Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / RSAC Innovation Sandbox Finalist: P0 Security with CEO, Shashwat Sehgal

Transcript

RSAC Innovation Sandbox Finalist: P0 Security with CEO, Shashwat Sehgal · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_01: Welcome to the Cybersecurity Go to Market podcast for a special showcase episode where we're talking to leaders of the companies selected for the 2024 RSA Conference Innovation Sandbox.
• 0:54
  SPEAKER_01: These are just the 10 companies the judges have selected as the most innovative startups in cybersecurity today out of hundreds to apply.
• 1:04
  SPEAKER_01: I am your host, Andrew Monahan, and today we're talking with Shashwat Sega, CEO and co-founder at P Zero Security.
• 1:12
  SPEAKER_01: Shashwat, welcome to the podcast.
• 1:14
  SPEAKER_01: Good to be here, Andrew, and great to meet you.
• 1:16
  SPEAKER_01: Yeah, good to meet you.
• 1:17
  SPEAKER_01: It must be a bit of a thrill to get selected down to one of the 10 finalists.
• 1:20
  SPEAKER_01: That's quite an honor.
• 1:21
  SPEAKER_00: Yeah, thank you.
• 1:22
  SPEAKER_00: And I'm quite looking forward to meeting everyone, uh, customers, judges, and the broader community alike at uh over at RSA.
• 1:29
  SPEAKER_01: Yeah, the sandbox innovation day Monday has turned into quite a big thing.
• 1:33
  SPEAKER_01: Uh, so it's uh it's quite exciting to see these companies get the chance to showcase what they're doing.
• 1:38
  SPEAKER_01: But let's get into our discussion today, Shash.
• 1:40
  SPEAKER_01: What first question for you where in the world did you have your first sandbox?
• 1:46
  SPEAKER_00: Great question.
• 1:47
  SPEAKER_00: So I grew up in uh in New Delhi, India.
• 1:50
  SPEAKER_00: And that's where I spent my childhood.
• 1:52
  SPEAKER_00: That's where I went to university.
• 1:54
  SPEAKER_00: And then I've been and uh kind of going around the world for my career.
• 1:58
  SPEAKER_00: I spent a few years in London, uh, moved to New York, and for the last 10 or so years I've been out here in the Bay Area.
• 2:05
  SPEAKER_01: Well, I must be a thrill to be able to come from you know one hotbed, which of course is India, you know, for tech-wise these days, into another one, which is Silicon Valley, where a lot's going on at the moment.
• 2:15
  SPEAKER_01: Uh, what's the story of the founding of P0 Security, Shashwat?
• 2:21
  SPEAKER_00: So this goes back to what I was doing uh before I started the company.
• 2:25
  SPEAKER_00: I was at Splunk, and uh at Splunk, I was leading product management teams, multiple product management teams within observability.
• 2:34
  SPEAKER_00: And this is that's where I met my co-founder Greg, uh, who's who's also my CTO.
• 2:39
  SPEAKER_00: What we had noticed was that Splunk was the security team at Splunk was having a very hard time uh at the time trying to make sure that cloud uh was secure.
• 2:51
  SPEAKER_00: What do we mean by that?
• 2:53
  SPEAKER_00: We were building all of these big uh item, you know, big technologies uh as part of an observability suite.
• 3:00
  SPEAKER_00: And we were looking to make sure that these were something that the Fortune 100s, the Fortune 500s felt safe deploying.
• 3:08
  SPEAKER_00: And as part of that, obviously the security team wanted to make sure that the access to Splunk's critical infrastructure was secure.
• 3:17
  SPEAKER_00: In other words, um they were, you know, they could regulate access to both human identities and non-human identities to any kind of sensitive resources in the cloud.
• 3:27
  SPEAKER_00: Now, this sounds very straightforward in theory, but as we started implementing these access controls within our environment, what we realized was that uh the cloud was quite different from the the technologies that came before it.
• 3:42
  SPEAKER_00: Specifically cloud native technologies like Kubernetes, like microservices, etc., were especially challenging to secure access for.
• 3:50
  SPEAKER_00: Why was this this the case?
• 3:52
  SPEAKER_00: As we dug deeper, we found out that this was difficult because the cloud was unique in at least two ways from how application development used to happen before the cloud.
• 4:03
  SPEAKER_00: What were those two ways?
• 4:05
  SPEAKER_00: Firstly, it was an order of magnitude more complex.
• 4:08
  SPEAKER_00: Why was it more complex?
• 4:09
  SPEAKER_00: Previously, all security teams needed to care about was to make sure humans don't have access to a production infrastructure.
• 4:17
  SPEAKER_00: Now they had to make sure humans as well as non-human identities did not have access to production infrastructure.
• 4:23
  SPEAKER_00: The number of identities exploded 100x from what it used to be before, and the number of access paths to sensitive infrastructure and sensitive data also exploded in number, right?
• 4:34
  SPEAKER_00: So the first reason why this was a challenging was just the sheer complexity.
• 4:38
  SPEAKER_00: And the second reason we found it was so challenging was because previously the tools that secured access to any sensitive information or sensitive data or sensitive infrastructure, they were not built with the from the f from the perspective of a developer.
• 4:53
  SPEAKER_00: Now, increasingly with cloud native development, the gatekeepers of the cloud are developer teams as opposed to IT and security teams.
• 5:01
  SPEAKER_00: Right?
• 5:01
  SPEAKER_00: So it's the incentive of someone in security is to ensure that the changes that they are introducing, the access controls that they are introducing into the system, does not impede a developer in any shape or form.
• 5:15
  SPEAKER_00: And this, what we found, was extremely hard to do with the existing tools.
• 5:19
  SPEAKER_00: So that's how we got started.
• 5:21
  SPEAKER_01: Does that mean that uh your buyer is on the development side or is it still on the security side?
• 5:26
  SPEAKER_00: A buyer is still on the security side, but we have designed our tools to be we have taken a lot of care to ensure that the eventual users of a product, which is typically the developer team, uh they are not impeded in any shape or form.
• 5:42
  SPEAKER_00: We meet them where they are in their journey rather than introducing new workflows, new ways of doing things.
• 5:48
  SPEAKER_00: You know, for example, uh, we've gone all in on integrations with command line, with uh integrations with Slack, rather than deploying a new software on on the laptop of a of a of a developer or asking them to log into a new portal, we try to meet them as much as possible where they are so that we are as less of a hindrance to them in their day-to-day work as possible.
• 6:10
  SPEAKER_01: And where were you and Greg uh as you sat down and thought, you know what, why don't we just do a company to solve this?
• 6:17
  SPEAKER_00: Yeah, so that's when we started facing this problem internally, that's when we decided, hey, there's probably a company to be built somewhere in this problem, right?
• 6:26
  SPEAKER_00: Uh somewhere in this space.
• 6:27
  SPEAKER_00: Uh so that's when I also started talking to my third co-founder, Nathan.
• 6:33
  SPEAKER_00: He and I were peers a couple of jobs ago, uh, when we were at Meraki, Cisco Meraki.
• 6:40
  SPEAKER_00: So at Cisco Meraki, I led the the SD-VAN team, and he was my engineering counterpart, right?
• 6:46
  SPEAKER_00: So collectively, we've been in this security space for the longest time.
• 6:50
  SPEAKER_00: And so he had left Meraki to become the VP of engineering at SemGrep.
• 6:55
  SPEAKER_00: And then he was thinking about his next steps after leaving SemGrep.
• 6:59
  SPEAKER_00: So the stars just aligned, and you know, Greg, Nathan, and I decided to start the company in late 2022.
• 7:05
  SPEAKER_00: That's awesome.
• 7:06
  SPEAKER_01: And going back to your your problem statement, so I get the fact that uh you had a developer first mindset to make sure that they were they were catered for.
• 7:14
  SPEAKER_01: But what's the bigger innovation the judges would have seen in what you do that got them so excited?
• 7:19
  SPEAKER_00: Yeah, so the broad space that we are operating in historically has been called as IGA, identity governance and administration, right?
• 7:28
  SPEAKER_00: Historically, this space has been targeted towards developers or specifically not even developers, towards human users or employees of an organization as they look to gain access to applications, right?
• 7:42
  SPEAKER_00: And we believe we are the next iteration of this space specifically for the cloud and specifically for a cloud development stack, which means we include not just developers but non-human identities as well.
• 7:54
  SPEAKER_00: So we believe the two innovations that we bring to the table is that we are solving this problem holistically for the cloud for all kinds of access across all kinds of identities.
• 8:05
  SPEAKER_00: That's one.
• 8:05
  SPEAKER_00: And the second innovation that we are getting to the table is that uh we've designed our product, the form factor of the product, to, you know, in a way that does not uh introduce any kind of friction to developer workflows.
• 8:18
  SPEAKER_01: So developers being important, people inside an organization in terms of the systems they support, and usually they they help the company run and make money.
• 8:25
  SPEAKER_01: So therefore, keeping them happy is a big deal.
• 8:28
  SPEAKER_00: Absolutely.
• 8:28
  SPEAKER_00: So every company requires some kind of access governance.
• 8:33
  SPEAKER_00: And for better or for worse, uh access governance has been synonymous with some kind of a trade-off between security and productivity.
• 8:42
  SPEAKER_00: And we want our goal is to make sure that this trade-off, to the extent that one exists, is minimized in any company.
• 8:50
  SPEAKER_00: Okay.
• 8:51
  SPEAKER_01: You know, intuitively, I I get the idea that lots of lots more excess is is going to have an impact on your ability to mitigate risks.
• 8:59
  SPEAKER_01: But what is what's the biggest business impact to this that people are really worried about?
• 9:03
  SPEAKER_01: Is there evidence to say that you know having all these non-human identities is a challenge is causing problems and and uh you know people are getting breached left, right, and center from them?
• 9:12
  SPEAKER_00: Yeah, absolutely.
• 9:13
  SPEAKER_00: So there are usually three sources of business impact to most of our customers, right?
• 9:19
  SPEAKER_00: The first source is obviously one of security.
• 9:22
  SPEAKER_00: At the end of the day, we are a security company, right?
• 9:25
  SPEAKER_00: By some estimates, uh, between 65 and 75% of uh cloud security incidents in 2023 had something to do with some kind of an identity misconfiguration.
• 9:37
  SPEAKER_00: If you think about it, that's a shocking number, right?
• 9:40
  SPEAKER_00: And um if you're able to move the needle on this statistic, even like let's say 10 to 20 percent, that's that could be huge in terms of its repercussions on the security posture of a company, right?
• 9:52
  SPEAKER_00: So so that's that's one.
• 9:53
  SPEAKER_00: Secondly, a business metric for us is to improve the operational efficiency of a company, right?
• 9:59
  SPEAKER_00: So many of our customers they use us day in, day out for you know things such as automating access requests for individual engineers or for automating uh access reviews of uh non-human identities, levels of uh access to the cloud, right?
• 10:18
  SPEAKER_00: So in many instances, we end up saving them hours of their time per week, several hours of their time per week, right?
• 10:25
  SPEAKER_00: So it's it's not hard to tie that to some kind of a business outcome in terms of we all live in a world of now that the zero interest rate environment is is gone, everyone starts to worry about their margins once again, right?
• 10:39
  SPEAKER_00: So we help um do team, we help security and DevOps teams do more with less.
• 10:44
  SPEAKER_00: So that ties frequently into yet another business outcome for our customers.
• 10:49
  SPEAKER_00: And and the third uh business imperative for a lot of customers is that uh many of their own customers, especially if they are selling to upmarket enterprise, large enterprise, many of their own customers will come with some kind of stringent requirements on on securing access to their internal data and internal infrastructure, right?
• 11:12
  SPEAKER_00: And to do that, the easiest way to secure access to whoever it is uh that that requires access is to use someone like P0, right?
• 11:22
  SPEAKER_00: So those are the three big business drivers security, operational efficiency, and revenue growth as you start going up market, uh, that we usually tie into.
• 11:31
  SPEAKER_01: That's correct.
• 11:32
  SPEAKER_01: You're tied into the three main uh revenue uh business drivers, right?
• 11:35
  SPEAKER_01: That's that's awesome to be able to do that.
• 11:37
  SPEAKER_01: Must put you in a good position when you're talking with prospects who are, as you say, they're scrutinizing this a lot more than they were two years ago.
• 11:44
  SPEAKER_01: So it sounds like you're used to having that conversation with people.
• 11:47
  SPEAKER_01: Yeah.
• 11:47
  SPEAKER_01: So I just look at the rest of the year, what are your big goals for 2024?
• 11:53
  SPEAKER_00: Um well, life in uh the the journey of a startup is that your goals are mostly or almost always on a two-week time horizon or a one-month time horizon rather than on a one uh year time horizon.
• 12:07
  SPEAKER_00: Uh but yeah, I mean jokes, jokes aside, right?
• 12:09
  SPEAKER_00: Um so far we've been very happy with the traction and the feedback that we've heard from customers.
• 12:14
  SPEAKER_00: Um our goal is to really step on the gas as far as the product development is concerned.
• 12:21
  SPEAKER_00: We've uh you know obviously covered a major portion of the stack at many of our customers, but uh you know, that we we we can always keep on building more and more integrations with the rest of the stack.
• 12:33
  SPEAKER_00: For example, uh if if a customer is is using some database that we do not currently support access to, maybe we want to build access to that.
• 12:42
  SPEAKER_00: Or if there is some cloud service uh that they don't that they use internally and we don't support access to it, that's also something we want to provide.
• 12:50
  SPEAKER_00: So I'd say the vast majority of our time this year is going to go towards improving and uh improving our product and making it ready for customers of all shapes and sizes.
• 13:01
  SPEAKER_00: And simultaneously, we'll also be investing in some go-to-market talent uh so that we can start uh you know selling and and and we can start reaching more customers than the ones that we've been talking to so far.
• 13:14
  SPEAKER_01: Is this an enterprise sales first uh go-to-market strategy, or is there some other way that you think you'll have to do this?
• 13:22
  SPEAKER_00: No, it's an it's it's very much an enterprise sales first strategy.
• 13:25
  SPEAKER_00: Um at some point, we'll be exploring other ideas as well around how to reach platform teams directly.
• 13:34
  SPEAKER_00: But uh, you know, again, that's more for the the the medium to long-term future.
• 13:38
  SPEAKER_00: I'd say in the the the near term, we are very much a security team focused uh sales strategy.
• 13:44
  SPEAKER_01: And then if you look to RSA in two weeks' time, except for celebrating the win of the innovation sandbox, what else do you have going on that week that you want to tell people about?
• 13:55
  SPEAKER_00: We'll be at booth 1960-1960.
• 13:58
  SPEAKER_00: So, any of uh you all who are uh attending RSA, if you want to see a demo of the product firsthand, if you want to play around with the product firsthand, I personally never am I am a strong disbeliever of canned demos.
• 14:10
  SPEAKER_00: I always believe in giving people access to the product, letting them play with it themselves, and watching their face when they see the aha moment.
• 14:17
  SPEAKER_00: Uh, if you want to do that, please by all means come over to Booth 1960.
• 14:21
  SPEAKER_00: The vast majority of my time at RSA, I'm expected to I'm expecting to be speaking to customers, prospects, you know, uh understanding what they like, what they do not like about the product, and in general, just you know, brainstorming on where cloud security is heading.
• 14:38
  SPEAKER_01: And is that in the main floor or are you in the early stage expo?
• 14:42
  SPEAKER_01: No, I'll we'll be in the main floor.
• 14:43
  SPEAKER_01: Great.
• 14:44
  SPEAKER_01: All right.
• 14:44
  SPEAKER_00: And any events with your investors at all?
• 14:47
  SPEAKER_00: Those are more in the evenings.
• 14:49
  SPEAKER_00: Uh yes, some in during the day as well.
• 14:52
  SPEAKER_00: But yeah, I mean, for me, we'll never be where we are uh without our our customers' help, right?
• 14:57
  SPEAKER_00: So for me, first and foremost, I want to be there on the front lines speaking to people, understanding uh their challenges, where you know what keeps them up at night, and um really just taking it from there.
• 15:09
  SPEAKER_00: That's great.
• 15:10
  SPEAKER_01: And I'll put your LinkedIn link into the show notes.
• 15:14
  SPEAKER_01: Is that the best way to get hold of you, or do you want to offer a different way?
• 15:17
  SPEAKER_01: No, I think that's the best way.
• 15:18
  SPEAKER_01: Okay, well, touch what I enjoyed our conversation.
• 15:21
  SPEAKER_01: Looking forward to seeing you on stage at the Innovation Sandbox that Monday, and I wish you all the best for that and for the rest of the year.
• 15:27
  SPEAKER_00: Thank you.
• 15:28
  SPEAKER_00: Really appreciate it.