Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Smallstep’s Groundbreaking Device Security: Lessons in Standards, Scale, and Startup Wins

Transcript

Smallstep’s Groundbreaking Device Security: Lessons in Standards, Scale, and Startup Wins · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_00: Welcome to the Cybersecurity Go to Market podcast for a special showcase episode where we're talking to the leaders of the companies selected for the 2025 RSA Conference Innovation Sandbox.
• 0:56
  SPEAKER_00: These are just the 10 companies out of hundreds that the judges have selected as the most innovative startups in cyber today.
• 1:04
  SPEAKER_00: I am your host, Andrew Monahan.
• 1:06
  SPEAKER_00: Today we're talking with Mike Malone, CEO and founder at Smallstep.
• 1:11
  SPEAKER_00: Mike, welcome to the podcast.
• 1:13
  SPEAKER_01: Thanks, Andrew.
• 1:14
  SPEAKER_01: Happy to be here.
• 1:15
  SPEAKER_01: Thanks for inviting me.
• 1:16
  SPEAKER_00: Now I would imagine in the ups and downs of startup life, this is probably one of the ups for you, right?
• 1:21
  SPEAKER_00: It is, yeah, you could say that.
• 1:23
  SPEAKER_00: Kicks off a hectic, uh, hectic period, though.
• 1:26
  SPEAKER_01: We are very busy.
• 1:28
  SPEAKER_01: Uh champagne problems.
• 1:29
  SPEAKER_01: Champagne problems can still be problems, though.
• 1:32
  SPEAKER_01: Yeah.
• 1:32
  SPEAKER_01: Yeah, yeah, exactly.
• 1:33
  SPEAKER_00: Well, let's start with you.
• 1:35
  SPEAKER_00: Where in the world did you have your first sandbox, Mike?
• 1:38
  SPEAKER_01: My first sandbox, uh, I grew up in Annapolis, Maryland.
• 1:42
  SPEAKER_01: So my first sandbox was there.
• 1:45
  SPEAKER_01: Uh my dad was an engineer.
• 1:47
  SPEAKER_01: Uh, so it was over-engineered.
• 1:49
  SPEAKER_01: It was a massive structure in my backyard that was like eight feet by eight feet, and I think it took two dump trucks to fulfill.
• 1:55
  SPEAKER_01: It's a pretty good sandbox.
• 1:56
  SPEAKER_00: Aaron Powell, and when did you move out to the Bay Area?
• 1:59
  SPEAKER_01: Uh I don't want to date myself right out of college, let's say.
• 2:04
  SPEAKER_00: Okay.
• 2:04
  SPEAKER_00: So 2015 then.
• 2:06
  SPEAKER_00: Let's call it that.
• 2:07
  SPEAKER_01: Yeah, right.
• 2:07
  SPEAKER_01: Yeah.
• 2:07
  SPEAKER_01: Last year.
• 2:08
  SPEAKER_01: Last year.
• 2:09
  SPEAKER_00: All right.
• 2:10
  SPEAKER_00: Well, let's talk about small step.
• 2:12
  SPEAKER_00: Um now I noticed on your profile, you know, small steps a startup, but you've been working on it for a while, it seems.
• 2:18
  SPEAKER_00: So I'm kind of interested to know where you're at, what the problem is you're solving, and and who cares most about this problem.
• 2:25
  SPEAKER_01: Yeah, totally.
• 2:26
  SPEAKER_01: Um, so what the problem we who we are, what we do, we are a device identity platform.
• 2:32
  SPEAKER_01: Uh so we tie access to trusted company-owned hardware.
• 2:37
  SPEAKER_01: And uh by doing that, we we're securing um sensitive resources like SaaS apps, uh, SSH, Git, cloud APIs, Wi-Fi, uh things like that.
• 2:47
  SPEAKER_01: We have been at it for a while.
• 2:49
  SPEAKER_01: And uh there's some core technology we've been developing for a long time uh under the hood there.
• 2:54
  SPEAKER_00: Aaron Ross Powell So it is a case of uh had to develop and mature over time, or have you pivoted a little bit with the positioning of the technology?
• 3:01
  SPEAKER_01: Aaron Powell Yeah.
• 3:02
  SPEAKER_01: Uh a little bit of both.
• 3:04
  SPEAKER_01: So uh the technology has been developed and um we are applying it to an area that we've been seeing um particular commercial interest.
• 3:13
  SPEAKER_00: Aaron Powell And why is it important to attach the identity to an actual device?
• 3:18
  SPEAKER_00: What does that give a security team?
• 3:20
  SPEAKER_01: Aaron Ross Powell Well, it's uh you know, we run into this occasionally.
• 3:24
  SPEAKER_01: Um it's important for a lot of reasons.
• 3:26
  SPEAKER_01: And um, you know, sometimes people uh sort of will will argue that point.
• 3:30
  SPEAKER_01: And my reaction to that is, well, like do you have EDR, do you have antivirus, do you have posture, do you have device management?
• 3:36
  SPEAKER_01: Well, if you have all of those things, then clearly you care what devices are accessing your systems, your resources.
• 3:42
  SPEAKER_01: Otherwise, why would you bother?
• 3:43
  SPEAKER_01: Um, because if you know an engineer working remotely from home can pivot at their desk and push code to a Git repo from their Plex Media Center, that completely undermines all of that security investment.
• 3:57
  SPEAKER_01: So I would say um it is it's important.
• 4:00
  SPEAKER_01: It has always been important.
• 4:01
  SPEAKER_01: Um and um it's more what's changed.
• 4:04
  SPEAKER_01: And what's changed is that is you know, not to sound like every other cybersecurity company on the planet, but zero trust, remote work.
• 4:13
  SPEAKER_01: You know, the the paradigm has changed.
• 4:16
  SPEAKER_01: And um with that, our approach to how we ensure that only um trustworthy devices are able to access systems uh has had to change as well.
• 4:28
  SPEAKER_00: Aaron Ross Powell Are companies attaching identities to devices already are just doing it better, or is this the first time you're actually able to pull this off at scale?
• 4:36
  SPEAKER_00: And that's why it's exciting.
• 4:37
  SPEAKER_01: Aaron Powell As with a lot of things in cybersecurity, it's a little bit of both.
• 4:41
  SPEAKER_01: It depends on maturity.
• 4:42
  SPEAKER_01: Um I would say that companies typically don't really bother about device identity until they've say got user identity sorted out, which is, by the way, um a much better addressed problem space.
• 4:58
  SPEAKER_01: You know, we all have Okta and entry ID, and you know, our customers typically have that before they talk to us.
• 5:04
  SPEAKER_01: But any company that uh is doing anything, you know, has any any semblance of a security program cares to some extent, uh that only their devices are able to access uh systems.
• 5:19
  SPEAKER_01: And the approach to that is a mess, frankly.
• 5:23
  SPEAKER_01: Um it's hodgepodge.
• 5:25
  SPEAKER_01: So uh our core tech is certificate-based, and that's really the only feasible approach.
• 5:31
  SPEAKER_01: So all approaches you see out there are going to be certificate-based.
• 5:34
  SPEAKER_01: But uh, what we find are small teams that are resource-constrained, that are doing their best to sort of shoestring and bubblegum things together, and then leaving a lot of gaps and uh you know, gaps that they know about, um, and also um having to make hard choices around what platforms are able to support, not support, what browsers they can support, stuff like that because of limitations, uh technical and resource limitations um around this problem.
• 6:04
  SPEAKER_00: Aaron Powell Now keeping in mind, Mike, that your audience on this podcast is a good market audience and not necessarily a pure tech audience.
• 6:11
  SPEAKER_00: Sure.
• 6:11
  SPEAKER_00: What's the big innovation that small steps bringing that the judges might have latched onto?
• 6:16
  SPEAKER_01: Yeah, so um our core technology is a new standard that we created with Google called Acme Device Attestation.
• 6:25
  SPEAKER_01: And it replaces a legacy protocol called SCEP, S-C-E-P.
• 6:31
  SPEAKER_01: Um, SCEP is bad.
• 6:33
  SPEAKER_01: It's old, it's a product of its time, but um, in what way is it bad?
• 6:37
  SPEAKER_01: So there are many reasons.
• 6:39
  SPEAKER_01: It like, you know, it predates TLS, so it rolls its own crypto, for example.
• 6:43
  SPEAKER_01: Um but fundamentally it's bad because it's a password protocol.
• 6:47
  SPEAKER_01: And we all know why passwords are bad.
• 6:48
  SPEAKER_01: It's you know, I could get into the nitty-gritty, but it won't.
• 6:51
  SPEAKER_01: It's weak security.
• 6:53
  SPEAKER_01: So fundamentally, your device identity story, insofar as you have one, reduces down to, hey, I have passwords that are being chucked around, shunted around the network, which is not a good story.
• 7:05
  SPEAKER_01: So Acme device attestation fixes this by uh authenticating devices using a private key that is generated in at manufacture time in the TPM or secure enclave.
• 7:16
  SPEAKER_01: Uh and so to sort of up-level that, it's it's hardware bound.
• 7:20
  SPEAKER_01: It is in silicon on the device, and you can't get it out without destructively disassembling that device in a lab.
• 7:28
  SPEAKER_01: Uh and even then, it's hard.
• 7:30
  SPEAKER_01: So it gives what security professionals would call non-exfiltrable credentials.
• 7:36
  SPEAKER_01: So you cannot remove them, you cannot separate the credential from the device.
• 7:39
  SPEAKER_01: So you are truly uh getting the strongest possible guarantee that uh a particular trusted device is accessing a system.
• 7:49
  SPEAKER_00: And then you're able to centrally, I guess, for a company, view all that and give and deny access privileges based on that.
• 7:57
  SPEAKER_00: Is that correct?
• 7:57
  SPEAKER_01: That's right.
• 7:58
  SPEAKER_01: A lot of what we do is on sort of both sides of the credential management.
• 8:02
  SPEAKER_01: So before you can issue credentials, you have to inventory all your devices.
• 8:05
  SPEAKER_01: And you know, it turns out that can be difficult and manage that inventory over time.
• 8:09
  SPEAKER_01: So we have like supply chain integrations.
• 8:11
  SPEAKER_01: So we work with uh Apple, Intel, Lenovo.
• 8:14
  SPEAKER_01: So one of our when one of our customers buys a new laptop, we automatically get the inventory metadata so that when that laptop is unboxed, you could drop ship that the laptop to a remote employee, let's say.
• 8:25
  SPEAKER_01: And when they unbox it, it will automatically identify and enroll itself.
• 8:29
  SPEAKER_01: Um and then you know, once the device has credentials, we all we also automate configuration and enforcement.
• 8:37
  SPEAKER_01: Um so we have enforcement points like hosted radius for Wi-Fi, uh, ZTNA relays.
• 8:42
  SPEAKER_01: We also integrate with enforcement points that our customers already have: Zscaler, Cloudflare Warp, Cisco Ice, Aruba ClearPass, et cetera, et cetera.
• 8:49
  SPEAKER_01: And uh we handle privilege access use cases that are tricky, you know, things like SSH and Git.
• 8:56
  SPEAKER_01: And so there's a lot, a lot that we do aside from simply uh managing the credentials.
• 9:02
  SPEAKER_00: Aaron Powell When I hear someone say we we created a new standard, I mean I uh my immediate thought is that's a lot of work, I would imagine.
• 9:10
  SPEAKER_00: Yeah.
• 9:11
  SPEAKER_00: Yeah, what are your learnings for other founders?
• 9:14
  SPEAKER_00: Would you do it again like that?
• 9:15
  SPEAKER_00: Or you say, yeah, that's the way to do it.
• 9:17
  SPEAKER_00: It's just a lot of hard work.
• 9:18
  unknown: Yeah.
• 9:18
  SPEAKER_01: Well, and I don't want to take full credit for that.
• 9:20
  SPEAKER_01: To be frank, a guy at Google, um Brandon Weeks, uh, did a lot of the standards work uh uh with with us.
• 9:29
  SPEAKER_01: And um yeah, standards are a lot of work.
• 9:31
  SPEAKER_01: I've done a lot of standards work in my career.
• 9:33
  SPEAKER_01: I worked on OAuth and OpenID and uh Sigstore and Spiffy and OEMbed and probably a number of others that I'm forgetting.
• 9:43
  SPEAKER_01: Um it can definitely be a lot of work.
• 9:45
  SPEAKER_01: I I don't know.
• 9:45
  SPEAKER_01: I guess my recommendation if you're doing standards work is um keep it tight and rough consensus and running code, if you've ever heard that idiom.
• 9:55
  SPEAKER_00: Aaron Powell Rough consensus and running code?
• 9:57
  SPEAKER_00: Right.
• 9:58
  SPEAKER_00: Tell me more about that.
• 9:59
  SPEAKER_01: Uh in other words, um don't bother trying to get everybody perfectly aligned uh before you start shipping things.
• 10:07
  SPEAKER_01: Rough consensus and then ship something that runs and works.
• 10:11
  SPEAKER_01: And um, you know, that's going to do a lot more for you than standards can be very bureaucratic.
• 10:17
  SPEAKER_00: Aaron Powell Right.
• 10:18
  SPEAKER_00: Right.
• 10:19
  SPEAKER_00: All sorts of weird people have to have their say or feel like they have to have their say, right?
• 10:22
  SPEAKER_01: Yeah.
• 10:23
  SPEAKER_01: In in this case, um you know uh Apple adopted the standard.
• 10:28
  SPEAKER_01: And once that happens, nothing else really matters.
• 10:32
  SPEAKER_00: Take us back to the time at Small Step when you got your first real order, right?
• 10:37
  SPEAKER_00: You've been developing and getting the consensus, and suddenly some company that wasn't that friendly said, you know what, we're gonna use some real hard cash for this stuff.
• 10:46
  SPEAKER_00: Uh what was that moan and and uh what was it like?
• 10:49
  SPEAKER_01: Um exciting.
• 10:51
  SPEAKER_01: But I will say, you know, it's funny because I feel like in startups, things happen incrementally.
• 10:59
  SPEAKER_01: And sometimes I find it hard to know when to celebrate, you know?
• 11:02
  SPEAKER_01: Um so I'd say, you know, you get the verbal commit and and then you're like, okay, but like is it then you have to go through legal and then you finalize the legal negotiations and then you sign, and then like when do you celebrate?
• 11:13
  SPEAKER_01: And then that, you know, you haven't been paid yet, you know, it's net 90 terms.
• 11:17
  SPEAKER_01: And um, so I'd say like what one of the things I think that I work on is just trying to remember to celebrate the wins because sometimes by the time it's all done, it feels like old news.
• 11:26
  SPEAKER_01: Um, but you know, those wins I think come with a mixture of excitement and obligation, right?
• 11:34
  SPEAKER_01: Because typically what that means is you just made a promise to somebody uh and asked for a lot of money, and now you got to deliver.
• 11:43
  SPEAKER_01: So it's uh it's part of the game.
• 11:46
  SPEAKER_01: I think you have to love that in order to do this sort of work, but uh it's definitely a roller coaster emotionally.
• 11:53
  SPEAKER_01: Aaron Powell Yeah.
• 11:53
  SPEAKER_00: I mean, it is the start of hopefully a long relationship, not the end of a of a process to buy something, right?
• 11:59
  SPEAKER_01: Aaron Powell If you're doing it right, if you're doing it right, that's for sure.
• 12:01
  SPEAKER_01: Yeah.
• 12:02
  unknown: Yeah.
• 12:02
  SPEAKER_00: Yeah.
• 12:03
  SPEAKER_00: It's uh yeah, I would imagine, you know, early stage, you're you're you're building out the product, you know where some edges are, you know where where you're strong and weak, and you're thinking, okay, now we have to actually start delivering on this stuff and uh probably at scale as well.
• 12:15
  SPEAKER_00: It's uh a whole different ballgame.
• 12:17
  SPEAKER_01: Aaron Powell Yeah.
• 12:18
  SPEAKER_01: Yeah.
• 12:18
  SPEAKER_01: Our customers are big, big mostly big companies.
• 12:21
  SPEAKER_01: It's an in this uh you know, since your audiences go to market, our go-to-market is interesting because it's uh this technology is really proliferating from large enterprises down, which is very unusual.
• 12:34
  SPEAKER_00: Aaron Ross Powell No, by that do you mean through OEMs or you're selling direct to the big Fortune whatever 500s and their We're selling direct to the big Fortune 500s.
• 12:44
  SPEAKER_00: Okay.
• 12:44
  SPEAKER_00: Yeah.
• 12:45
  SPEAKER_00: Which presents its own challenge, right?
• 12:46
  SPEAKER_00: It's only so many of them will be willing and able to work with an early stage company and especially with the impact that you can have as well.
• 12:53
  SPEAKER_01: Right.
• 12:53
  SPEAKER_01: And you know, just working with their legal team, even if they really want to buy it, can take a year.
• 12:58
  SPEAKER_00: Aaron Powell Yeah.
• 12:59
  SPEAKER_00: So slight change of pace.
• 13:01
  SPEAKER_00: Uh clearly you're very technical.
• 13:03
  SPEAKER_00: This is your DNA as a as an engineer and in in general, but also in cyber.
• 13:08
  SPEAKER_00: I also saw, though, that you you like your literature as well.
• 13:13
  SPEAKER_00: Uh I I read somewhere that you liked On the Road and Fear and Lothing in Las Vegas and books like that.
• 13:18
  SPEAKER_00: If Small Step was a character in one of your favorite books, which character would it be?
• 13:25
  SPEAKER_01: You know, that's I hate questions like this.
• 13:28
  SPEAKER_01: I don't get stressed out about you can ask me the most technical, like, you know, on the spot question in the world, but if you ask me two truths and a lie, I clam up.
• 13:37
  SPEAKER_01: I'd say, you know, I I like both both of those books um for a particular reason.
• 13:44
  SPEAKER_01: And I think that reason is really one of our core values at small steps.
• 13:49
  SPEAKER_01: So you could pick, say, you know, Hunter Thompson or, you know, Ken Keesy, whatever.
• 13:54
  SPEAKER_01: And that's authenticity.
• 13:56
  SPEAKER_01: I think, you know, like 'em or hate them, those people were true to themselves and uh at least tried to be honest even when it maybe wasn't the best idea for them, let's say.
• 14:11
  SPEAKER_01: You know, like like Hunter Thompson in his gonzo journalism movement, the whole idea, he would say, uh, was to you know he used to say a lot of journalism um lies with the truth and he tells the truth with lies.
• 14:29
  SPEAKER_01: So I like that.
• 14:30
  SPEAKER_01: That's I think what I like about them is the authenticity.
• 14:33
  SPEAKER_01: Like you really uh f feel like you're you're truly understanding another person.
• 14:39
  SPEAKER_00: Aaron Ross Powell I would imagine as you as you get success and you grow, you know, if that's one of your uh values inside the company, it's gonna be interesting how you hang on to that because you're gonna have to bring in more and more people who are perhaps less attached to your your mission as you are, right?
• 14:54
  SPEAKER_01: Aaron Powell Yeah, I think that every company faces that as they scale.
• 14:58
  SPEAKER_01: Um we have a pretty good foundation.
• 15:01
  SPEAKER_01: It's part of the hiring process, right?
• 15:03
  SPEAKER_01: And just part of the energy.
• 15:04
  SPEAKER_01: Yeah.
• 15:05
  SPEAKER_01: I I don't know that I have like a super insightful response to that, aside from uh absolutely, yeah.
• 15:11
  SPEAKER_00: It's an interesting process as you're scaling.
• 15:13
  SPEAKER_00: One more thing to think about, right?
• 15:14
  SPEAKER_00: That you have the right people on board.
• 15:16
  SPEAKER_00: Well, Mike, listen, I enjoyed having you on.
• 15:18
  SPEAKER_00: Uh, wish you a lot of success and luck for next Monday.
• 15:22
  SPEAKER_00: We're recording this the Tuesday before the conference, and uh hope the whole day and week goes well for you.
• 15:27
  SPEAKER_01: Thanks so much.
• 15:28
  SPEAKER_01: Uh really honored to be selected as a finalist, and um, thanks again for having me on your show.