Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / RSAC Innovation Sandbox Finalist: VulnCheck with Jay Wallace, VP of Global Sales

Transcript

RSAC Innovation Sandbox Finalist: VulnCheck with Jay Wallace, VP of Global Sales · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_01: Welcome to the Cybersecurity Go to Market podcast for a special showcase episode where we are talking to leaders of the companies selected for the 2024 RSA Conference Innovation Sandbox.
• 0:54
  SPEAKER_01: And these are just 10 companies that the judges have selected from many, many hundreds of entries as the most innovative startups in cybersecurity today.
• 1:04
  SPEAKER_01: I am your host, Andrew Monahan, and today we're talking with Jay Wallace, the VP of Global Sales at Voluncheck.
• 1:10
  SPEAKER_01: Jay, welcome to the podcast.
• 1:12
  SPEAKER_00: Thanks for having me, Andrew.
• 1:13
  SPEAKER_01: And Jay, I say welcome to the podcast.
• 1:15
  SPEAKER_01: This is the second time, I believe, and I maybe someone will correct me if I'm wrong, but I think you might be the first time we've had a return guest on.
• 1:23
  SPEAKER_01: So welcome back to the podcast.
• 1:25
  SPEAKER_00: Well, I'm certainly honored.
• 1:26
  SPEAKER_00: I really appreciate you having me back.
• 1:27
  SPEAKER_01: Well, the crowd and the audience were clamoring for more Jay Wallace.
• 1:31
  SPEAKER_01: So here we go.
• 1:32
  SPEAKER_01: The Innovation Sandbox has been the impetus for us to get uh get you back on and have another chat.
• 1:37
  SPEAKER_01: So this is a special showcase episode.
• 1:39
  SPEAKER_01: So we're gonna run through these questions and we're looking for the best and most interesting answers to the questions that we have.
• 1:45
  SPEAKER_01: So here's the first one for you, Jay.
• 1:47
  SPEAKER_01: Where in the world did you have your first sandbox as a kid?
• 1:52
  SPEAKER_00: Um I would say it was at the uh the the dreaded daycare was my first sandbox.
• 1:57
  SPEAKER_00: Um as a child of the 80s, uh that meant like the little turtle sandbox that uh you shared with other kids.
• 2:05
  SPEAKER_00: In retrospect, probably a very disgusting place to play, but of course, as a kid who cares that you're just having fun, and uh I just was trying to avoid the the gross snacks that they served at daycare.
• 2:15
  SPEAKER_00: So the sandbox was the right place to be.
• 2:17
  SPEAKER_00: And where in the world was this daycare?
• 2:19
  SPEAKER_00: Uh this was in a small town called Haiko, Texas.
• 2:23
  SPEAKER_00: There is uh not many people that know where Heiko is, but I like to call it the Bermuda Triangle of Texas.
• 2:28
  SPEAKER_00: Uh, if you were to draw a triangle from Abilene to Dallas to Austin, it's just square in the middle.
• 2:33
  SPEAKER_00: Um I had a group by graduating classes, 43 people, three exchange students, and I always wondered to myself, how in the world did you travel across the world as an exchange student and land in Heiko, Texas?
• 2:44
  SPEAKER_00: Still not sure the answer to that, but it was certainly entertaining.
• 2:47
  SPEAKER_01: It's funny the places people end up sometimes, right?
• 2:50
  SPEAKER_01: All right.
• 2:50
  SPEAKER_01: So what is the story of the founding of Volncheck?
• 2:54
  SPEAKER_00: Yeah, so um Anthony Bettini is uh the founder of Voluncheck, and uh I was introduced to him uh by way of a VC that we shared with my former company and this company.
• 3:05
  SPEAKER_00: Uh he's a third-time founder all the way back to Foundstone, uh head secure headed security research at Foundstone, uh, went through the McAfee acquisition, stayed on with uh security research, leading that team for about 10 years until he went to start his own company.
• 3:20
  SPEAKER_00: Uh the first company was called App Authority.
• 3:23
  SPEAKER_00: It was a mobile application security company in the early days of mobile application security, sold that company to Symantec, uh, decided to found another company after that called FlawCheck.
• 3:34
  SPEAKER_00: Um, but it was a uh container security company that was sold to Tenable.
• 3:39
  SPEAKER_00: And he stayed on with Tenable for about three years and uh decided he wanted to go found his own thing again, but wasn't quite sure which.
• 3:47
  SPEAKER_00: So he took a bridge job as the CTO at White Hat Security, um running all things research and uh and technical related.
• 3:56
  SPEAKER_00: And once he had enough shape of Volncheck, he went on to found Volncheck.
• 4:01
  SPEAKER_00: And it's still a very young company, but a really exciting space in the vulnerability management space, obviously not without its challenges and issues, but it's a great place to be.
• 4:10
  SPEAKER_00: Uh he's got a huge history and you know, exploitation and weaponization of exploits and vulnerability management.
• 4:15
  SPEAKER_00: So he's bringing all that to the table with Volnchek.
• 4:19
  SPEAKER_00: Uh, has also hired a stellar team, both on the executive side and individual contributor level.
• 4:23
  SPEAKER_00: So really fortunate to be working here with such good talent.
• 4:26
  SPEAKER_01: And Anthony is a sole founder, which I guess if you get all the experience that he has of doing it before is, you know, I don't know if okay is the right word, but you know, normal.
• 4:36
  SPEAKER_01: Um not for people that are doing it for the first time, though.
• 4:39
  SPEAKER_01: They probably have the benefit of wanting to have a founding team.
• 4:41
  SPEAKER_00: Yeah, absolutely.
• 4:42
  SPEAKER_00: I think uh experience shows he's made a lot of really good decisions, even the way that he's structured the team, the talent that he's brought on early.
• 4:49
  SPEAKER_00: We like to consider ourselves very small but mighty.
• 4:52
  SPEAKER_00: So uh even though today we're a team of 21, we still have a ton of output.
• 4:56
  SPEAKER_00: Uh, we're outpacing some of the competitors we have in the space by a lot of key metrics, not just in growth metrics and ARR, but in actual product velocity.
• 5:06
  SPEAKER_00: So I think I would say uh a little bit strange for me.
• 5:10
  SPEAKER_00: I've pretty much always worked where there was a group of co-founders, but uh it certainly seems to be working out.
• 5:15
  SPEAKER_01: So what's the problem that VoneCheck solves and for whom?
• 5:19
  SPEAKER_00: Yeah, uh I think that we are solving a huge problem for uh cybersecurity companies, uh large enterprise that are dealing with a ton of vulnerability that they have to manage every day.
• 5:29
  SPEAKER_00: Uh everybody's trying to solve the vulnerability prioritization problem, uh, and for large government as well.
• 5:35
  SPEAKER_00: And the reason I say we're solving a problem for these folks is the standard today is that everybody tries to solve this problem with people.
• 5:42
  SPEAKER_00: Well, more vones means more people, more CVEs means more people.
• 5:47
  SPEAKER_00: Uh, even most recently, NIST has had their issues because they experienced a budget cut after requesting a budget increase because they were trying to solve the problem with more volunes, more people.
• 5:57
  SPEAKER_00: The problem that we're solving is the people we think is the real issue.
• 6:01
  SPEAKER_00: It's too slow to go through multiple channels before you can get to uh patch remediation.
• 6:05
  SPEAKER_00: Even when a vendor does uh come out with an ODA and issues remediation advice immediately, it still takes a long time for that to make its trek across uh MITRE for enrichment, make it into NVD or possibly the Sysakev, and then eventually make it to a vulnerability scanner where they write a plug-in, uh create a signature, and you can start testing against your environment.
• 6:27
  SPEAKER_00: During that time, attackers have a chance to move laterally within your environment.
• 6:31
  SPEAKER_00: Um, there is uh in in certain cases when you have mass exploitation events such as like Cisco iOS XC, Avanti, or Confluence, there's just not enough time to wait for you to get a signature or a plug-in written at one of the Vone management solutions.
• 6:45
  SPEAKER_00: And so this is where uh this is where Vulncheck really lives.
• 6:49
  SPEAKER_00: We provide real-time exploit and vulnerability intelligence.
• 6:52
  SPEAKER_00: Everything we build is meant to be machine to machine.
• 6:54
  SPEAKER_00: So what we're effectively saying is skip the analyst, get it into the tools that the analyst use and move at a much faster pace than your adversaries.
• 7:03
  SPEAKER_01: So what is the transformation then?
• 7:05
  SPEAKER_01: Is it many days and weeks down to you said real time?
• 7:08
  SPEAKER_01: Is that the difference?
• 7:09
  SPEAKER_01: Or what's what do you say to prospects when you're talking to them?
• 7:12
  SPEAKER_00: Yeah, um, I'll give you an example.
• 7:14
  SPEAKER_00: Um this one, I I will, to be fair, is a little bit of an easy example because we could find everything we needed for the detections on the internet.
• 7:20
  SPEAKER_00: But Cisco iOS XE, um, this was a vulnerability that didn't make it through MITRE and onto the NVD for five days.
• 7:27
  SPEAKER_00: And around the same time it landed on an NVD, it landed on the Syskev list.
• 7:31
  SPEAKER_00: Well, that's all fine and good, but again, it it took five days where VolnCheck, we had a version scanner written for this and found 8,000 compromised routers on the internet three hours after the disclosure was made by Cisco.
• 7:42
  SPEAKER_00: And this is because we have such a wide abundance of intelligence that we can look at our own intelligence and sort of predict if something's going to land on a known exploited vulnerabilities list.
• 7:51
  SPEAKER_00: And if that's the case and we understand that it's remotely executable, we make that a priority to build uh detection artifacts for it and deliver that to our customers.
• 7:58
  SPEAKER_01: And who is it inside the enterprise that buys this that cares most about it?
• 8:02
  SPEAKER_00: I would say there's two groups of people that care the most about it.
• 8:04
  SPEAKER_00: It's the vulnerability management team and it's the cyber threat intelligence teams.
• 8:08
  SPEAKER_00: Um sometimes those folks can live in the SOC or they can live independent of the SOC, but we're finding that most of the folks that find value out of this is we give them speed.
• 8:17
  SPEAKER_00: They already have tools.
• 8:18
  SPEAKER_00: It's not a tooling problem, it's a people problem.
• 8:20
  SPEAKER_00: And so they see the value immediately because they've likely been struggling this for some time now.
• 8:24
  SPEAKER_01: Now, when you say people problem, is it because there's a bloat in the number of people in the team required to keep up, or they just can't get the headcount, so therefore they can't even get to some of the work they need to do anyway?
• 8:35
  SPEAKER_00: I think it's a combination of both, quite honestly.
• 8:37
  SPEAKER_00: Whenever we talk to customers, it's uh for example, um, I was talking to a large pharmaceutical company the other day, and their workflow um involved is very analyst heavy.
• 8:49
  SPEAKER_00: Um they're managing what you can imagine is hundreds of thousands of vulnerabilities that they need to remediate between their software and hardware inventory.
• 8:56
  SPEAKER_00: They have a team of three people.
• 8:57
  SPEAKER_00: And so when they're thinking about how do I solve this problem without people, well, I don't have headcount to hire or double or triple my staff.
• 9:05
  SPEAKER_00: Not to mention that the pace of vulnerabilities, new vulnerabilities that are coming out today is much higher than it was just a few years ago.
• 9:11
  SPEAKER_00: I think one of the stats that I saw was back in 2018, it took almost a year for a vulnerability to be exploited in the wild.
• 9:17
  SPEAKER_00: In 2022, it was down to eight days.
• 9:19
  SPEAKER_00: My suspicion would be in 2024, it's even less than that.
• 9:23
  SPEAKER_00: And so we're talking hours, not days, and you're talking less people, less headcount, more tools to manage.
• 9:29
  SPEAKER_00: And that's why I mentioned it's not a tools problem.
• 9:32
  SPEAKER_00: It's it's a people problem.
• 9:33
  SPEAKER_00: I'd say in the most cases, a lot of large enterprises already have the tools that they need in place.
• 9:38
  SPEAKER_00: They simply don't have the bodies or the headcount to address the vulnerabilities that are coming in.
• 9:42
  SPEAKER_01: So, what is the big innovation that uh the judges would have seen in what you're doing to say, yeah, there's a company we need to showcase?
• 9:49
  SPEAKER_00: Yeah, I think there's a few different reasons why.
• 9:51
  SPEAKER_00: Uh I think everything that we deliver being machine consumable really struck a chord.
• 9:56
  SPEAKER_00: You know, and in the age of AI and the age of machine learning, um, there's got to be a way that you can get data to people who run those machines faster.
• 10:05
  SPEAKER_00: And so we monitor uh around 270 million data points for every hour on the hour that's getting refreshed.
• 10:13
  SPEAKER_00: This also includes data such as Chinese exploit data and Russian exploit data, very hard to get data from across the internet.
• 10:21
  SPEAKER_00: We're monitoring everything from uh Git repositories at the fire hose.
• 10:24
  SPEAKER_00: So as soon as something's committed, we pick that up.
• 10:27
  SPEAKER_00: Um but before it ever hits a customer, before a customer ever plugs this into their SIM or their SOAR or their threat intelligence platform, it's completely normalized.
• 10:35
  SPEAKER_00: And we put it in an easy-to-consume JSON image.
• 10:38
  SPEAKER_00: So whether you'd like to take a full offline backup of all of the data that we produce, or you just like to plug in certain indexes that we cover into your systems, you can do that.
• 10:48
  SPEAKER_00: And the people part is the smallest part of the problem that we're solving.
• 10:52
  SPEAKER_00: So I think that's the thing that really stuck out.
• 10:55
  SPEAKER_00: Uh, to my knowledge and what I've seen across the landscape, we're the only company that's taking this approach to vulnerability management to help end users in the vulnerable management program and CTI program get data faster.
• 11:06
  SPEAKER_01: And is a secret sauce, therefore, in the normalization and how you work with the data, or is it how you do it, how you do it as such scale?
• 11:14
  SPEAKER_00: I think it's the scale at which we do it.
• 11:16
  SPEAKER_00: Um, you know, there's a lot of companies out there that'll take data in and normalize it.
• 11:20
  SPEAKER_00: Uh, I was on a call call with uh one of our partners just earlier today, and he said the biggest struggle his customers have is that they've bought all of these different tools.
• 11:29
  SPEAKER_00: They've gone to posture management, they brought in the SIM, the SOAR, the hyperautomation.
• 11:34
  SPEAKER_00: They brought in all of these tools, but all they're doing is correlating bad data.
• 11:38
  SPEAKER_00: So when you look at public sources, many times they don't have uh citations.
• 11:41
  SPEAKER_00: They're not doing things what we're doing, which is like tying things back to miter attack techniques.
• 11:45
  SPEAKER_00: So not only do you know what a CVE is, how it's being exploited, but you also know the techniques that your attackers are using to attack you.
• 11:53
  SPEAKER_00: And then we provide you with all of the detection artifacts to defend against those things.
• 11:57
  SPEAKER_00: So um, we're really providing this fully uh well-rounded approach to we'll give you all of the information at large scale.
• 12:04
  SPEAKER_00: Um there's nobody out there that's that's collecting and updating 270 million unique data points every hour.
• 12:10
  SPEAKER_00: It just doesn't exist.
• 12:11
  SPEAKER_00: So I think it's scale normalization and just making it very simple for users to consume.
• 12:16
  SPEAKER_01: And Jay, what are your big goals for the go-to-market team for 2024?
• 12:20
  SPEAKER_00: Uh I think I'll probably say something that a lot of sales leaders feel and go-to-market leaders feel um we want to grow, but not grow at all costs.
• 12:29
  SPEAKER_00: Uh, we're doing pretty well uh in terms of our revenue goals for the year.
• 12:33
  SPEAKER_00: Um we just finished up a 200% revenue goal quarter.
• 12:37
  SPEAKER_00: Uh, we're looking pretty good to do something very similar, and we're doing it with a 21-person team.
• 12:41
  SPEAKER_00: You know, my idea would be that if I could do this with uh the minimum amount of salespeople, I think everybody's happy.
• 12:47
  SPEAKER_00: Um that means we've got happy customers, salespeople are making money, but we can stay very efficient while we grow.
• 12:53
  SPEAKER_00: That would be the goal.
• 12:54
  SPEAKER_00: Um, and then whatever you go to market leader wants, well, we're on a podcast for a reason.
• 12:59
  SPEAKER_00: I'd love to win the innovation sandbox.
• 13:01
  SPEAKER_00: I think that would be a banner uh banner accomplishment for us and the team.
• 13:05
  SPEAKER_00: Um, some of us have participated in innovation sandbox challenges before, been down selected into the top 10.
• 13:11
  SPEAKER_00: Others have not.
• 13:12
  SPEAKER_00: This is my first time at a company that's been selected and is running in the top 10.
• 13:16
  SPEAKER_00: So really excited about that.
• 13:17
  SPEAKER_00: I think uh that paired with revenue goals for the year, it would I think it was a pretty successful year for us here at Voltscheck.
• 13:24
  SPEAKER_01: And then let's talk about the week of the RSA conference, except for wild over-exuberant uh celebrations for winning the sandbox.
• 13:30
  SPEAKER_01: What else do you have uh planned for that week?
• 13:33
  SPEAKER_00: Well, uh a few things.
• 13:35
  SPEAKER_00: We uh have some new partnerships that we're announcing coming up in the RSA.
• 13:38
  SPEAKER_00: Um we're gonna be doing some co-sponsored happy hours with those folks while we make the announcement.
• 13:43
  SPEAKER_00: Uh, more on that to come with the press release.
• 13:45
  SPEAKER_00: Um, we've also are opening up some new markets.
• 13:48
  SPEAKER_00: We're already doing some business in the UK and Europe.
• 13:51
  SPEAKER_00: Um our next frontier is Australia.
• 13:53
  SPEAKER_00: So we'll be in with some folks that we can help open the market with in Australia while we're out, uh, as well as some of our partners that we have in the UK now.
• 14:00
  SPEAKER_00: Um, as a small team, we want to make sure that we make bets that we know we can win.
• 14:04
  SPEAKER_00: And so we've got some really exciting partnerships that I think we're gonna uh be able to take advantage of that week.
• 14:09
  SPEAKER_00: In addition to that, RSA for me and most of the folks that I know is always feels like a family reunion.
• 14:14
  SPEAKER_00: You're getting back together with people that you haven't seen maybe since the last RSA or since Black Hat.
• 14:19
  SPEAKER_00: You get to catch up with people that have left old companies and join new ones, you get to hear about all the new exciting startups that are uh taking place.
• 14:25
  SPEAKER_00: Maybe it's their first RSA or maybe it's their fifth RSA and they finally caught lightning in a bottle or having a banner year.
• 14:32
  SPEAKER_00: So to me, that's the best part about RSA.
• 14:34
  SPEAKER_00: You get to go see folks that you haven't seen in a while, learn about new innovative technology.
• 14:38
  SPEAKER_00: And this this year it's just the cherry on top that we get to participate in all the fun with RSA Sandbox.
• 14:43
  SPEAKER_01: That's fantastic.
• 14:44
  SPEAKER_01: And Jay, I'll put your LinkedIn uh profile link in the show notes.
• 14:48
  SPEAKER_01: Is that the best way to get a hold of you, or do you want to give out some other way?
• 14:51
  SPEAKER_00: Yeah, uh best way to get a hold of me is probably on LinkedIn.
• 14:54
  SPEAKER_00: Um you can also always reach out to me by uh by email.
• 14:58
  SPEAKER_00: It's Jay, the letter J Wallace at Voluncheck.com.
• 15:02
  SPEAKER_00: Um, I'll stop short of giving out my cell phone number for all you BDRs out there that are listening to this podcast, but you know, reach me through the other channels if you can.
• 15:09
  SPEAKER_01: That's awesome.
• 15:10
  SPEAKER_01: Well, Jay, listen, all the best for RSA.
• 15:13
  SPEAKER_01: Good luck in the final round of selection for the sandbox.
• 15:17
  SPEAKER_01: I wish you, the team, a lot of success for that and for 2024 and beyond.
• 15:20
  SPEAKER_00: Thanks a ton, Andrew.
• 15:21
  SPEAKER_00: Really appreciate it.
• 15:22
  SPEAKER_00: Thanks for having me back on and I hope to see you at the conference.
• 15:24
  SPEAKER_00: Uh we'll do.
• 15:25
  SPEAKER_00: I'll see you there.