEAKER_01: How would you explain to someone like me what LightSpin does?
• 4:21
  SPEAKER_00: So the most simple way to explain it is just click to prioritize and click to remediate any risk that you have in your cloud environment from your infrastructure service to your Kubernetes, from CACD security to runtime, all of those in one holistic solution.
• 4:39
  SPEAKER_01: Okay.
• 4:40
  SPEAKER_01: How are people doing it right now then without uh Lightspin?
• 4:43
  SPEAKER_00: Sorry, what what?
• 4:44
  SPEAKER_01: If they don't have LightSpin right now, like a company, how are what are they doing instead right now that's saying I need something to help me out here?
• 4:52
  SPEAKER_00: So it will be a challenge for them because, as I mentioned before, click to prioritize and click to remediate, just to function really difficult to get nowadays.
• 5:01
  SPEAKER_00: So most of the solutions on the market or open source will generate huge amounts of noise, which means that you will have to review manually thousands of thousands of alerts, and you will be super desperate, you will have the time to market, you probably won't understand part of these findings, and you even discover most of them are false positive.
• 5:22
  SPEAKER_00: And when you will find something that you really need to fix, you need to learn how to fix it.
• 5:26
  SPEAKER_00: And what happens when you understand Amazon that you know idea about Google Cloud, and now you need to fix something in Google Cloud.
• 5:33
  SPEAKER_00: So basically, they will spend a lot of time and a lot of effort in a desperate way to solve problems.
• 5:39
  SPEAKER_00: When they will get light spin on the other side, we will prioritize for them and clean the noise, give them focus only what should be done, plus we will do it for them by providing exactly how to fix it.
• 5:52
  SPEAKER_00: So basically, that's exactly what we do and what will happen if they want to use light spin.
• 5:57
  SPEAKER_01: I like the simplicity of click to prioritize, but I imagine there's a lot of intelligence that has to go in behind that to do that effectively for a company.
• 6:05
  SPEAKER_01: Is that where a lot of your innovation is?
• 6:07
  SPEAKER_00: Yes, we don't use the word intelligence, we use the word graph theory.
• 6:11
  SPEAKER_00: But yes, the magic behind all this technology those prioritization remediation is built on our unique technology, a graph algorithm.
• 6:21
  SPEAKER_00: You can say we're like the Google Navigator of the offensive cloud security.
• 6:24
  SPEAKER_00: Our technology can calculate for you the shortest path to the damage, we call it the attack path, and by that we help you to prioritize.
• 6:33
  SPEAKER_00: So when you get thousands of alerts and you don't know what to do with them, we provide you the context.
• 6:39
  SPEAKER_00: We explain how issue number one lead to issue number two leads to damage, and to calculate the shortest path, as I mentioned before the Google Navigator for Offensive Cloud Security, calculate the attack paths that help you to prioritize and reduce the amount of the alerts.
• 6:54
  SPEAKER_00: Once we do that, we do backtrack on the graph and use another algorithm in place, which is called root cause analysis, to generate for you automatically the infrastructure, the code, the right configuration to fix the solution.
• 7:07
  SPEAKER_00: And as you mentioned before, yes, that's exactly the heart and the magic behind LightSpeak.
• 7:13
  SPEAKER_01: And is that a solution that is accepted by min-market, by enterprises, everyone?
• 7:20
  SPEAKER_01: Where's the sweet spot for you in the market?
• 7:22
  SPEAKER_00: Yeah, basically everyone who is cloud can be a potential customer.
• 7:26
  SPEAKER_00: Having said that, we are spot on, we call it cloud native first.
• 7:32
  SPEAKER_00: The cloud native first are customers who use cloud by design.
• 7:36
  SPEAKER_00: Like the product is running on the cloud infrastructures by design for a couple of years.
• 7:41
  SPEAKER_00: Mostly can be found on SaaS companies.
• 7:43
  SPEAKER_00: Um it can be FinTech, it can be InsureTech, it can be crypto smart mobility.
• 7:48
  SPEAKER_00: And so, yes, that's basically where we are focusing nowadays.
• 7:52
  SPEAKER_00: We're less trying to sell to Fortune 500.
• 7:54
  SPEAKER_01: Yeah, if they're cloud first, cloud native, right?
• 7:56
  SPEAKER_01: They're more natural to understand it all.
• 7:59
  SPEAKER_01: And uh when you're thinking about targeting an organization, is it the security team which is the main buyer or is it the data team or the cloud team?
• 8:08
  SPEAKER_00: That's a good point because think about the following situation I'm in, right?
• 8:13
  SPEAKER_00: So from one side, the decision maker, the financial decision maker is the CISA.
• 8:17
  SPEAKER_00: But once he paid the check, deployment done, the security engineers using the platform.
• 8:23
  SPEAKER_00: But the security engineers using the platform and using through the platform to open, let's assume Jira ticket.
• 8:28
  SPEAKER_00: And once the Jira ticket is opened, it's forwarded to the DevOps, and DevOps fix the problem.
• 8:33
  SPEAKER_00: So basically, what we learned is that the end users are both the security engineers and the DevOps.
• 8:39
  SPEAKER_00: Security engineers will use the engine of the prioritization to get the focus and take the right decision maker based on the dynamic risk analysis, but the DevOps would love to use the remediation side of the solution to eliminate the kitchen efficiently, reduce the time to market, and simplify posture management.
• 8:56
  SPEAKER_01: So does that mean that you have to involve all these teams during the sales cycle?
• 9:00
  SPEAKER_00: Yes.
• 9:01
  SPEAKER_00: I think that in cloud security in general, it doesn't matter what you will do, you have to involve all of them.
• 9:06
  SPEAKER_00: Because even if you will use your connections and introduce me to some CISO, the CISO will tell me I would love to test your solution.
• 9:14
  SPEAKER_00: But in order to test the solution, you need permissions to cloud, and the owner for that in most of the cases will be the devs.
• 9:21
  SPEAKER_00: So, yes, we need to.
• 9:23
  SPEAKER_00: And that's how we put it in a different angle when we our vision is for engineers.
• 9:29
  SPEAKER_00: We want to be the most adaptive solution by engineers, in other words, for any stage of their cloud journey.
• 9:35
  SPEAKER_00: So we have a strong um inbound community approach and start for free approach so engineers can play with the platform, get the value before they will go to the decision maker to ask for the budget.
• 9:48
  SPEAKER_01: Right.
• 9:48
  SPEAKER_01: So you've talked about a good way to mitigate risk because they're able to tackle more and get more insight and do the remediation.
• 9:55
  SPEAKER_01: But also, it sounds like what part of the driver is operational as well, so that things can happen quicker and they can be more effective.
• 10:02
  SPEAKER_01: I'm wondering off the two risk mitigation and operational costs, which is the bigger driver, do you think, for organizations right now to look at light spin?
• 10:11
  SPEAKER_00: Yeah, I I think more than that, the challenge, like when you look on this digital transformation happen nowadays and everyone moves to the cloud, we see a lot that's and it's not something new, right?
• 10:24
  SPEAKER_00: We have starvation for experts, right?
• 10:26
  SPEAKER_00: We really have starvation for experts.
• 10:27
  SPEAKER_00: It's difficult to find someone who can be really good expert and talent to address all the problems we have in your cloud.
• 10:35
  SPEAKER_00: And when you succeed to find someone like that, he's expert in some specific aspect like Amazon or Kubernetes or Azure.
• 10:42
  SPEAKER_00: But the problem starting with that, you brought some Azure experts, and your infrastructure is multi-cloud.
• 10:49
  SPEAKER_00: So, how you can expect him to address those all problems, and that's exactly where we see the most biggest problem nowadays.
• 10:57
  SPEAKER_00: So companies have a budget for cloud security, but more than that, they need an efficiency, they need something that can give them the focus, that they can simplify, that they can bridge between those gaps.
• 11:07
  SPEAKER_00: And I think that's exactly where we give the best value and the best advantage on the market.
• 11:13
  SPEAKER_00: Got it.
• 11:14
  SPEAKER_01: What were you doing before founding LightSpin, Vladi, for you to come to this realization this was something worth building?
• 11:21
  SPEAKER_00: Yeah, so actually I came to solve or other Zar and myself, the my my co-founder.
• 11:28
  SPEAKER_00: We came to solve problems that we suffered from.
• 11:30
  SPEAKER_00: I do offensive cloud security for almost 10 years.
• 11:33
  SPEAKER_00: We I'm starting my journey in the intelligent, I'm a capitan on my rank, uh, was in the incident response and uh forensics uh teams, and after that I joined to Ernst Young for penetration testing position, and then I joined to General Electric for Vulnerability Researcher for cloud position.
• 11:52
  SPEAKER_00: And in my last um job, I was um I initiated a cloud security architec team for subcompany of Volkswagen for a big project called ODP.
• 12:04
  SPEAKER_00: So all my life I was an offensive approach of cloud security or OPSEC, and we suffered a lot from this problem of posture management in the cloud, so we decided to solve it by ourselves because we have the knowledge.
• 12:16
  SPEAKER_01: So then you were working in that project and realized you're wasting a whole bunch of time on things that should be a lot easier.
• 12:21
  SPEAKER_00: I didn't realize it, like it's something I suffered from for a while, for a couple of years in different positions.
• 12:28
  SPEAKER_00: And at some point, I just say, okay, it's a good time to stop everything I do and just try to solve the problem.
• 12:34
  SPEAKER_00: So we left our works, we left everything, and we just decided to initiate it.
• 12:38
  SPEAKER_00: This great company to provide value to people.
• 12:41
  SPEAKER_00: Okay.
• 12:41
  SPEAKER_00: Have you got a sales team right now, Vladi?
• 12:44
  SPEAKER_00: Yes, we have a team in the United States and England.
• 12:48
  SPEAKER_00: Um two A's in the United States, one for East Coast and West Coast, and one A for England.
• 12:54
  SPEAKER_01: And what was the time in your development and your journey that said, okay, now is the right time to bring in someone, the first person on the sales side?
• 13:03
  SPEAKER_00: I think I mentioned it before that I'm I'm a hands-on guy.
• 13:06
  SPEAKER_00: I'm really come to solve my own problems, and I think that's even so I know how to sell, it's always a good idea to bring someone who do that as an expert.
• 13:15
  SPEAKER_00: And more than that, sometimes when you look on the cultural differentiations, you need this experience because there's a huge differentiation between winning POC and converted deal.
• 13:25
  SPEAKER_00: So we're pretty fast understood that we need to bring sales leaders to support us on a professional way and in front of the customers.
• 13:34
  SPEAKER_00: And so yeah, we we have leaders since almost a year, actually, now when I think about it.
• 13:40
  SPEAKER_01: So, how long after founding did that come when did you have a product released, or were you still in stealth mode when that happened?
• 13:46
  SPEAKER_00: No, actually, we we in 2020 we raised seed.
• 13:50
  SPEAKER_00: In April 2020, we got the money, and then the release of the GA was in December.
• 13:56
  SPEAKER_00: In November, we actually announced a PRs that it's a new stealth mode company called Light Spin, it's now more in stealth mode, right?
• 14:04
  SPEAKER_00: Knows this style, and um we hired the first sales leader end of March.
• 14:11
  SPEAKER_01: End of March, okay.
• 14:12
  SPEAKER_00: Of 2021.
• 14:13
  SPEAKER_01: 2021.
• 14:13
  SPEAKER_01: So that was almost a year after you got the first money, right?
• 14:16
  SPEAKER_00: Yes, yeah, yeah, yeah.
• 14:17
  SPEAKER_01: And then was that a leader or did you get someone more junior?
• 14:21
  SPEAKER_00: So we don't have juniors, actually, all of our sales are sales leaders, but we don't have uh VP sales nodes, just have executives, senior executives.
• 14:31
  SPEAKER_01: Got it.
• 14:32
  SPEAKER_01: And any learnings as you went from Vladdy-led sales to sales-led selling, uh, how they kind of understood what you were doing and were able to take on the rein from what your efforts were before that.
• 14:45
  SPEAKER_00: So that is a lot.
• 14:46
  SPEAKER_00: It's like new domains that you are coming in, right?
• 14:49
  SPEAKER_00: But I think that one of the most important things in sales is order.
• 14:55
  SPEAKER_00: You need to really be understand how do you manage sales cycle.
• 14:59
  SPEAKER_00: And every time document and define tasks and uh see that you stand in your task and define new tasks.
• 15:07
  SPEAKER_00: And don't afraid to ask questions, customers, including questions like what do you think about the product?
• 15:13
  SPEAKER_00: Do you think it's kind of product you would like to have in your portfolio, right?
• 15:17
  SPEAKER_00: So you won't waste time or just okay, how can we move forward?
• 15:21
  SPEAKER_00: Because otherwise we can do POC forever.
• 15:24
  SPEAKER_00: But I think maybe the most important thing in sales is to manage forecasts.
• 15:28
  SPEAKER_00: That's my opinion, what makes sales leaders to be really strong.
• 15:35
  SPEAKER_00: It's an art in my person.
• 15:37
  SPEAKER_01: Yeah, so both of those I would agree with.
• 15:39
  SPEAKER_01: I'm just wondering, you know, when you were transitioning from just you selling to them selling for you, if in that transition, did you just hand it over or did you kind of do it with them for a while?
• 15:51
  SPEAKER_01: And and how did that process all work?
• 15:53
  SPEAKER_00: I'm really hands-on.
• 15:54
  SPEAKER_00: I'm all the time working with my teams.
• 15:56
  SPEAKER_00: So we're working together everyday things.
• 15:59
  SPEAKER_00: I'm super involved in all the opportunities.
• 16:02
  SPEAKER_00: I have my own opportunities also, especially in Israel and uh Switzerland and Australia, places like that, but everyone has his own region in manage it, and I'm of course involved in sync and brainstorming and statuses, and sometimes even if it needed joining the calls, there is a need in the CEO to join and give the additional value.
• 16:22
  SPEAKER_00: Here, most important thing is to just know how to manage team and get full transparency and trust between each other to know that we can work together, take a decision together, to get the conversion quickly.
• 16:35
  SPEAKER_01: And do you remember your first paying customer?
• 16:37
  SPEAKER_00: Yes, of course.
• 16:38
  SPEAKER_00: Forever.
• 16:39
  SPEAKER_01: Forever.
• 16:40
  SPEAKER_00: The C S and know that.
• 16:41
  SPEAKER_00: I always tell them forever, I will remember them.
• 16:45
  SPEAKER_01: And how did you first get in touch with that customer before they became a customer?
• 16:50
  SPEAKER_00: It actually was next insurance.
• 16:52
  SPEAKER_00: And I use my connection and get an opportunity to have a conversation with the C so he really liked what we do.
• 17:00
  SPEAKER_00: He became to be a design partner.
• 17:02
  SPEAKER_00: And after he became to be a design partner, he was really excited about the solution.
• 17:06
  SPEAKER_00: And at some point, I just asked him, okay, so what should I do?
• 17:09
  SPEAKER_00: So you will become to be a paying customer and say nothing, send me a quote.
• 17:14
  SPEAKER_00: And that's the story.
• 17:15
  SPEAKER_00: Since then, happy ever after.
• 17:18
  SPEAKER_01: Yeah.
• 17:19
  SPEAKER_01: Essentially, when you get so aligned with someone like that, right?
• 17:23
  SPEAKER_01: It just becomes natural to do business together, and it's not uncomfortable at all, right?
• 17:27
  SPEAKER_01: Yeah.
• 17:28
  SPEAKER_01: As you're looking five years out, Vladdy, what's your big vision for Lightspin?
• 17:32
  SPEAKER_00: Yeah, I think I mentioned it before.
• 17:33
  SPEAKER_00: Light spin's vision is to be the most adaptive solution by engineers, for engineers, in any stage of their cloud security journey.
• 17:42
  SPEAKER_00: I think that's our approach is value-oriented sales, and we're big believers in S more value as you give, you get back.
• 17:49
  SPEAKER_00: So that's what we expect in life in after in five years.
• 17:54
  SPEAKER_01: Good, good.
• 17:55
  SPEAKER_01: Well, if someone wants to get a hold of you or apply for a job, what's the best way to do that, Freddy?
• 18:00
  SPEAKER_00: So, first of all, LinkedIn, you can see or LinkedIn on our website.
• 18:03
  SPEAKER_00: Feel free to see all the open positions.
• 18:05
  SPEAKER_00: We're always available for you.
• 18:07
  SPEAKER_00: So if someone wants to reach out and get some questions, they can just ping them on LinkedIn or any one of my team.
• 18:13
  SPEAKER_00: I guarantee you that everyone will respond and would love to answer any questions they would like to have or just apply for an opportunity.
• 18:20
  SPEAKER_01: Awesome.
• 18:20
  SPEAKER_01: All right.
• 18:21
  SPEAKER_01: Well, listen, best wishes for RSA 2022 and also 2023.
• 18:25
  SPEAKER_00: Thank you very much.
• 18:27
  SPEAKER_01: Okay, a lot of good stuff in there for me that Vladi was talking about.
• 18:31
  SPEAKER_01: Three takeaways.
• 18:31
  SPEAKER_01: First of all, how they are thinking about targeting cloud native or cloud-first companies first.
• 18:38
  SPEAKER_01: You know, companies whose whole business is in the cloud and it's key to their ability to operate the company and provide a service or a product to their customers.
• 18:47
  SPEAKER_01: That's a key target for them.
• 18:48
  SPEAKER_01: They must understand the cloud world inside and out and be naturally more informed about the issues and what needs to be solved.
• 18:55
  SPEAKER_01: So that was one takeaway.
• 18:56
  SPEAKER_01: Second takeaway was he said that the CISO is the economic buyer, but other teams need to be involved, DevOps team, the security team itself, things like that.
• 19:05
  SPEAKER_01: So, you know, it is a multidimensional sale that needs to be done, even though the CISO is the end of the day is the economic buyer.
• 19:12
  SPEAKER_01: And I thought it was interesting, you know, when I asked him about learnings and what he feels about sales, he said, you know, what sales often needs is to make sure things are in order.
• 19:21
  SPEAKER_01: You know, there's a cadence, there's a process, things are squared away, there's an order to what they do, and that allows you to sell effectively, and then I would imagine also to build a method grow.
• 19:31
  SPEAKER_01: So three takeaways from me, you may have had different ones, but I enjoyed the conversation with Laddie and what likes when everything stats at RSA 2022 and through to 2023 as well.