Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 132: Sharon Goldberg, Founder and CEO of BastionZero talks selling targeted cybersecurity solutions

Transcript

132: Sharon Goldberg, Founder and CEO of BastionZero talks selling targeted cybersecurity solutions · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: Bastian Zero's journey involves research projects, breaches, crypto, and a pivot.
• 0:39
  SPEAKER_00: And now they are a finalist in the innovation sandbox at RSA.
• 0:43
  SPEAKER_00: Hear the stories and find out what they do and what their innovation is with their co-founder and CEO, Sharon Goldberg, in this episode.
• 1:01
  SPEAKER_00: Welcome to the Sales Bluebird podcast, which exists because at B2B startups it's hard to get consistent traction and scale the team.
• 1:09
  SPEAKER_00: Sales Bluebird provides you with tips, tricks, experiences, examples, and ideas and inspiration from people who know a thing or 10 about selling and building a startup.
• 1:19
  SPEAKER_00: I am your host, Andrew Monahan, and our guest today is Sharon Goldberg, the founder CEO at Bastion Zero.
• 1:26
  SPEAKER_00: Sharon, welcome to Sales Bluebird.
• 1:28
  SPEAKER_00: Thank you for having me.
• 1:29
  SPEAKER_00: Yeah, I'm looking forward to our conversation.
• 1:30
  SPEAKER_00: Bastion Zero was selected for the Innovation Sandbox finalists, list of 10 finalists at RSA this year, which is an incredible feat in itself because I hear there's like 800 people that do applications and you know Really?
• 1:42
  SPEAKER_00: Yeah, that's why I heard 10 gets selected for the final.
• 1:45
  SPEAKER_01: 800?
• 1:46
  SPEAKER_01: Are you serious?
• 1:47
  SPEAKER_01: I have no idea.
• 1:48
  SPEAKER_01: I had no idea.
• 1:49
  SPEAKER_01: I just submitted the application and just kind of forgot about it.
• 1:52
  SPEAKER_01: 800 people.
• 1:53
  SPEAKER_01: I didn't know that.
• 1:54
  SPEAKER_00: Yeah, it's a big deal.
• 1:55
  SPEAKER_00: And the panelists that are doing the judging, I believe, are the ones that go through your videos in that and say, yes, no, no, no, yeah.
• 2:02
  SPEAKER_00: What I like about it is this is not because you spent a lot of money with a magazine or something and you get listed, you know, this is a real proper selection.
• 2:10
  SPEAKER_00: So it's it's the real deal.
• 2:11
  SPEAKER_01: Yeah.
• 2:11
  SPEAKER_00: So congrats on that.
• 2:13
  SPEAKER_00: I'm really intrigued to learn more about Bastion Zero and hear what's going on that would cause you to get into the final 10 of such a big list.
• 2:20
  SPEAKER_00: But, Sharon, before we get to the business side of the list, get to know the real Sharon Goldberg.
• 2:26
  SPEAKER_00: There's no better way.
• 2:26
  SPEAKER_00: I've got a list of 15 questions, and we're gonna try something a little bit different.
• 2:31
  SPEAKER_00: We're gonna spin this wheel that you and I can see it.
• 2:33
  SPEAKER_00: If people listen to the audio, they won't be able to see it, obviously.
• 2:36
  SPEAKER_00: And I'm just gonna select for us one of these questions for you.
• 2:39
  SPEAKER_00: So let me spin the wheel and see what questions we get for you, Sharon.
• 2:46
  SPEAKER_00: Dive bar or cocktail bar?
• 2:48
  SPEAKER_01: Cocktail bar.
• 2:53
  SPEAKER_00: Beach or mountains?
• 2:55
  SPEAKER_01: That's really hard.
• 2:56
  SPEAKER_01: I probably spend more time on the beach.
• 2:58
  SPEAKER_00: I live in Colorado, so beach is a luxury for me.
• 3:01
  SPEAKER_01: Yeah, there are no mountains anywhere I've ever lived.
• 3:03
  SPEAKER_00: So beach.
• 3:04
  SPEAKER_00: There you go.
• 3:05
  SPEAKER_00: Beach it is.
• 3:06
  SPEAKER_00: All right, last question for you.
• 3:09
  SPEAKER_00: Suite of the four seasons or cabin in the woods?
• 3:12
  SPEAKER_01: Oh, that's super easy.
• 3:14
  SPEAKER_01: Four seasons all the way.
• 3:17
  SPEAKER_01: Completely.
• 3:18
  SPEAKER_00: Super easy.
• 3:19
  SPEAKER_00: You like the luxury, right?
• 3:20
  SPEAKER_01: No, I just don't like mosquitoes.
• 3:22
  SPEAKER_01: I have a really big problem with mosquitoes, so I could never camp, you know, because I break out completely in hives.
• 3:27
  SPEAKER_01: I would have to drug myself with Benadryl in order to survive the Cabin in the Woods experience.
• 3:32
  SPEAKER_00: I have that unique quality that attracts mosquitoes.
• 3:35
  SPEAKER_00: If there's 10 of us around a fire, I'm the one that gets bitten and no one else does.
• 3:38
  SPEAKER_01: Yeah, that's me too.
• 3:39
  SPEAKER_00: So I'm with you on that.
• 3:41
  SPEAKER_00: All right, let's get down to the business side of this then.
• 3:44
  SPEAKER_00: So, yes, Bastion Zero, selected for the innovation sandbox.
• 3:48
  SPEAKER_00: Give us a sense of where you are on the journey with whatever you can share about company size, number of people, things like that.
• 3:54
  SPEAKER_01: Yeah, so we are early in the journey.
• 3:57
  SPEAKER_01: We started building in September of 2020.
• 4:00
  SPEAKER_01: So we've been doing this for about 18 months.
• 4:02
  SPEAKER_01: I mean, when I say started building, like we started building, we had nothing really until September of 2020.
• 4:07
  SPEAKER_01: We're about 15 people and we're still in the phase of, I mean, we have paying customers, we have quite a number of them, but we're in the phase of working with our customers on rollouts, taking feedback, you know, expanding across their infrastructure and bringing in new customers where each customer kind of brings us some learning.
• 4:25
  SPEAKER_01: So we'll learn like we need to add this feature, or we need to have, you know, an upgrade path that's smoother.
• 4:31
  SPEAKER_01: Like all of these different things are happening from each customer.
• 4:34
  SPEAKER_00: So that's an exciting creation period.
• 4:37
  SPEAKER_01: Yeah.
• 4:39
  SPEAKER_01: On the other hand, I would say that we like what is sort of smooth and understood is like we know why people talk to us, we know why people care about this product, we know why they want the product.
• 4:52
  SPEAKER_01: And now it's just making sure that like we're covering the use cases in a way that's really smooth and easy for everyone.
• 4:58
  SPEAKER_01: But the why and the whether, I feel really good about that, which I have to say as a startup founder.
• 5:04
  SPEAKER_01: So if any other founders are listening, like that's a really good feeling because not being there, I also know that feeling too very, very well.
• 5:10
  SPEAKER_01: So like being in a place where, like, yeah, we're sitting on a product that people want, that's really cool.
• 5:16
  SPEAKER_00: And you know why, which is really cool.
• 5:18
  SPEAKER_01: Yeah.
• 5:18
  SPEAKER_00: Let's get to the details then.
• 5:21
  SPEAKER_00: So I'm uh I'm from Scotland, Sharon.
• 5:23
  SPEAKER_00: We're simple people.
• 5:24
  SPEAKER_00: I'm not very technical.
• 5:25
  SPEAKER_00: How would you explain what Bastion Zero does to someone like me?
• 5:29
  SPEAKER_01: It's very simple.
• 5:30
  SPEAKER_01: So you have an engineering team, they need to access your back end, right?
• 5:34
  SPEAKER_01: They need to access your servers, your Kubernetes clusters, your databases, all of that infrastructure that runs your company's product and applications.
• 5:42
  SPEAKER_01: You need to give them some way to get in because when things break, they need to get a way in.
• 5:46
  SPEAKER_01: You know, something goes wrong, they need a way in.
• 5:49
  SPEAKER_01: They may need to debug, there may be a security incident, they need to just get into the infrastructure and see what's going on.
• 5:54
  SPEAKER_01: So, how are you going to do that in a way that's secure, right?
• 5:57
  SPEAKER_01: And especially how are you gonna do that in light of the fact that that type of remote access vector is one of the most popular ways that adversaries infiltrate systems, right?
• 6:07
  SPEAKER_01: So the two most popular infiltration vectors for systems for infiltration is phishing and remote access.
• 6:12
  SPEAKER_01: So, how do you balance the challenge of locking down remote access, but also giving your engineers the type of access that they need to actually do their job and like recover from incidents and deal with incidents, right?
• 6:23
  SPEAKER_01: So that's the problem that we're solving.
• 6:25
  SPEAKER_00: And then how are people solving that right now?
• 6:28
  SPEAKER_01: Yeah, so that's what's so interesting.
• 6:29
  SPEAKER_01: I mean, this problem has been around forever.
• 6:31
  SPEAKER_01: Like ever since there's been computer systems, there has been this problem.
• 6:35
  SPEAKER_01: It's been solved in lots of different ways.
• 6:37
  SPEAKER_01: So if we go back like 20 years, what you would see is VPNs and Bastion hosts.
• 6:42
  SPEAKER_01: My company is called Bastion Zero after Bastion Hosts.
• 6:46
  SPEAKER_01: And so, you know, this problem has existed for a long time, and there's been sort of a number of products that solve this problem.
• 6:52
  SPEAKER_01: One of the most important ones is VPNs.
• 6:54
  SPEAKER_01: What VPNs do, which I think everyone listening knows, is you know, restrict people's access to a system based on their network address, based on their IP address, right?
• 7:04
  SPEAKER_01: So if I was to draw a picture for you, like think about your valuable assets here, like my head, and around it there's a big box, and that's the VPN.
• 7:13
  SPEAKER_01: So as long as you're not inside the box, you can't get into whatever assets there are.
• 7:16
  SPEAKER_01: But once you're inside, you can kind of go around and access all the assets that are in there.
• 7:21
  SPEAKER_01: So that's a really this perimeter VPN model is a very old model.
• 7:25
  SPEAKER_01: It's been around 20 or more years.
• 7:27
  SPEAKER_01: And what we found recently is that this model is just not good enough in the face of a modern adversary that is actually really trying to attack you, right?
• 7:37
  SPEAKER_01: And so even though VPNs is what we used in the past, there has been sort of a whole array of products and solutions that deal with the gaps in the security of a VPN.
• 7:47
  SPEAKER_01: There's also another really big gap that has always been existing and that has always needed to be addressed.
• 7:52
  SPEAKER_01: So if you think of a server, right?
• 7:54
  SPEAKER_01: You have a VPN, the VPN gets you into the server, but then to access the server itself, you may have like passwords or you may have SSH keys or you'll have some kind of credential that gets you into the server, right?
• 8:04
  SPEAKER_01: And so historically, we've always needed systems that give people access to the credentials that get them into the server.
• 8:11
  SPEAKER_01: So there's the VPN part, and then there's the actual target and what credentials you have on the target, right?
• 8:17
  SPEAKER_01: And so that second part, managing those credentials, has been done in like a myriad of ways over the last 20 years.
• 8:23
  SPEAKER_01: A lot of places, even today, don't do anything.
• 8:26
  SPEAKER_01: They just hand out SSH keys and they don't really have any kind of system there.
• 8:30
  SPEAKER_01: There are places where they've built their own system for managing SSH keys.
• 8:34
  SPEAKER_01: Sometimes they've built SSH certificate authorities.
• 8:37
  SPEAKER_01: And this is, by the way, not just for servers.
• 8:39
  SPEAKER_01: Like if you think about databases, databases have passwords.
• 8:41
  SPEAKER_01: How do you manage your database passwords?
• 8:43
  SPEAKER_01: If you have Kubernetes clusters, how do you manage your Kubernetes credentials?
• 8:46
  SPEAKER_01: Think of anything you have in there, it has a credential to get you into some sort of privilege or role in that machine.
• 8:52
  SPEAKER_01: How do you manage all that, right?
• 8:54
  SPEAKER_01: And so building out all those systems is something that people have needed to do for the last 20 years.
• 8:59
  SPEAKER_01: So traditionally they would just build it themselves.
• 9:01
  SPEAKER_01: And then there was this sort of category of products called PAM, privilege access management, that you're probably familiar with.
• 9:07
  SPEAKER_01: So classic way of solving this problem is put in a VPN and then put in a PAM.
• 9:10
  SPEAKER_01: VPN manages like who, you know, access and PAM manages the credentials to the servers, right?
• 9:16
  SPEAKER_01: And if you think about this, this is like a lot of machinery.
• 9:18
  SPEAKER_01: It's very heavy machinery.
• 9:20
  SPEAKER_01: So if you think about what our product does, is it takes both of those parts, like how do you get in?
• 9:24
  SPEAKER_01: And also all the credentials for the servers.
• 9:26
  SPEAKER_01: How do you manage all of that?
• 9:27
  SPEAKER_01: And we put that in one product, and that's what we're selling at Bastion Zero.
• 9:30
  SPEAKER_01: So I don't even have like a category name for this.
• 9:34
  SPEAKER_01: And I don't know if Gartner has even come up with the name.
• 9:37
  SPEAKER_01: I mean, but the idea is it's just infrastructure remote access, access to the backend for your production engineers.
• 9:43
  SPEAKER_01: But, you know, it's not broken up into these kinds of pieces like, okay, we're gonna buy a VPN and we're gonna build a Bastion host and we're gonna put a PAM in and we're gonna buy this thing.
• 9:50
  SPEAKER_01: It's just one cloud service that allows you to do all of this in one place.
• 9:54
  SPEAKER_01: And it just makes it a lot simpler because you just don't need to manage all these components yourself.
• 9:58
  SPEAKER_00: And you you mentioned the use case around developers getting the access.
• 10:01
  SPEAKER_00: Is that who the buyer is?
• 10:02
  SPEAKER_00: Or is the security team the one that's trying to catch up with what the developers are doing?
• 10:07
  SPEAKER_01: That's exactly right.
• 10:07
  SPEAKER_01: So I think the number one reason why people talk to us is they have infrastructure and it consists of a lot of things.
• 10:14
  SPEAKER_01: So majority of teams you'll talk to, they'll say, okay, I have servers, I have Kubernetes clusters, I have databases, I have 70 databases, I have 3,000 databases.
• 10:22
  SPEAKER_01: Like they have all these things, right?
• 10:24
  SPEAKER_01: They were put in place by all sorts of different teams at all sorts of different times, and they needed a way to access them because sometimes things went wrong and they needed a way to access them, right?
• 10:32
  SPEAKER_01: So what you end up with this is organic development of like many, many, many different remote access systems that many teams put to place over time.
• 10:40
  SPEAKER_01: And then at some point there's a security team hired and there's a CISO, maybe, or maybe not, and then there's someone in there who's like a cloud security expert.
• 10:48
  SPEAKER_01: And that person is like, hmm, I wonder what my risks are.
• 10:51
  SPEAKER_01: And they realize that they have like X number of different ways to have remote access into this cloud system that they're supposed to be getting under control.
• 10:59
  SPEAKER_01: And they may not even know what they are, right?
• 11:01
  SPEAKER_01: There may be five different ways that different teams use to manage EC2 instances, right?
• 11:05
  SPEAKER_01: So getting all of that under control and getting visibility into like a few key things, like who has access to what thing and who did access what thing, and what did they do with that access, right?
• 11:16
  SPEAKER_01: It's very hard to get a handle on that if you don't even know what the systems are.
• 11:20
  SPEAKER_01: So that's kind of the main reason that teams will talk to us and look at the solution.
• 11:24
  SPEAKER_01: And that's why, by the way, I told you that like we know why people talk to us.
• 11:27
  SPEAKER_01: It's because of this, right?
• 11:28
  SPEAKER_01: Like they don't have a good sense of even what's going on.
• 11:31
  SPEAKER_01: That's sort of the one main thing.
• 11:33
  SPEAKER_01: And the other main thing would be a lot of times I've heard from teams where they're afraid to give people access to certain parts of the infrastructure.
• 11:41
  SPEAKER_01: So they're sort of like not putting a support team on some sort of with giving access to some sort of support team because they're afraid, like we don't want to give these support engineers these keys or these credentials.
• 11:51
  SPEAKER_01: Like, what happens if they walk away with them?
• 11:53
  SPEAKER_01: We don't know these people that well.
• 11:55
  SPEAKER_01: They live in a different country, right?
• 11:56
  SPEAKER_01: Or they're contractors, or you know, they're not as highly trained as our production engineering team.
• 12:02
  SPEAKER_01: So that creates a lot of management problems and personnel problems.
• 12:05
  SPEAKER_01: And so sometimes they're looking actually to expand the access.
• 12:08
  SPEAKER_01: So it's either like they're trying to contract the access because everyone has access to everything, and or it's like not enough people are allowed to have access to all the things that they want.
• 12:17
  SPEAKER_01: And I've seen both actually.
• 12:18
  SPEAKER_01: But it's just basically a mismatch between the security team feeling unsafe to give access to certain people, or unsafe because they have no idea who has access to what and like how much privilege they have, right?
• 12:30
  SPEAKER_00: And I imagine that in the VPN world, overprivileged is the default, usually, right?
• 12:35
  SPEAKER_00: And that's why they're they're feeling a little bit nervous about things in the cloud world as well.
• 12:39
  SPEAKER_01: So there's a VPN world and then there's more than that.
• 12:42
  SPEAKER_01: So like I cannot tell you the number of times that people have told me like my bastion hosts keep me up at night.
• 12:47
  SPEAKER_01: Like they say that so much that it makes me laugh when they say that.
• 12:50
  SPEAKER_01: Like I'm trying not to laugh when they say that because I'm like, okay, you're like doing my pitch for me, you know, when they say that.
• 12:56
  SPEAKER_01: Because, like, here's an example of a thing that can happen.
• 13:00
  SPEAKER_01: You have a box and it's sitting there and it's got keys and credentials for 10 or 100 other boxes that are sitting behind it, right?
• 13:08
  SPEAKER_01: So, what does that mean?
• 13:09
  SPEAKER_01: That means if an adversary compromises that box, that's the bastion host, they can access the 10 or 100 machines that are sitting behind that bastion host, right?
• 13:17
  SPEAKER_01: So you've got to think about the security engineer who's like, well, I really hope there's not some kind of Oday in this box that's gonna get popped and I'm completely screwed, and someone's gonna be like, How could you put all these keys on this product?
• 13:30
  SPEAKER_01: Like, how could you have all these keys just sitting there for an adversary to steal and that just looks really bad, right?
• 13:35
  SPEAKER_01: So it's the kind of almost like um what I call a single point of compromise.
• 13:38
  SPEAKER_01: A lot of people call it that.
• 13:39
  SPEAKER_01: You have this really valuable single point of compromise that's just sitting there.
• 13:43
  SPEAKER_01: And so it's not just a matter of like over-privilege, you know, engineers have too much privilege.
• 13:48
  SPEAKER_01: There's also these places where credentials are just sitting around and it can be very scary for teams.
• 13:54
  SPEAKER_01: So the the VPN, uh, the Bastionhost case that I gave is really an example of single point of compromise.
• 13:59
  SPEAKER_01: Another thing that I see a lot is we have a shared SSH keys or we have shared, we all have the same password to the database.
• 14:07
  SPEAKER_01: We all know the database password, or we all know this admin credential or or something like that.
• 14:12
  SPEAKER_01: You know, everyone has root access to everything, right?
• 14:15
  SPEAKER_01: Because if you don't have tooling to actually get this under control, it's really, really hard.
• 14:20
  SPEAKER_01: And if you don't have anyone paying attention, then each sort of like infrastructure team or developer team will build something different and you'll have it's just an afterthought.
• 14:29
  SPEAKER_01: Chaos.
• 14:29
  SPEAKER_01: Yeah, it's nice from a sales perspective, and this is a sales conversation, it's nice from a sales perspective because you see when a company reaches a certain size, they want to have a certain level of maturity and they realize that like everything is just all over the place.
• 14:42
  SPEAKER_01: This cannot continue, right?
• 14:44
  SPEAKER_01: And that's when, you know, we come in with a product like this, and they don't necessarily want to go do things the old way with a VPN or with a PAM, right?
• 14:52
  SPEAKER_01: PAMs are sort of heavy and VPNs are incomplete.
• 14:55
  SPEAKER_01: It's an incomplete solution.
• 14:57
  SPEAKER_01: So you can purchase a VPN, but then you need to build the access system behind the VPN.
• 15:01
  SPEAKER_01: You need to figure out well, what about the admin credentials on the server?
• 15:04
  SPEAKER_01: What about the SSH keys for the server?
• 15:06
  SPEAKER_01: What about, you know, the database passwords, right?
• 15:09
  SPEAKER_01: All of that stuff you have to build out.
• 15:11
  SPEAKER_01: So you can buy a VPN, but then what about the rest?
• 15:13
  SPEAKER_01: Your team has to build that piece.
• 15:15
  SPEAKER_01: And who's going to build that?
• 15:16
  SPEAKER_01: Your security engineer.
• 15:17
  SPEAKER_01: And how many security engineers do you have?
• 15:19
  SPEAKER_01: And what do they cost when they're that good at infrastructure as well as security, right?
• 15:23
  SPEAKER_01: So that's where the opportunity is.
• 15:25
  SPEAKER_01: So, like I said, I feel really good about the market and the opportunity because you just see it over and over again.
• 15:31
  SPEAKER_01: You know, you talk to team.
• 15:32
  SPEAKER_00: Yeah, it sounds like from what you're saying, the risk mitigation is probably the biggest driver.
• 15:36
  SPEAKER_00: But I'm wondering if what you just said there around operational effectiveness as well, like, you know, having people do really admin type things around VPNs, et cetera, must really frustrate people as well.
• 15:47
  SPEAKER_01: Yeah, I mean, like think about these engineers that are doing this work.
• 15:51
  SPEAKER_01: Who are these people?
• 15:52
  SPEAKER_01: These are people who both know security and they also know cloud.
• 15:55
  SPEAKER_01: So just think about how expensive this person is, right?
• 15:59
  SPEAKER_01: Or people.
• 16:00
  SPEAKER_01: Think about how in demand they are, and then think about what happens when they great resignation out of your organization.
• 16:05
  SPEAKER_01: Like, what are you gonna do then?
• 16:07
  SPEAKER_01: Right?
• 16:08
  SPEAKER_01: So it's not a great system to try to maintain yourself.
• 16:11
  SPEAKER_01: I've certainly seen organizations that have put something in place 10 years ago and it's fine and it's just sitting there and it's working.
• 16:17
  SPEAKER_01: But you know, spending months on this is not a great idea.
• 16:22
  SPEAKER_01: Like, I'll tell you another story.
• 16:23
  SPEAKER_01: I talked to one group and they were telling us that they had built out something very similar to what Bastion Zero was.
• 16:29
  SPEAKER_01: This has happened to me a couple times, and I was like, Oh, it's too bad we didn't meet you on time.
• 16:33
  SPEAKER_01: And then I asked them always, like, how was it building this?
• 16:35
  SPEAKER_01: How long did it take you?
• 16:36
  SPEAKER_01: And I remember one team, he's the person said, Well, you know, the guy building it, he's a fantastic engineer, he's really great.
• 16:41
  SPEAKER_01: And I was like, Okay, here we go.
• 16:43
  SPEAKER_01: It's gonna take it's like one day.
• 16:44
  SPEAKER_01: And then the answer was, Oh, yeah, it took him two months, and he only built one third of the system.
• 16:48
  SPEAKER_01: And I was like, Okay, yeah.
• 16:50
  SPEAKER_00: Then he leaves.
• 16:51
  SPEAKER_01: Yeah, well, I mean, I don't know.
• 16:53
  SPEAKER_01: I mean, in this particular case, I don't know what happened, but I just thought it was so interesting because I was thinking, like, okay, this person is gonna tell me that, like, okay, I had a guy build this for me in two days, so why are you even bothering?
• 17:02
  SPEAKER_01: And then I should just like, you know, feel sad for a few days and think that we don't have anything to sell here.
• 17:07
  SPEAKER_01: But every time we get that kind of story, it usually results in I spent two weeks, I spent three weeks, I spent a month, you know.
• 17:14
  SPEAKER_01: Yeah.
• 17:14
  SPEAKER_00: So And then what is, if you were to summarize it, what is the big innovation that you think people are latching on to when they select you through to the finals here?
• 17:23
  SPEAKER_01: Yeah, so I haven't talked about it at all.
• 17:25
  SPEAKER_01: Let me tell you the story of the innovation here.
• 17:27
  SPEAKER_01: Because so far I've only been telling about the product in the market, which by the way, just to say I feel really excited that we figured this out a year and a half ago when this was not obvious in the market.
• 17:38
  SPEAKER_01: So that part, by the way, was I think just for my team.
• 17:41
  SPEAKER_01: I'm so proud of us for figuring that out because these indications were not there in the market like 18 months ago.
• 17:46
  SPEAKER_01: We're sort of like, okay, this needs to be a problem that's being solved.
• 17:50
  SPEAKER_01: And at the time there were only a few startups solving the problem, but there wasn't really anything clear as a solution.
• 17:56
  SPEAKER_00: What were you doing at the time to get that realization?
• 17:59
  SPEAKER_01: Oh, well, then I have to tell you the whole story of the company, which is like a crazy story.
• 18:02
  SPEAKER_01: Okay, so I'll tell you the story of the company, then I'll tell you the story of the innovation.
• 18:06
  SPEAKER_01: So the story of the company goes like this we actually used to be a blockchain company.
• 18:09
  SPEAKER_01: So the company was founded by myself and my co-founder.
• 18:12
  SPEAKER_01: We met at Boston University.
• 18:13
  SPEAKER_01: I'm a professor, first-time CEO, but you know, what I was doing before was I was leading a group of researchers at Boston University in information security and cryptography.
• 18:21
  SPEAKER_01: That's where I met my co-founder Ethan.
• 18:23
  SPEAKER_01: So what happened was we were doing a whole bunch of different things and we started to work in Bitcoin, actually.
• 18:29
  SPEAKER_01: And I'm saying Bitcoin because this is 2014.
• 18:32
  SPEAKER_01: So there was Bitcoin already, pretty much.
• 18:35
  SPEAKER_01: And so we were working on Bitcoin, and then we started publishing all these papers, and people started like commercializing our the results in our research papers.
• 18:44
  SPEAKER_01: And um, my co-founder actually, before he did his PhD, he was in startup world.
• 18:49
  SPEAKER_01: So he was basically coming into my office regularly and saying, Well, listen, like, look at all this stuff that's going on.
• 18:55
  SPEAKER_01: And I was like, okay, let's see.
• 18:56
  SPEAKER_01: Let's see if we could start a company.
• 18:57
  SPEAKER_01: And so we actually started.
• 18:58
  SPEAKER_01: A company was a blockchain company.
• 19:00
  SPEAKER_01: It was called Arwin.
• 19:01
  SPEAKER_01: And we did that for a while.
• 19:03
  SPEAKER_01: So that was fun.
• 19:03
  SPEAKER_01: And then what happened was March 2020 hit.
• 19:06
  SPEAKER_01: And at that time, all of our customers were banks.
• 19:08
  SPEAKER_01: And if you remember, at that time the interest rates in banks had changed.
• 19:13
  SPEAKER_01: And I'm forgetting the exact terminology because I just like blacked it all out in my memory.
• 19:17
  SPEAKER_01: But we lost all our customers within like a month of COVID hitting.
• 19:21
  SPEAKER_01: And we were sitting there, we're like, okay, what do we do?
• 19:23
  SPEAKER_01: And we didn't want to be a blockchain company anymore because actually we're cryptographers and information security people, and we were really struggling with the fintech aspects, the regulatory sort of financial services piece.
• 19:35
  SPEAKER_01: Because our customers were not like us.
• 19:37
  SPEAKER_01: Our customers were financial services people.
• 19:39
  SPEAKER_01: So we we weren't from the same world.
• 19:41
  SPEAKER_01: So we were like, why don't we just build a product for engineers?
• 19:44
  SPEAKER_01: Because we're engineers, everyone we know are engineers, our whole network is engineers.
• 19:47
  SPEAKER_01: Let's get out of this fintech thing.
• 19:49
  SPEAKER_01: We're just not that good at it.
• 19:50
  SPEAKER_01: So that's what we did.
• 19:51
  SPEAKER_01: And the reason that we picked this problem was because we were building these systems for moving millions of dollars of Bitcoin in a cloud service in a SaaS.
• 20:01
  SPEAKER_01: And one of the things that scared us the most was giving our engineers access into the SaaS to fix problems when they break.
• 20:08
  SPEAKER_01: We had the exact problem.
• 20:10
  SPEAKER_01: And, you know, we were small.
• 20:11
  SPEAKER_01: I mean, we were like 10 people.
• 20:13
  SPEAKER_01: So it wasn't like we could go buy like a cyber arc or something, you know, there were that we wouldn't have even imagined to do something like that.
• 20:18
  SPEAKER_01: We didn't even know what that was.
• 20:20
  SPEAKER_01: But we did have the problem and we were, you know, we were looking at how we solved the problem.
• 20:23
  SPEAKER_01: The way we solved the problem was the same way you would have solved the problem 20 years before, which was we put SSH keys in and we had a VPN, and it was like, this is crazy, like this cannot be, right?
• 20:33
  SPEAKER_01: And so we realized that like we were 10 people and we had this problem.
• 20:36
  SPEAKER_01: This problem must be everywhere.
• 20:37
  SPEAKER_01: And we sort of started looking around, and yeah, we realized that the problem was everywhere.
• 20:41
  SPEAKER_01: So that's how we figured out that we wanted to build this.
• 20:44
  SPEAKER_01: We actually were thinking of building a vault initially very, very early on, and then very quickly we realized there were like, you know, many, many very successful vaulting products.
• 20:52
  SPEAKER_01: And so there was no reason to build a vault.
• 20:54
  SPEAKER_01: And so we looked at remote access actually as the way because people actually, when we first started, I remember telling my investors they had decided that what we were doing was credential management, and we're actually not doing credential management, we're doing remote access, which is a different problem.
• 21:06
  SPEAKER_01: So that's how it started, where we just like we knew that as a tiny startup we had this problem.
• 21:11
  SPEAKER_01: We were really worried about it because if someone got our SSH keys, they could like steal Bitcoin, right?
• 21:16
  SPEAKER_01: So it was really, it was really a big problem.
• 21:18
  SPEAKER_00: What a journey, huh?
• 21:19
  SPEAKER_01: Yeah, that was a fun journey.
• 21:21
  SPEAKER_01: That's a story for another day, but pivoting in a pandemic is really hard.
• 21:25
  SPEAKER_01: But also, you know, like they say that like the best companies get built in hard times.
• 21:29
  SPEAKER_01: Like, I actually think that like we could do that during that time because everybody was just hunkered down and we just worked really hard on this idea with our team, with every one of our engineers.
• 21:41
  SPEAKER_01: We were just really focused on getting this product to work and figuring it out.
• 21:46
  SPEAKER_01: And there wasn't a lot of distractions.
• 21:48
  SPEAKER_01: It was just we're gonna figure this out and we figured it out.
• 21:50
  SPEAKER_00: So And that led you to say, well, let's figure it out, but let's do it differently than others.
• 21:55
  SPEAKER_01: No, I mean that part was always there, right?
• 21:57
  SPEAKER_01: So I have to tell you the other part of the story, right?
• 21:59
  SPEAKER_01: So I told you the pivot story and how we chose this specific problem to solve, but there's a bigger story here.
• 22:05
  SPEAKER_01: It's a bigger story is that my co-founder Ethan and I have been working together for a decade almost.
• 22:09
  SPEAKER_01: We met at BU.
• 22:11
  SPEAKER_01: We've written something like seven papers together, seven research papers together.
• 22:14
  SPEAKER_01: But you know, the story starts really in 2011.
• 22:17
  SPEAKER_01: So in 2011, I'm a professor at BU.
• 22:20
  SPEAKER_01: I'm pre tenure, I've been there for two years, and this crazy thing happens, which to me was like is still to me one of the most important cybersecurity incidents in history, but I don't think that other people see this the same.
• 22:32
  SPEAKER_01: Way I do, but for me it was one of the biggest ones.
• 22:34
  SPEAKER_01: So if I was to give you my top five cybersecurity incidents, this is in that list.
• 22:38
  SPEAKER_01: And that's the Diginotar incident of 2011.
• 22:40
  SPEAKER_01: Have you heard of that?
• 22:41
  SPEAKER_00: I have not.
• 22:42
  SPEAKER_01: You have not.
• 22:42
  SPEAKER_01: Yeah, so a lot of people haven't heard of it.
• 22:44
  SPEAKER_01: To me, it was an enormous event.
• 22:45
  SPEAKER_01: So what happened?
• 22:46
  SPEAKER_01: There was a certificate authority in the Netherlands for TLS, which is what your web browser uses to connect securely to websites.
• 22:52
  SPEAKER_01: So the security of the TLS ecosystem rests on certificate authorities, which basically certified public keys that are used in TLS.
• 22:59
  SPEAKER_01: So if that certification breaks, then the security of TLS completely falls apart.
• 23:03
  SPEAKER_01: There's no security at all.
• 23:04
  SPEAKER_01: It's completely broken, right?
• 23:05
  SPEAKER_01: So if a certificate authority gets hacked, then it turns out that even if one certificate authority gets hacked, the security of the entire TLS ecosystem falls apart completely.
• 23:14
  SPEAKER_01: And this is what happened in 2011.
• 23:15
  SPEAKER_01: Some obscure CA in the Netherlands got hacked, the keys were stolen, fraudulent certificates were issued, and what ended up happening was the adversary was able to read, just steal people's Google sessions, introspect on Google sessions, and break the security of TLS for Google, right?
• 23:30
  SPEAKER_01: So it was crazy because it was some random CA in the Netherlands.
• 23:33
  SPEAKER_01: And why did this happen?
• 23:34
  SPEAKER_01: Because there was one key there that was extremely powerful and could basically break the security of the whole ecosystem.
• 23:40
  SPEAKER_01: So the adversary went after that and stole that key.
• 23:43
  SPEAKER_01: And so what happened as a result was that the TLS ecosystem decided like we should not rely on CAs and blindly trust them the way we have for the last 20 years.
• 23:52
  SPEAKER_01: I mean, we always knew that that was the weak link of TLS, but it became very clear when, you know, it really happened, right?
• 23:58
  SPEAKER_01: And so then all this effort went into like minimizing the exposure of the ecosystem to a hack by a certificate authority.
• 24:07
  SPEAKER_01: So that's where certificate transparency came from.
• 24:09
  SPEAKER_01: That's where certificate pinning came from.
• 24:11
  SPEAKER_01: All of this stuff in TLS that like your web browser does now, it came out of this 2011 uh Digi Notar incident.
• 24:17
  SPEAKER_01: So that's why to me it's a huge incident because it changed the way we use TLS.
• 24:21
  SPEAKER_01: TLS, one of the most important protocols on the internet.
• 24:23
  SPEAKER_01: Okay, so that's 2011.
• 24:25
  SPEAKER_01: Now, what happened then was I basically my whole research program was affected by that because I started a research program around how do you limit the trust you put in a single authority or a single key so that you can't break the security of some system.
• 24:37
  SPEAKER_01: Because at the end of the day, the dirty secret in cryptography and in information security, and everybody listening to this knows this, is a lot of times there's one route of trust for your system.
• 24:45
  SPEAKER_01: And if that thing gets hacked, you can build all the fancy security you want, but that thing gets hacked, everything falls apart.
• 24:50
  SPEAKER_01: Your security completely collapses, right?
• 24:52
  SPEAKER_01: So in TLS, we no longer have this type of single point of compromise.
• 24:55
  SPEAKER_01: I mentioned we were actually a blockchain company for a while.
• 24:58
  SPEAKER_01: 2014, Mt.
• 24:59
  SPEAKER_01: Gox.
• 24:59
  SPEAKER_01: Have you heard of that?
• 25:00
  SPEAKER_00: No.
• 25:01
  SPEAKER_01: Do you remember that?
• 25:01
  SPEAKER_01: Mt.
• 25:02
  SPEAKER_01: Gox was the first cryptocurrency exchange that was hacked.
• 25:05
  SPEAKER_01: Bitcoin was stolen because Mount Gox was compromised.
• 25:08
  SPEAKER_01: So what happened as a result?
• 25:10
  SPEAKER_01: Again, Mount Gox, there was Bitcoin keys sitting in one place.
• 25:13
  SPEAKER_01: The adversary went after those keys because they're all just sitting there, right?
• 25:16
  SPEAKER_01: And stole those keys, stole a bunch of money, Bitcoin money.
• 25:18
  SPEAKER_01: So what happened in the Bitcoin ecosystem?
• 25:21
  SPEAKER_01: Very rarely today do you find situations where Bitcoin keys are sitting all in one place.
• 25:25
  SPEAKER_01: They're broken up into parts, they're spread around.
• 25:27
  SPEAKER_01: And if you really want to steal Bitcoin, you have to hack a lot of different separate independent places, right?
• 25:32
  SPEAKER_01: So you see like two ecosystems that are stress tested by adversaries and they adapt to not have these single points of compromise.
• 25:42
  SPEAKER_01: Okay, remote access, guess what?
• 25:44
  SPEAKER_01: Full of single points of compromise, right?
• 25:46
  SPEAKER_01: Even today, if you talk about the kind of product that I'm describing to you, some of the most cutting-edge products in this market are selling you a certificate authority, which is by the way, what Digi Notar was in 2011, got hacked and we no longer use those architectures.
• 25:58
  SPEAKER_01: So we were like looking at this market and we were like, well, how do people solve this problem now?
• 26:02
  SPEAKER_01: And we saw certificate authorities, we're like, okay, come on, like this can't be the state of the art, but it was, and it still kind of is, right?
• 26:09
  SPEAKER_01: And so what we're doing is we're coming in, we're saying, like, this is not the state of the art, guys.
• 26:13
  SPEAKER_01: Like infrastructure access is now going to be subject to the same kind of scrutiny that TLS was in 2011, that Bitcoin was in 2014.
• 26:22
  SPEAKER_01: I believe that we're kind of like at that moment now where we're last year we were, like we had the um solar winds incident, we had the Okta breach recently.
• 26:29
  SPEAKER_01: Those are all examples of cases where the adversary went over and attacked the place where you do authentication, right?
• 26:35
  SPEAKER_01: If you attack the place where Alice authenticates to the system, you break that, you can start authenticating adversaries, right?
• 26:42
  SPEAKER_01: Or fraudulent authentication, and then you can access all the things that trust the authentication system.
• 26:47
  SPEAKER_01: So in remote access system and in cloud security in general, we have a lot of reliance on the authentication system and we just trust it as a single point of compromise.
• 26:55
  SPEAKER_01: That is not a good architecture, and that's really our innovation.
• 26:57
  SPEAKER_01: We came and we said, like, we shouldn't be doing this anymore in this industry, especially when we see what we're seeing in terms of how adversaries are going after single points of compromise, just like they have in every other high-value industry that became higher value slightly before this one, let's say.
• 27:11
  SPEAKER_01: Right?
• 27:11
  SPEAKER_01: So Bitcoin, you get money.
• 27:13
  SPEAKER_01: TLS is like the most important security protocol in the internet, I would argue, because just used to secure every communication everywhere.
• 27:19
  SPEAKER_01: And now it's starting to be cloud security and infrastructure, right?
• 27:23
  SPEAKER_01: So that's where we came in.
• 27:24
  SPEAKER_01: Myself, I've been working on this line of work since 2013.
• 27:27
  SPEAKER_01: I have filed a grant for it.
• 27:29
  SPEAKER_01: I worked on it in the context of internet routing, I worked on it in the context of Bitcoin.
• 27:33
  SPEAKER_01: And when we started the company, we looked at the market and we saw certificate authorities.
• 27:37
  SPEAKER_01: And so we thought, this is an opportunity for us.
• 27:39
  SPEAKER_01: And you talk to customers and they get it.
• 27:42
  SPEAKER_01: Like they do get it.
• 27:43
  SPEAKER_01: It's not a common thing.
• 27:43
  SPEAKER_00: I was gonna ask you about that, right?
• 27:45
  SPEAKER_00: Does it take a very attuned security person to really be able to justify a purchase like that?
• 27:49
  SPEAKER_00: Or is it just generally accepted, yeah, we you're right, we should just shouldn't be doing it like that.
• 27:53
  SPEAKER_01: No, it's not that.
• 27:54
  SPEAKER_01: Like, I think that most people appreciate the model and they appreciate the concept.
• 27:58
  SPEAKER_01: I think where we struggle is that we're a startup.
• 28:00
  SPEAKER_01: So they know we're a startup and they're like, okay, that's good.
• 28:03
  SPEAKER_01: Like, so then it's a question of like, do I want to work with a startup that obviously has some sort of innovative model and product, or would I rather just buy something that's or build something on my own?
• 28:13
  SPEAKER_01: I mean, rarely do they build something on their own, to be honest, but or do I buy something that's a more established product and like they value the establishment of the product over the security model of our product?
• 28:23
  SPEAKER_01: That's the that's what we struggle with.
• 28:25
  SPEAKER_01: But I don't have a hard time explaining to people why the model matters.
• 28:30
  SPEAKER_01: I think they understand why the what the model matters.
• 28:32
  SPEAKER_01: Yeah, I think we need a little bit to scale out the story because a lot of times it's like me and technical folks on my team kind of giving this explanation.
• 28:40
  SPEAKER_01: And I'd love to be in a place where, you know, we can hire some sales folks or we can have sort of the materials where our teams can just kind of do this without a technical person on the call.
• 28:50
  SPEAKER_01: But, you know, if you get one of me or one of my technical folks talking to our customers, they get it.
• 28:55
  SPEAKER_01: And that's why they talk to us.
• 28:57
  SPEAKER_00: Yeah, a couple of things spring to mind as you were talking there.
• 28:59
  SPEAKER_00: One is that there are definitely companies and also people who are just more disposed to buying from early stage companies.
• 29:06
  SPEAKER_01: Right.
• 29:06
  SPEAKER_00: And there's those that no matter what you offer them, they're not gonna do it.
• 29:09
  SPEAKER_00: Right.
• 29:09
  SPEAKER_00: And it's one of the things they qualify pretty early.
• 29:12
  SPEAKER_00: And secondly, you know, your your story is very compelling, right?
• 29:15
  SPEAKER_00: And the question is when you bring in the the go-to-market team, how will they be able to tell their version of it, right?
• 29:21
  SPEAKER_00: And explain it in their way that people would that they understand and then that they can impart the value of it as well.
• 29:26
  SPEAKER_01: Yeah, I don't really tell the story that way to prospects um because it's so it's such a crazy story.
• 29:31
  SPEAKER_01: I mean, the whole story is crazy, right?
• 29:33
  SPEAKER_01: I mean, I'm a professor and my co-founder is a PhD, and we've been working on this for a while, and then we were a blockchain company, and then we decided to not be a blockchain company, and we ended up here.
• 29:41
  SPEAKER_01: So we normally we kind of talk to them about remote access and why they should care about it.
• 29:45
  SPEAKER_01: And then we call their attention to the fact that basically everything that this market calls zero trust is only focused on zero trust on the user side, but it's a hundred percent trust on the side of the authentication system, right?
• 29:59
  SPEAKER_01: So you put in a certificate authority or an SSO provider and you trust that 100%.
• 30:03
  SPEAKER_01: That is not zero.
• 30:05
  SPEAKER_01: You say zero trust, it sounds nice, right?
• 30:07
  SPEAKER_01: You don't trust the user, but you do trust the authentication system.
• 30:10
  SPEAKER_01: And what we're trying to say is zero trust should be not just, you know, the user on the user side, like worrying about your users holding credentials and getting hacked and like lateral movement and things like that, but it's also the system that you're using to authenticate the user that should be robust to adversaries.
• 30:24
  SPEAKER_01: It shouldn't be a single point of compromise.
• 30:26
  SPEAKER_01: But the majority of the products right now, that's how they're designed.
• 30:29
  SPEAKER_00: That's right.
• 30:29
  SPEAKER_00: They rely on the existing SSO or authentication system in place, and that provides that.
• 30:35
  SPEAKER_00: So do people then ask you, do you replace some of these authentication systems or are you sitting alongside them for certain use cases?
• 30:42
  SPEAKER_01: Yeah, so we don't replace your SSO.
• 30:44
  SPEAKER_01: So I guess the innovation is the following.
• 30:46
  SPEAKER_01: We don't want to be a single point of compromise.
• 30:48
  SPEAKER_01: So we can be a system to do, you know, authentication, which is like login, are you really who you say you are?
• 30:53
  SPEAKER_01: Then authorization, which is does Sharon have access to the root user on, you know, server one, two, three in New York City, right?
• 31:01
  SPEAKER_01: That's authorization.
• 31:02
  SPEAKER_01: And then audit.
• 31:03
  SPEAKER_01: So tracking like what access I actually have, what privileges I actually have, and then what I did with that access, like recording my sessions or logging my commands.
• 31:12
  SPEAKER_01: So we can do all of those things, right?
• 31:14
  SPEAKER_01: But we don't want to be the only root of trust for doing those things.
• 31:18
  SPEAKER_01: And so what we do is we actually add a second route of trust, which is your authentication provider.
• 31:23
  SPEAKER_01: So if you use Octar, if you use G Suite, or if you use Azure AD as your SSO provider, what we do is we built a protocol that requires both us and your SSO provider to participate in order for you to access a server.
• 31:36
  SPEAKER_01: Right.
• 31:36
  SPEAKER_01: And so what that does is that if we get hacked, your SSO provider is still not hacked, then you know the targets are not going to be compromised.
• 31:43
  SPEAKER_01: It also means that, you know, our cloud service can't access the targets on its own.
• 31:46
  SPEAKER_01: It doesn't have privilege access to the targets because the SSO provider has to participate.
• 31:51
  SPEAKER_01: Like if you work at Acme Co., I can't log in as a user of ACMICO.
• 31:55
  SPEAKER_01: You didn't give me an account, even though I'm the CEO of Bastion Zero.
• 31:57
  SPEAKER_01: I don't have an account at Acme Co.
• 31:59
  SPEAKER_01: So I can't log into your targets, even though, you know, it's the cloud service.
• 32:02
  SPEAKER_01: And like if I really wanted to, I could do stuff too, even though I actually personally can't do anything.
• 32:07
  SPEAKER_01: But, you know, anyone at my company cannot access your targets because we need your SSO provider to participate.
• 32:13
  SPEAKER_01: And if you don't give us a login to your company, we can't access your targets, right?
• 32:17
  SPEAKER_01: So the idea is that we actually do sit along alongside your SSO provider.
• 32:21
  SPEAKER_01: We integrate with it, but we do it in such a way that like you can't actually get into the targets unless the SSO provider participates.
• 32:28
  SPEAKER_01: So that's how we get rid of this problem of having a single point of compromise in the authentication system, right?
• 32:33
  SPEAKER_01: Because you're authenticating to the SSO, you're also authenticating to us, right?
• 32:37
  SPEAKER_01: And those are separate routes of trust.
• 32:39
  SPEAKER_01: So neither one of them has control of the infrastructure you need both in order to have control.
• 32:43
  SPEAKER_00: We're starting to get to the end of the timeshare.
• 32:45
  SPEAKER_00: I'm curious, as you think about the next few years, where do you see the market going or what do you think lies in store for you about how this expands out and has more use cases and more users?
• 32:56
  SPEAKER_01: Yeah.
• 32:56
  SPEAKER_01: Well, I think one thing that we're doing, I think that a lot of companies do at the stage that we're at, is we're deliberately looking for tech stacks that are simpler, right?
• 33:06
  SPEAKER_01: And newer and sort of avoiding tech stacks that have 20 years of legacy technology, you know, all this complicated protocols or old operating systems.
• 33:16
  SPEAKER_01: That's as you can imagine, and I think everyone here listening knows that makes things really hard for the engineering team to build out all those use cases, right?
• 33:24
  SPEAKER_01: So we're really uh technology stack focused right now with this product.
• 33:28
  SPEAKER_01: But I think what's interesting is some of the older legacy stacks are really the ones that are getting compromised.
• 33:35
  SPEAKER_01: So there's actually quite a lot of business there to be done in securing these legacy infrastructure.
• 33:40
  SPEAKER_01: And that's gonna be very interesting because the newer stacks, maybe they don't even have any solutions at all, right?
• 33:46
  SPEAKER_01: They just have like what I described, this sort of like random different systems that different people have put in over time.
• 33:51
  SPEAKER_01: And that's the case in some of the older companies as well.
• 33:54
  SPEAKER_01: But you know, in some of these enterprises, they're also using some of these older products.
• 33:58
  SPEAKER_01: So I actually think it's gonna be interesting to see what's happening with some of these more legacy like VPN or PAMs versus a product like ours, which is more modern, has a better security architecture, and is easy to deploy because we do things like auto-discover targets, like integrate with your identity provider, like, you know, without having you do a lot of things, you know, rolling out to your users in a very simple way.
• 34:21
  SPEAKER_01: So having that versus what the older technology has and the bigger enterprises are dealing with is gonna be interesting.
• 34:29
  SPEAKER_01: So I think that's the place where it's sort of macro-wise, like, how is this gonna shake out?
• 34:34
  SPEAKER_01: Because we're in a segment of the market where I don't believe there's too many legacy solutions.
• 34:39
  SPEAKER_01: Like people have VPNs sometimes, but that's pretty much it.
• 34:42
  SPEAKER_01: There's a whole rest of the market that's built up like different solutions with different tools that can be potentially disrupted.
• 34:49
  SPEAKER_01: So, you know, we are focused on the simpler, more modern stack, but there's a lot more out there.
• 34:55
  SPEAKER_01: And, you know, you can go into industrial controls, you can go into manufacturing, like there's this problem is everywhere.
• 35:01
  SPEAKER_01: It's quite hard to solve, though, once you get into these really complicated old legacy stacks.
• 35:06
  SPEAKER_01: But but I think that the market is just really, really big.
• 35:09
  SPEAKER_01: You know, the more you can deal with, the more you can absorb in a product like this, then the the more market you can unlock.
• 35:14
  SPEAKER_00: Yeah, it sounds like the smart way was to start with the more modern stacks, right?
• 35:18
  SPEAKER_00: Because then you get the traction, you learn.
• 35:20
  SPEAKER_00: And the tougher thing is the older ones and what has to change and the technology to be able to be effectively used in those different environments.
• 35:27
  SPEAKER_01: I mean, there's also the bet that like they move towards a more modern stack.
• 35:31
  SPEAKER_01: So like this set of customers that we can, you know, reach over time gets bigger because they actually get closer to where we are.
• 35:36
  SPEAKER_01: But yeah, there is like just think about all these machines that are out there running software and people need access to them.
• 35:42
  SPEAKER_01: How are you gonna do that?
• 35:43
  SPEAKER_01: Well, that's what we solve.
• 35:45
  SPEAKER_00: Every company has their legacy older systems line around ES400s running whole systems inside the company, for example, right?
• 35:51
  SPEAKER_01: Yeah, you'd be surprised.
• 35:53
  SPEAKER_01: I mean, you see all kinds of stuff even with like small companies.
• 35:55
  SPEAKER_01: I mean, we just find stuff everywhere.
• 35:57
  SPEAKER_01: We've seen a lot of interesting, you know, a lot of interesting things.
• 36:00
  SPEAKER_01: So we're just trying to keep the scope of our deployments a little bit limited so that we can scale faster.
• 36:07
  SPEAKER_00: Well, Sharon, I really enjoyed this conversation.
• 36:09
  SPEAKER_00: Uh, if someone wants to continue the conversation with you, what's the best way to get hold of you?
• 36:13
  SPEAKER_01: Well, depending on when this podcast comes out, I'm actually going to be at RSA.
• 36:17
  SPEAKER_01: So if you want to talk to me, you can actually meet me there because I'll be there like a real person walking around with my mask on.
• 36:23
  SPEAKER_01: So that's one opportunity.
• 36:24
  SPEAKER_01: Otherwise, yeah, we have a forum on our site.
• 36:27
  SPEAKER_01: You know, just fill it out.
• 36:28
  SPEAKER_01: We watch it very carefully, as you can imagine, like every startup.
• 36:31
  SPEAKER_01: So be very interested to connect and hear about use cases that you may have.
• 36:35
  SPEAKER_00: And it's bastionzero.com, is that right?
• 36:38
  SPEAKER_01: Yes, that's right.
• 36:39
  SPEAKER_00: Okay, so that's where to go.
• 36:40
  SPEAKER_01: So it's bastion zero for zero trust bastion or zero bastions in your network.
• 36:45
  SPEAKER_01: Get rid of all your bastions.
• 36:46
  SPEAKER_00: It's got all angles covered.
• 36:48
  SPEAKER_01: All angles covered, yes.
• 36:49
  SPEAKER_00: That's great.
• 36:50
  SPEAKER_00: Well, listen, I enjoyed the conversation.
• 36:52
  SPEAKER_00: I really do wish you well in the final process in the innovation sandbox, and see how all this plays out both then but also in the coming months.
• 37:00
  SPEAKER_00: You're in a really super exciting time and doing incredible things.
• 37:03
  SPEAKER_00: I wish you all the best for the rest of the year and into the next year.
• 37:06
  SPEAKER_01: Thank you.
• 37:06
  SPEAKER_00: So thanks very much, and uh look forward to meeting you again in the future.
• 37:10
  SPEAKER_01: Thank you.
• 37:10
  SPEAKER_00: Well, for me, that was a really super interesting conversation with Sharon.
• 37:15
  SPEAKER_00: Quite the journey that her, her and her co-founder Evan have been on, and the coming to the market of Bastion Zero as the seeds of the technology and the thinking were formed over the years.
• 37:26
  SPEAKER_00: In terms of takeaways for me, I really had three.
• 37:29
  SPEAKER_00: First of all, uh, what that journey enabled Sharon and team to do was really understand the problem, the absolute core problem that people are facing in a level of detail and a way of talking to the prospects that they just get and they really latch on to.
• 37:44
  SPEAKER_00: Like she was saying that people really, when they hear it, it makes sense to them about the problem and what they're doing to solve it.
• 37:50
  SPEAKER_00: So that was one.
• 37:51
  SPEAKER_00: Secondly, having said that, always be learning from early customers.
• 37:55
  SPEAKER_00: She said right at the start that they're in that mode of really learning what the customers are doing, the the uh guardrails they're bumping into, things that they need to expand to, they need to add features in.
• 38:05
  SPEAKER_00: Her and the team are definitely learning and observing and engaging from those early customers to get that feedback and shaping the product as they go along.
• 38:13
  SPEAKER_00: And then the third one for me was really interesting, which was you know, know what you want to be doing.
• 38:18
  SPEAKER_00: When she talked about how they were in the fintech crypto world, you know, she said they realized it just wasn't their sweet spot.
• 38:23
  SPEAKER_00: It got into a whole bunch of things around compliance and things like that, they just didn't care for.
• 38:29
  SPEAKER_00: And really at heart, they were information security researchers and they were identity and cryptography people.
• 38:36
  SPEAKER_00: And therefore, their real sweet spot and where their passion was was somewhere completely different than the kind of Bitcoin and fintech world.
• 38:44
  SPEAKER_00: And when they decided where they were going to pivot in March and April of 2020, that was one of the governing things that they they were looking at.
• 38:50
  SPEAKER_00: So those were my three takeaways, and I really wish Sharon and team every success in the innovation sandbox contest, and also for the rest of 2022 and and 2023.