Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Questions to answer before you scale a cybersecurity company with Ross Haleliuk, author of Cyber for Builders

Transcript

Questions to answer before you scale a cybersecurity company with Ross Haleliuk, author of Cyber for Builders · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: Starting a company and getting traction in cybersecurity is hard.
• 0:37
  SPEAKER_00: Fundamental decisions like which problem to solve, how do you know when you have product market fit, how do you compete against the big platform companies?
• 0:45
  SPEAKER_00: Luckily, Ross Haliluk literally wrote the book about all of this.
• 0:49
  SPEAKER_00: Cyber for Builders was released in January 2024 and has become a bestseller.
• 0:54
  SPEAKER_00: And Ross joins us today on the podcast to demystify what it takes to get building right.
• 1:00
  SPEAKER_00: Don't go away.
• 1:29
  SPEAKER_00: Ross, welcome to the podcast.
• 1:31
  SPEAKER_01: Thank you so much, Andrew.
• 1:32
  SPEAKER_01: Happy to be here.
• 1:33
  SPEAKER_00: You know, I've been looking forward to our discussion, Ross.
• 1:35
  SPEAKER_00: The book came out recently recently, right?
• 1:37
  SPEAKER_00: Was it uh February, March time?
• 1:39
  SPEAKER_00: Is that about right?
• 1:40
  SPEAKER_00: Mid-January.
• 1:41
  SPEAKER_00: Mid-January, okay.
• 1:42
  SPEAKER_01: Mid-January.
• 1:43
  SPEAKER_00: Uh I got I was behind on getting my copy, but uh Cyber for Builders, the essential guide to building a cybersecurity startup.
• 1:51
  SPEAKER_00: So a lot of good stuff in here.
• 1:53
  SPEAKER_00: And what's interesting about it, Ross, uh, is it's not just you, you've actually collaborated with a whole bunch of cybersecurity entrepreneurs and operators and all the rest of it to bring out a pretty compelling little book here.
• 2:04
  SPEAKER_01: Yeah, it's been it's been a very, very exciting journey of getting together the book and also reaching out to over 50 cybersecurity startup founders, investors, like industry analysts and participants of the of the industry, otherwise to get their perspectives.
• 2:19
  SPEAKER_01: You know, I didn't want it to be just you know a monologue of one guy who builds products in the industry.
• 2:25
  SPEAKER_01: I wanted it to be a fairly like diverse collection of different perspectives and different ideas.
• 2:31
  SPEAKER_00: Well, when we look at the book, Ross, uh, I looked through some of the chapters.
• 2:36
  SPEAKER_00: I would say, actually, before we get into it, if you're listening to this episode and you're wondering if this book is for you, if you're in the mode of building a company, it's for you.
• 2:45
  SPEAKER_00: Also, if you're in the go-to-market side, though, there's a great uh whole chapter in here that Ross has done explaining the ecosystem of the cybersecurity industry, explaining what different players do, the pros and cons of what they do and where they fit into everything that's going on.
• 2:59
  SPEAKER_00: I think it's probably the best summary.
• 3:02
  SPEAKER_00: If you don't know what a GSI is, for example, and how that differs to a local reseller versus how it might relate to an angel investor versus a VC versus a PE.
• 3:12
  SPEAKER_00: You want to make sense of all those things I've just said, I would go read that whole chapter in Ross's book because he lays it out very clearly about what all these different entities do and what they care about.
• 3:21
  SPEAKER_00: So, yeah, if you're in that mode, definitely go read it for that reason.
• 3:24
  SPEAKER_00: But I there was a couple of sections in here that caught my eye.
• 3:26
  SPEAKER_00: One was called Validating the Problem at the start, towards the start of the book.
• 3:31
  SPEAKER_00: And then towards the end, you got a section called A Practical Guide to Failing a Startup.
• 3:35
  SPEAKER_00: And you've got a subchattern there called that says scaling before the company achieves product market fit.
• 3:41
  SPEAKER_00: This seems to be endemic for us, right?
• 3:43
  SPEAKER_00: If I was to I very unfairly and unscientifically say of the 3,700 vendors in cybersecurity, there's a whole load in that half million to five, six million ARR range that aren't growing that fast, primarily because they don't have a strong product market fit.
• 3:59
  SPEAKER_00: Um why do very, very smart people uh kid themselves that they've got product market fit and start throwing salespeople and marketing people at a product or a company that isn't quite ready for it?
• 4:11
  SPEAKER_01: That is a good question.
• 4:12
  SPEAKER_01: You see, I I don't think I have a very insightful answer, but I definitely have an opinion on this topic.
• 4:17
  SPEAKER_01: And and uh I think the number one thing that comes to mind is that there is no such, like it's very hard to see once you have achieved the product market fit, right?
• 4:25
  SPEAKER_01: There isn't there isn't a specific revenue threshold that enables you to say that.
• 4:29
  SPEAKER_01: There isn't a specific kind of feedback that you start receiving about the product.
• 4:35
  SPEAKER_01: There is no there is no uh milestone when it comes to the uh number of active users in the product that you can just hit and say, okay, I am, you know, I I I have achieved the PMF, everything is going well, it's time for us to start scaling.
• 4:50
  SPEAKER_01: It's it's a very abstract term.
• 4:53
  SPEAKER_01: And it's much easier to see when you do not yet have a product market fit than it is to see one once you have achieved it.
• 5:02
  SPEAKER_01: And you know, the textbook definition of PMF is that, well, you know, the the signs are you know, the signs are very clear the moment your product starts selling, you know, like like a hot you know, hot cake, and everything is is is fantastic, and and customers are reaching out and prospects are reaching out and starting to ask you know for your products, starting to say, hey, just take my money, give me what it is that you've built.
• 5:24
  SPEAKER_01: Like that's where you have where you would have achieved the product market fit, and it's time for you to start scaling.
• 5:29
  SPEAKER_01: But realistically speaking, with security products, it rarely, if ever, happens, right?
• 5:34
  SPEAKER_01: There are some examples of solutions where uh the the market was educated so well that it did indeed start to pull security solutions.
• 5:44
  SPEAKER_01: And you know, there is there is an example of an MFA, which has taken us you know over a decade to get to the point where the broader market understands the value of it and and starts to implement it.
• 5:55
  SPEAKER_01: There are some of the other examples, but for the most part, cybersecurity startups always have to educate prospects and educate customers, like why it is that they need to care about you know about the specific attack vector that they're solving for or the specific problem that they're solving.
• 6:13
  SPEAKER_01: And for that reason, it it's frankly very hard to like very hard to say once the startup has achieved the product market fit.
• 6:19
  SPEAKER_01: Is it you know, we've we've been able to sell the product to 25 uh you know SMBs.
• 6:25
  SPEAKER_01: Is that enough for us to go and hire you know 25 uh salespeople and just say go?
• 6:32
  SPEAKER_01: I don't know.
• 6:33
  SPEAKER_01: It depends.
• 6:33
  SPEAKER_01: And so it's the absence of a very scientific formula that makes it makes it very hard.
• 6:38
  SPEAKER_01: And frankly, timing is also tricky, right?
• 6:41
  SPEAKER_01: Because if you scale prematurely, you can you can lose the momentum and you can essentially just set your resources on fire, like burn the money by by hiring, by overhiring salespeople, by letting them, you know, by by unleashing them to start selling something that the market is not yet ready to buy, or maybe that that doesn't fully solve the problem.
• 7:02
  SPEAKER_01: But if you wait too long and you don't hire fast enough, you will you the problem you end up in is is is very different.
• 7:10
  SPEAKER_01: It is the problem where your competitors are able to seize the moment while you're trying to ramp up your sales function.
• 7:17
  SPEAKER_01: So there is this, like there is this like sweet spot for for hiring once you are seeing strong enough signs of the product market fit, but before it became evident to the to the rest of the industry that this is indeed a problem with high potential, then you need to start hiring.
• 7:35
  SPEAKER_01: And it's very hard to it, like that spot is very, very hard to find.
• 7:38
  SPEAKER_01: So I think that's like if I were to you know to summarize this, like that's the number one reason why.
• 7:44
  SPEAKER_01: There is the second reason to too, and I think that second reason is much easier to explain and it's much more yeah, it's it's probably even an even harder one to tackle.
• 7:54
  SPEAKER_01: And it has to do with the fact that the vast majority of cybersecurity startup founders are very smart technical people who have a great idea about how certain technological innovations can change the you know the game and can enable uh cybersecurity defense defense teams uh to like to do their work and to uh you know outsmart the adversaries.
• 8:16
  SPEAKER_01: But what they're often not is they're not salespeople, they're not marketers, they're not product people.
• 8:22
  SPEAKER_01: So they have that technical understanding, and they end up building a very good, very robust technological solution that the market may or may not be ready for, the market may or may not understand, and in their mind, it's often that all we need to do is to just now that we've built the product, let's hire salespeople and let's start selling.
• 8:43
  SPEAKER_01: But that's like you, you and I both know that that is not how the life works, right?
• 8:48
  SPEAKER_01: If you didn't initially start from the the customer discovery, if you didn't understand the problem in depth, if you didn't understand the customer's willingness to pay, if you didn't understand, if this is even, you know, if this problem is in the top 10 or top five problems that the security team cares about, you're probably not not going to build the product that will that you can just go ahead and start selling.
• 9:11
  SPEAKER_01: And this is where what I often see in the industry, salespeople and marketers are put in the position in which they have no chances of winning, right?
• 9:20
  SPEAKER_01: You have a you have very smart technical founders who build great solutions to problems that may or may not exist, and they see that they're struggling to sell those solutions.
• 9:29
  SPEAKER_01: So they go ahead and they hire a marketer, they hire a salesperson and say, okay, go start selling.
• 9:35
  SPEAKER_01: Like we want to see demand.
• 9:37
  SPEAKER_01: But neither of those people can can artificially manufacture that demand.
• 9:40
  SPEAKER_01: And so then the founders become upset that their sales and marketing are not performing well, and there is this, you know, there is this disconnect between the reality of the market and what the founder or the set of founders and salespeople and marketers are trying to do.
• 9:53
  SPEAKER_01: So that to me is the second reason is this the fact that many products are started as solutions first or solution driven, and then they're trying to find the problem and they're trying to, you know, to just get somebody to buy it.
• 10:06
  SPEAKER_00: And I feel like in cyber and maybe in tech in general, right, everyone has a ton of problems, right?
• 10:11
  SPEAKER_00: You talk to a CISO, you talk to a VP of Security Ops.
• 10:14
  SPEAKER_00: There's things that aren't working great.
• 10:16
  SPEAKER_00: It's whether, as you said, it's the top five things they're they're really concerned about.
• 10:20
  SPEAKER_00: Maybe that's where sometimes founders can get happy ears a little bit, say, well, they've got this problem, therefore, you know, we should go solve it, as opposed to digging even deeper into, well, how big a problem is this?
• 10:30
  SPEAKER_01: And like 100%.
• 10:32
  SPEAKER_01: And it's actually much more complex.
• 10:34
  SPEAKER_01: And this is why I don't believe that some like blanket suggestions are going to do uh this industry justice.
• 10:40
  SPEAKER_01: Like, for example, the fact that the security team has a problem does not necessarily mean that one, it's the most urgent hair-on fire problem that that is going to compel them to go out and look for solutions.
• 10:51
  SPEAKER_01: But more importantly, there are times when it is a legitimate problem.
• 10:56
  SPEAKER_01: Security team is genuinely concerned about solving this problem.
• 11:00
  SPEAKER_01: But they also know that they have like 85 or however many security tools already implemented in their environment.
• 11:08
  SPEAKER_01: So every time the question becomes, how do we solve this problem?
• 11:12
  SPEAKER_01: The number one option is never to go out and see see what are some of the newer startups offering.
• 11:20
  SPEAKER_01: The number one default option nowadays is becoming let's have a look at our existing stock and see if any of the solutions there can solve this problem.
• 11:30
  SPEAKER_01: Again, it doesn't mean that those solutions will be able to solve this problem better than wherever dedicated startup out there is tackling this specific challenge.
• 11:40
  SPEAKER_01: But if if any of your existing tools can solve this problem to like 75%, that may very well be good enough.
• 11:48
  SPEAKER_01: Like you don't have to introduce a new vendor, you don't have to go through a new POC, you don't have to sign a new contract, you don't have to negotiate a new contract.
• 11:54
  SPEAKER_01: So all of those factors are impacting the startup's ability to succeed, right?
• 11:59
  SPEAKER_01: Just because you have a problem doesn't mean, and just because just because the customer has a problem, and just because a startup has a good solution, it does not mean that this customer is going to go out and consider bringing in a net new vendor.
• 12:16
  SPEAKER_01: It's much more likely that they're going to say, okay, is any of the platform vendors that we currently have going to solve this problem within the next six months?
• 12:23
  SPEAKER_01: And if the answer is yes, there's just no chances that this company is going to buy a startup.
• 12:29
  SPEAKER_01: They will most likely sit and wait until you know Octus or CrowdStrike's or Palo Alto's or Microsoft of this world are just going to release this new feature.
• 12:38
  SPEAKER_01: And it makes sense, right?
• 12:39
  SPEAKER_01: So there's there are just so many factors that startups and founders have to think about that is just beyond is this a problem and should they go ahead and solve it?
• 12:47
  SPEAKER_01: Like, yes, some some things are problems.
• 12:50
  SPEAKER_00: And with so many blurred lines to what you're saying between different categories or subcategories or product types, right?
• 12:56
  SPEAKER_00: Between what, you know, it's not clearly saying this one shines a light and this one drives a car.
• 13:01
  SPEAKER_00: It's not like that, right?
• 13:02
  SPEAKER_00: The world we're in, there's so much overlap in different product areas.
• 13:05
  SPEAKER_00: You could see how you know good enough is actually might be a completely different way to solve the problem that uh the the founder hadn't even thought about, right?
• 13:13
  SPEAKER_00: That if he just did something and activated something in Okta, it might actually take care of as you know most of this other problem they were thinking about.
• 13:19
  SPEAKER_01: Yeah, and for many founders, well, for most founders, or I would even dare to say for all founders, this one problem that they're solving is the number one problem that they hope the security team is going to worry about.
• 13:32
  SPEAKER_01: And it's the number one problem that causes all the breaches.
• 13:35
  SPEAKER_01: Like if you look, if you look at like if you look at the marketing of every single cybersecurity solution, it sounds as though if you look at the identity solution, like 90 plus percent of all the like of all the breaches happen because of the identity, uh, you know, misconfiguration and so on and so forth.
• 13:53
  SPEAKER_01: If you if you're looking at the cloud security solution, you take the same number, 90 plus percent, but just say they happen because of the cloud.
• 14:01
  SPEAKER_01: If you're a company that helps to secure workforce or deal with insider thread, like it's the same story.
• 14:07
  SPEAKER_01: Like 90 plus percent happen because of the insiders.
• 14:09
  SPEAKER_01: And so I don't, it's hard to say to what degree those those numbers are correct.
• 14:14
  SPEAKER_01: Obviously, like they all cannot be right at the same time.
• 14:18
  SPEAKER_01: But what is true is that from a perspective of a founder that is, for example, tackling the problem of insider threats, like they go to market, like they go, they talk to CISUS and they say, you know what, this is the number one problem you should worry about, and here we have a solution.
• 14:33
  SPEAKER_01: But then if you step back, then you realize that from the CISUS standpoint, there is like 155 of those startups that are all trying to say, you know, that yes, the problem we are solving is the number one problem you have to worry about.
• 14:46
  SPEAKER_01: And a smart security leader is not going to handle prioritization based on wherever you know the companies that are selling them solutions are telling them.
• 14:55
  SPEAKER_01: Instead, they'll step back, they will look at their own environment, they'll try to understand what the attack vectors are, what the crown jewels are of this specific business, like where the risks lie in this specific customer environment.
• 15:09
  SPEAKER_01: And based on that, they will do their own prioritization.
• 15:12
  SPEAKER_01: And it just so happens that there are hundreds and thousands of potential attack vectors, of potential ways uh through which an organization can be breached, but some of them are much more likely to happen than others.
• 15:26
  SPEAKER_01: And security budgets are finite.
• 15:28
  SPEAKER_01: So the buyers will have to prioritize the areas that they're most concerned about and uh deal with the rest.
• 15:34
  SPEAKER_00: One of the things I've heard you say, Ross, in the last couple of years is that you really advocate for founding teams who've been practitioners.
• 15:41
  SPEAKER_00: So they've been in security operations or architecture, and they, you know, had to run that for, I don't know, a Fortune 500 company for a few years.
• 15:49
  SPEAKER_00: They truly understand the nature of the world in which they're in.
• 15:53
  SPEAKER_00: Um yet, you know, there's a whole bunch of very successful startups right now who they came out of 8200, out of Israel, very, very smart people, right?
• 16:01
  SPEAKER_00: Who clearly know cybersecurity really, really well, but they might not have the operational experience.
• 16:06
  SPEAKER_00: So how do you think about that dichotomy then about you know where the real secret sauce might lie?
• 16:13
  SPEAKER_01: Yeah, so there the it is a very interesting question.
• 16:15
  SPEAKER_01: And I think it's it's it's also important to define what the meaning of the word security, of the word security practitioner, right?
• 16:23
  SPEAKER_01: I I have a full confidence and I have a I have a very, very high degree of certainty that every like every 8200 uh unit graduate is a security practitioner, right?
• 16:37
  SPEAKER_01: It's just their practitioners who are often on more of the more of an offensive side, but they're still very proficient, like highly, you know, highly uh educated, like highly agile security practitioners and people who understand security at the very fundamental level.
• 16:54
  SPEAKER_01: Like there are many reasons why why uh places such as Unit 8200 are producing so many great uh founders and and and so many great companies.
• 17:04
  SPEAKER_01: And uh there is definitely, you know, there is definitely the Israeli culture, there is definitely this, you know, this this mindset that I you know I can do anything, like I I I am I am very capable.
• 17:15
  SPEAKER_01: There is the support that that the people from from from uh IDF get once they do choose to start a company, but also something that that often gets missed, and it's the fact that uh there is a very good understanding of the offensive side of security.
• 17:32
  SPEAKER_01: And uh when you think about when you think about places like NSA, when you think about places like IDF, like people who work, like people who work uh in the military, they get visibility into the most cutting-edge offensive technologies.
• 17:48
  SPEAKER_01: And it typically in cybersecurity specifically, it generally takes several years for the cutting edge offensive technologies to, you know, to start and and to start spilling into the market and to translate into you know just the day-to-day breaches.
• 18:06
  SPEAKER_01: So anything, like anything we are we are talking about today as just the commonplace breaches, like the behavioral detections, like all of this, like all of this stuff, it used to be the you know, it used to be the very same techniques and methodologies that were used in in IDF, were used in NSA, were used by the nation states attacks.
• 18:24
  SPEAKER_01: And then after several years, it sort of escapes the containment and it becomes commonplace.
• 18:31
  SPEAKER_01: So essentially, people who get to see the attacks in the military can anticipate that the same or similar types of attacks will be seen in the industry several several years from now, and they can build solutions that that not only anticipate it but solve those specific those specific problems.
• 18:49
  SPEAKER_01: Like there's so many reasons why that's the case.
• 18:51
  SPEAKER_01: I do believe that uh 8200, like in general, like uh Unit Matsov, like uh IDF more broadly, like places like NSA, uh, you know, the the US Cyber Command, like all of those places are producing highly capable security practitioners.
• 19:07
  SPEAKER_01: It's just that their lenses are very different than the lenses of somebody, for example, working in a SOC at JP Morgan, which is also going to be very different than the lenses and the perspective of a security engineer building solutions at, say, Google or Meta.
• 19:22
  SPEAKER_01: So it's they're all security practitioners, they just see the industry from different perspectives.
• 19:27
  SPEAKER_00: It feels like the ideal combo is a little bit of each, right?
• 19:30
  SPEAKER_00: If you had the the more you know future thinking 8200 person with the the GP Morgan sock person with the meta-engineer architect, that might be the killer combo right there.
• 19:41
  SPEAKER_01: Uh potentially.
• 19:43
  SPEAKER_01: Potentially, I think I think the like the fundamental philosophical question here is do we care, like do we care about people and their ability to do things, you know, their drive, their hunger, their passion, their willingness, you know, to go an extra mile to succeed, or do we care about the specific skill sets and experiences?
• 20:03
  SPEAKER_01: I am a big believer that the former matters much more than the latter.
• 20:08
  SPEAKER_01: Meaning, one of the like one of the reasons why Israeli founders often succeed over founders from other geographies is really their drive, it's their hunger, it's their desire to just push the limits and go, you know, go and make things happen.
• 20:22
  SPEAKER_01: While you see people in in some other places are are used to more, you know, like I'll say safer, safer ways in which the competition uh unfolds, and and we're just frankly less hungry.
• 20:36
  SPEAKER_01: And that is something that I see a lot with with the security engineering culture today, where if you're a security engineer in one of the successful, like in one of the you know, Bay Area uh cloud native uh venture-backed companies, you can be paid very well.
• 20:52
  SPEAKER_01: Like we're talking about like hundreds and thousands of dollars.
• 20:56
  SPEAKER_01: And the question is, why would you take a risk, right?
• 20:59
  SPEAKER_01: If you like if if you're deciding if you want to give up your half a million uh salaries somewhere at very advanced and a very tech-forward corporation and go and build a startup that has very high chances of failing, do you even feel compelled to make to take that risk as much as if you are not making half a million bucks and and and you know that the only way for you to succeed financially is to go and build this build a successful company.
• 21:25
  SPEAKER_01: So there are all of those factors that come into play.
• 21:27
  SPEAKER_01: But I do I do believe that the future of cybersecurity innovation is going to be defined by security practitioners.
• 21:32
  SPEAKER_01: And frankly, not just the future, but the present.
• 21:35
  SPEAKER_01: Like the very much the present today is being defined by people who have who have seen security from the very like who know security from the very foundational level, who have accumulated their experiences, be it in the military, uh, be it in you know, in on SOC teams, being uh you know, on application security teams.
• 21:55
  SPEAKER_01: So like the the future, the future is already here, it's just not evenly distributed, as they say.
• 22:00
  SPEAKER_00: Talking about risk, let's let's take a different angle to this.
• 22:03
  SPEAKER_00: What does it take for a CISO or you know, a security leader, let's say at any company, to actually want to buy from an early stage cybersecurity company?
• 22:13
  SPEAKER_01: Yeah, uh, I it's it's interesting because I actually have an article that is uh I think it's scheduled to come out this week or potentially next week, about uh like talking about risks of buying from startups.
• 22:25
  SPEAKER_01: And frankly, in my view, any purchasing decision has some risk context, right?
• 22:31
  SPEAKER_01: Uh if you are like If if if let's just say if a security team is considering buying solutions from a large and established corporation, there are risks.
• 22:40
  SPEAKER_01: It's just different kinds of risks.
• 22:42
  SPEAKER_01: Yes, maybe the risks of that company going you know going out of business three months later are lower, but there are risks to you know to the quality of support that the that the security team can expect.
• 22:55
  SPEAKER_01: You know, when you submit a support ticket with a large uh large enterprise, you're probably going to wait for a few weeks until they get back to you.
• 23:04
  SPEAKER_01: And the answer is often going to be, yeah, thank you.
• 23:07
  SPEAKER_01: We acknowledge your concern.
• 23:09
  SPEAKER_01: Uh you know, the team will will take this into consideration as we plan our future roadmap.
• 23:14
  SPEAKER_01: And that's the end.
• 23:15
  SPEAKER_01: Like to me, the fact that you as a buyer cannot get your feedback actioned in a quick manner is a form of risk, for example.
• 23:26
  SPEAKER_01: Then if you look at the startups, you see that yes, the chances of that startup getting out, you know, either going out of business or pivoting or or or uh you know maybe be getting acquired are potentially higher than the chances of a more established company.
• 23:44
  SPEAKER_01: But even then, uh there are risks that are lower, right?
• 23:48
  SPEAKER_01: You have a much lower chances of needing to wait for six weeks until your product question gets answered because the founders are working 24-7 and and they will get that answer to you right away.
• 24:01
  SPEAKER_01: So you're not taking those risks.
• 24:03
  SPEAKER_01: And so I guess the the the meta point is that every single buying decision is risky.
• 24:09
  SPEAKER_01: It's just there are different types of risks that are more likely for different kinds of products.
• 24:14
  SPEAKER_01: Moreover, in cybersecurity specifically, there aren't really that many choices that buyers have, right?
• 24:22
  SPEAKER_01: You look at some of the more established companies and you see them getting acquired, you see them getting acquired for pennies on a dollar, you know, despite having raised like billions of dollars.
• 24:33
  SPEAKER_01: Like you see companies getting acquired by private equity firms, and then you know, having their roadmaps and having their their you know their their focus changed entirely.
• 24:44
  SPEAKER_01: So there are risks.
• 24:45
  SPEAKER_01: There are always risks.
• 24:47
  SPEAKER_01: I think one of the like one of the responsibilities of a security leader is to find ways to manage those risks.
• 24:53
  SPEAKER_01: And uh when they buy, like when they buy from from an early stage cybersecurity startup, yes, the chances are much higher that something is going to happen to that startup, but then also they can get a potential partner that is going to be very responsive to their to their questions, that is going to be willing to build the product and shape the product in such a way that addresses the unique concerns of the you know of the of the enterprise.
• 25:17
  SPEAKER_01: Uh so for very early stage founders, I think that's where it becomes very tricky.
• 25:22
  SPEAKER_01: Like if you're a pre-seed seed stage company and you're trying to get an enterprise to talk to you and to buy from you, like that is a much harder value proposition.
• 25:31
  SPEAKER_01: There are some tricks uh through which people are trying to signal that they're like that the risk of working with them is lower.
• 25:40
  SPEAKER_01: Like I like some startups, for example, build an open source version of their product.
• 25:44
  SPEAKER_01: So while the the the enterprise buyer may not develop a very high degree of confidence that this startup is going to be stable, at the very least, they can expect the code, uh, they can inspect the code, they can see exactly how the product works, so they can, you know, they can analyze it to understand if there are any any kind of security concerns that they that they should be worried about.
• 26:08
  SPEAKER_01: So uh doing creating the open source version is one way to handle those risks.
• 26:13
  SPEAKER_01: Being just very transparent with buyers about the stage of the company is another way uh to handle the risk.
• 26:19
  SPEAKER_01: Raising capital from reputable investors is also a very strong signal that that you know buyers look at and they say, okay, we don't know if this company is going to be successful, but it's most likely that we will want to replace this product after two years anyway, and they have just raised capital that will give them runway for the next like three to four years.
• 26:41
  SPEAKER_01: So that sounds great.
• 26:42
  SPEAKER_01: Like we're probably you're probably okay to make this buying decision.
• 26:46
  SPEAKER_01: So all of those factors, the capital, the caliber of the team, you know, the the quality of the team that the company is able to attract, like are they hiring like very senior, very reputable people, or are they outsourcing their software engineering to you know to countries with lower cost of labor?
• 27:02
  SPEAKER_01: So all of those, all of those factors, along with the capital that they're able to raise, like the quality, the caliber of VCs, you know, the the the the the SISUs and uh and the peers who either recommend this this product or who you know who could have potentially either invested into into it as angels or maybe who act as advisors to the company or just reputable people from the in from from the industry who are not practitioners but who still have that strong profile.
• 27:28
  SPEAKER_01: Like all of those things matter, and they signal that the startup is is is ready to start selling to more mature companies.
• 27:37
  SPEAKER_00: Well, Ross, let's learn a bit more about you personally.
• 27:40
  SPEAKER_00: I'm gonna spin the wheel here to see which of these 35 questions I'm gonna ask you.
• 27:45
  SPEAKER_00: And just so you know, my spin the wheel technology, it's next gen, it's AI driven, it uses the latest polymorphic encryption to protect the algorithm I'm using to generate completely random questions out of absolutely nowhere.
• 27:58
  SPEAKER_00: So let me spin this wheel and see what it comes up.
• 28:05
  SPEAKER_00: Question number 19, Ross.
• 28:07
  SPEAKER_00: How did you make money as a kid?
• 28:09
  SPEAKER_01: So uh when I was a teenager, I was actually uh doing some writing, like some sort of ghost writing for you know for different local media.
• 28:20
  SPEAKER_01: So like writing was something that I I've done before.
• 28:23
  SPEAKER_01: Then I when I was even younger, I think I was I was solving, you know, I was doing homework for people for for money.
• 28:30
  SPEAKER_01: That's also something I've done, you know.
• 28:32
  SPEAKER_01: Living living in a different world where it wasn't considered cheating at the time.
• 28:36
  SPEAKER_00: Yeah, it wasn't considered cheating, yeah.
• 28:37
  SPEAKER_00: Uh I've got two teenage girls, I'm sure they would tell me it's not cheating either.
• 28:41
  SPEAKER_00: Now you're because you started writing in your teenage years.
• 28:43
  SPEAKER_00: Is that the forerunner of your blog then, which has been so successful?
• 28:47
  SPEAKER_01: Uh I did.
• 28:48
  SPEAKER_01: Uh I was I was quite active.
• 28:49
  SPEAKER_01: You see, I I was quite uh interested in you know in politics and different societal societal challenges.
• 28:56
  SPEAKER_01: So the topics uh on which I would I would write before were very different.
• 29:00
  SPEAKER_01: I was also like I was doing all kinds of random stuff.
• 29:03
  SPEAKER_01: Like I was drawing, so I had several exhibitions and actually sold some paintings abroad uh in in different European countries.
• 29:11
  SPEAKER_01: It was, yeah, the childhood was an interesting time, a very different time.
• 29:15
  SPEAKER_00: You were doing lots of things to make money as a kid.
• 29:16
  SPEAKER_00: That's awesome.
• 29:17
  SPEAKER_00: All right, let me spin the wheel again and get our second question.
• 29:25
  SPEAKER_00: All right, number 28.
• 29:28
  SPEAKER_00: Is there a memorable moment in your work career that uh either makes you stop and think that was cool or stop and think that was a little bit embarrassing?
• 29:37
  SPEAKER_01: Hmm, that is going to be a tough one.
• 29:42
  SPEAKER_01: Uh yeah, like I I spent my the past decade of my life in product management, so all the memorable memorable moments were primarily releases and like big milestones that we would launch.
• 29:54
  SPEAKER_01: I don't know if there is anything specif anything that's fun or even embarrassing that I can I can come up with.
• 30:01
  SPEAKER_01: You know, I never like fortunately I was never naked on a Zoom call or Google Meet call.
• 30:07
  SPEAKER_01: Like like no, like no extra unexpected events have ever happened to me.
• 30:11
  SPEAKER_01: Uh I think probably the most memorable moments that I can think of were during the pandemic when I would get to actually get together with people that I worked with, you know, just going out, like going to do some rock climbing and some of those things.
• 30:26
  SPEAKER_01: And the reason I say that those are the memorable moments is because I am a very social human being.
• 30:30
  SPEAKER_01: Like I need people, I need to be around people.
• 30:33
  SPEAKER_01: And the the several years of of the pandemic isolation were very, very hard on me.
• 30:38
  SPEAKER_01: So I, you know, whenever I would get out and actually like socialize with people I work with, like that was indeed very memorable.
• 30:45
  SPEAKER_01: Quite quite a boring answer, but but I think as long as you accept it.
• 30:50
  SPEAKER_00: Well, I accept it for no, but we got RSA in a couple of weeks' time, so it might we might have to engineer an embarrassing moment or a fun moment for you uh at RSA.
• 30:58
  SPEAKER_00: All right, let's spin the wheel for the last completely random question here.
• 31:09
  SPEAKER_00: All right, number three.
• 31:10
  SPEAKER_00: What is the story behind you getting your first job in cybersecurity?
• 31:16
  SPEAKER_01: Yeah, the story is actually very uh very different from most of the stories I've heard about people getting into security.
• 31:24
  SPEAKER_01: So, in my case, like I'm a product guy, I have been in product management for quite some time.
• 31:28
  SPEAKER_01: I worked across different industries.
• 31:30
  SPEAKER_01: So I was in e-commerce, retail, wholesale, financial technology for a number of years.
• 31:34
  SPEAKER_01: And then at a certain like uh several years ago, well, quite a few years ago, or at least that's that's how it feels at this point.
• 31:42
  SPEAKER_01: Uh, a good friend of mine reached out saying, Hey, uh, we're looking for somebody to lead product.
• 31:47
  SPEAKER_01: We are a cybersecurity pre-seed stage startup.
• 31:50
  SPEAKER_01: Uh, knowing that you have done product, knowing that you have led product at different companies, would you be interested in joining?
• 31:56
  SPEAKER_01: And uh I had a great conversation with the founder, I had a great, you know, great conversation with the broader team.
• 32:03
  SPEAKER_01: Everything made sense.
• 32:04
  SPEAKER_01: You know, the industry made sense, the opportunity made sense, the market made sense.
• 32:08
  SPEAKER_01: And then I went home and I started doing some digging into the industry.
• 32:12
  SPEAKER_01: I wanted to understand how the industry functions, like what are the different vendors, what are the different product categories.
• 32:18
  SPEAKER_01: And ultimately, after doing it for several hours, I ended up calling my friend and I said, you know what, I am not going to do it.
• 32:26
  SPEAKER_01: So his response was like, hey, like, what do you mean?
• 32:29
  SPEAKER_01: And for me, you know, for me at the time, coming from the financial technology world, where you can very much understand what different products do into the cybersecurity world, the first the very first things I saw were MDR, XDR, NDR, sim, source, CSPM, DSPM, DLP.
• 32:48
  SPEAKER_01: And I was just getting lost in all of those abbreviations.
• 32:51
  SPEAKER_01: It was so incredibly confusing.
• 32:53
  SPEAKER_01: And I said, okay, you know, like let's put aside the abbreviations.
• 32:57
  SPEAKER_01: What do those products do?
• 32:59
  SPEAKER_01: And so uh I I wanted to test some of them, I wanted to see, you know, how they like how they compare to one against one another.
• 33:07
  SPEAKER_01: And what became very apparent is that I was either unable to do it because it was very hard to get access to the products, or whenever I was able to do it, I would, I would deploy it, I would you know, create an account, and I would see that the feature set and the functionality of of product A was very similar to the functionality of the product B, and yet they were considered to be products from different quote unquote categories.
• 33:31
  SPEAKER_01: And that's when I said, you know what, this is such a complicated space.
• 33:35
  SPEAKER_01: Like, how how can I ever understand this?
• 33:37
  SPEAKER_01: But again, like several years later, here I am.
• 33:39
  SPEAKER_01: So, as you can, as you can see, I did go back on my decision.
• 33:43
  SPEAKER_01: I ultimately ended up joining the company, and it's been a fantastic journey ever since.
• 33:47
  SPEAKER_01: I think, I still think up until today that me moving into the cybersecurity space has been the absolutely very best decision in my career life.
• 33:56
  SPEAKER_01: Probably not in my life, but definitely my career life.
• 34:01
  SPEAKER_00: Yeah, you know, I talked to a head of sales recently.
• 34:04
  SPEAKER_00: They just exited uh bought, and he told me a couple of stories how in the early stages, when they were getting their first customers, one of the questions they would get asked by prospects was, Who's your VCs?
• 34:17
  SPEAKER_00: And it was almost like a proxy for, well, how credible are you?
• 34:21
  SPEAKER_00: Like you look and feel okay, but I need to know other smart people that I trust have already put some money in.
• 34:27
  SPEAKER_00: And they didn't have a great answer because the founders had actually gone for the best deal in terms of valuation as opposed to the highest caliber VCs.
• 34:35
  SPEAKER_00: So when they said, Well, this company, this company, this company, he said a couple of times the SISO's like, I've never heard of those people.
• 34:41
  SPEAKER_00: I've no idea who they are.
• 34:43
  SPEAKER_00: I, you know, I don't know what to make of that, right?
• 34:45
  SPEAKER_00: It was almost like a black mark against them as they were as they were thinking about it.
• 34:49
  SPEAKER_01: Yeah, and it's always like it's always a signaling exercise.
• 34:52
  SPEAKER_01: Like, who are the investors that that were willing to take risks on you?
• 34:56
  SPEAKER_01: Like, what is their reputation?
• 34:57
  SPEAKER_01: Who are the early employees that left their well-paying jobs to join your company and and what's their reputation?
• 35:04
  SPEAKER_01: Like, who are the early advisors that are really spending their time and effort to help this company grow?
• 35:10
  SPEAKER_01: And what what is their reputation?
• 35:12
  SPEAKER_01: Who are the early angel investors?
• 35:14
  SPEAKER_01: And on and on and on.
• 35:15
  SPEAKER_01: So it's just it's it's it's all about signaling.
• 35:18
  SPEAKER_01: And the same is true for all areas of life, including business, right?
• 35:21
  SPEAKER_00: Yeah, for sure.
• 35:22
  SPEAKER_00: And let's completely change tech here on you, Ross.
• 35:25
  SPEAKER_00: Uh, philosophical question for you.
• 35:28
  SPEAKER_00: If you were, let's say you were gonna start your own company right now, would you want to create the wave that was gonna, you were gonna, you know, write off into the future, or would you want to ride someone else's way that already exists in terms of helping people with the transformation?
• 35:44
  SPEAKER_01: That is a very good question.
• 35:46
  SPEAKER_01: And I did, I I have to admit, I've spent some time thinking about answering this to this exact question for myself, you know, as I think about you know my future plans and what's what could be possible.
• 35:58
  SPEAKER_01: And I there are pros and cons, right?
• 36:00
  SPEAKER_01: There are pros and cons to each of those paths, and there are the way you build companies in in each of those directions is going to be very different.
• 36:09
  SPEAKER_01: If you are trying to create a wave, you have to like you have to raise a lot of capital.
• 36:14
  SPEAKER_01: You have to invest a lot of money into marketing, you have to invest a lot of money into educating the market and making the market understand like why they should care.
• 36:24
  SPEAKER_01: Like why, like, why is it that they should prioritize this specific thing that you're solving for against like all the other things?
• 36:31
  SPEAKER_01: And in general, in cybersecurity specifically, a lot of the problems do not become a matter of market knowledge by default or because companies are looking for ways to solve them or to solve something.
• 36:46
  SPEAKER_01: Instead, it's the company solving this problem that needs to go out and educate customers.
• 36:51
  SPEAKER_01: Like, and and I'll give you a very very very simple, very basic example.
• 36:56
  SPEAKER_01: Uh, if you are a marketer, you like you know that your performance is is directly tied to the metrics and your ability to drive those metrics.
• 37:07
  SPEAKER_01: So, as a marketer, you're always looking for ways to get uh more people uh visit your website, to get more people open your email, to get more people click on the CTA within your email, to get you know to open the new net new, you know, net new customer groups or net new channels to get exposed to different prospects.
• 37:28
  SPEAKER_01: You're always on the lookout for something to help drive the same metrics that you know you're being evaluated on.
• 37:35
  SPEAKER_01: If you're a security, so as a result, the the the buyers, the prospects in the marketing technology space are always out there looking for something new.
• 37:44
  SPEAKER_01: The same is not true in security.
• 37:46
  SPEAKER_01: Like in security, security teams aren't exactly you know starting their day by saying, Oh my god, what is some cool stuff out there that we can try?
• 37:55
  SPEAKER_01: Instead, they have to be very problem-focused, they have to deal with their limited resources because they're not tied to the revenue, right?
• 38:02
  SPEAKER_01: Their goals are essentially you know preserving the status quo and making sure that the company doesn't get breached.
• 38:08
  SPEAKER_01: And when it does get breached, the you know, the the blast radius of that breach and the financial uh financial impact are very much contained.
• 38:16
  SPEAKER_01: So founders looking to essentially create, you know, start a wave, they have to think about all of those factors and they have to invest a lot of resources into educating others about the specific need.
• 38:28
  SPEAKER_01: I like on the other hand, if you, as you say, if you're riding somebody else's wave, that means that somebody else's marketing budget has already educated buyers about this problem.
• 38:39
  SPEAKER_01: It means that somebody else's, you know, some some other VCs, not your VCs, but some other VCs have already paid for, you know, for events and conferences and and some of the other educational and marketing activities that have prepared buyers to at the very least ask themselves questions, such as, is this something like is this an attack vector that we should worry about?
• 39:02
  SPEAKER_01: Like if this is if if if this is not the first time they're hearing about the problem, it's much more likely that they will actually listen and and they'll you know they will be willing to try something.
• 39:12
  SPEAKER_01: And on top of that, when you look at when you look at the the state of the market, you come to realize that many of the successful, in fact, most of the successful cybersecurity startups and cybersecurity companies uh haven't exactly invented something new.
• 39:28
  SPEAKER_01: Instead, they have leveraged the a lot of the work that have happened before them.
• 39:33
  SPEAKER_01: Like you look at companies like Duo Security and you realize that fundamentally it's the same RSA token that existed for many years that was now delivered in a much more user-friendly, easier to scale, easier to deploy way.
• 39:48
  SPEAKER_01: When you look at, you know, when you look at some of the like some of the winning EDR companies, you realize that there was already the endpoint security market, there was a well-established endpoint security market, but there were some of the net new needs that the existing endpoint security market at the time was not able to solve.
• 40:07
  SPEAKER_01: And so they they they focused on the known attack vector, and they were able to build their their business around this.
• 40:14
  SPEAKER_01: In the same way, like if you look at the cloud security space today, like everybody is looking at this, like some people are you know paying attention to what Orca is doing and some other companies in that space.
• 40:25
  SPEAKER_01: But what is true is that neither of those companies have quote unquote started the cloud security as a segment.
• 40:33
  SPEAKER_01: Instead, they have leveraged the decade and a half of the work that other startups have been accumulating, and they were able to bring it all together and execute incredibly well.
• 40:45
  SPEAKER_01: So, to answer your question, I think, I think again, there are pros and cons to each of those, each of those approaches.
• 40:51
  SPEAKER_01: I think I would be much more inclined to take the you know the latter path and to look for a new way of solving an old problem as opposed to trying to educate the market about the net new problem.
• 41:05
  SPEAKER_01: And uh yeah, that's that's probably how I think about it.
• 41:08
  SPEAKER_00: Well, speaking about educating the market, last question for you.
• 41:11
  SPEAKER_00: You know, you got a section in the book, uh, the rise of security platforms in industry consolidation.
• 41:18
  SPEAKER_00: You were talking about you know, future trends or trends that are coming up right now.
• 41:21
  SPEAKER_00: And of course, just a couple of months ago, that the Palo Alto CEO said, you know, that they want to be the platform for cybersecurity, right?
• 41:28
  SPEAKER_00: This is the platform play coming in.
• 41:29
  SPEAKER_00: Try to strike, obviously, want to do it as well.
• 41:32
  SPEAKER_00: Beyond all the arguments about what they're doing, let's let's focus on if I was a startup.
• 41:36
  SPEAKER_00: How should I think about these big platform plays companies?
• 41:39
  SPEAKER_00: Are they people that I should try and compete against?
• 41:42
  SPEAKER_00: Should I try and integrate with?
• 41:44
  SPEAKER_00: Should I just focus on my own thing and just try and you know find my own path?
• 41:49
  SPEAKER_00: Or or what how would you encourage people to think about it?
• 41:51
  SPEAKER_01: It's it's a tough one.
• 41:53
  SPEAKER_01: It's it's going to depend on so many factors.
• 41:55
  SPEAKER_01: Uh, what is the ambition of the founders?
• 41:58
  SPEAKER_01: What is the vision of the founders?
• 42:00
  SPEAKER_01: Like how much time and effort, like how much what is the degree of risks that they're willing to take?
• 42:05
  SPEAKER_01: Are they interested in you know in building a fairly you know well-scoped uh quote unquote point solution and getting acquired within the next like two to three years?
• 42:15
  SPEAKER_01: Or are they looking to build a company that solves that has a larger larger vision that it is going to pursue and solves like a much more tangible, like much more impactful problem?
• 42:27
  SPEAKER_01: I and I don't think that either of those is is better than than than the other.
• 42:32
  SPEAKER_01: It's just that uh this whole process of ideating and this and and thinking about about you know the question you asked, it has to start by people asking themselves those questions and doing some soul searching and understanding what is it that they're trying to do.
• 42:47
  SPEAKER_01: If the goal is to build something that is that has higher chances for uh higher chances to get acquired, then it is again you know, past performance is not a guarantee of future results, but based on the past the past data, it does appear that point solutions that do one thing very well are much more likely to get acquired compared to the platform solution.
• 43:11
  SPEAKER_01: In fact, acquirers tend to look for companies that just do one thing incredibly well and that can be integrated into the broader platform, and and the the sales team of the acquiring company can just start, you know, start selling and pushing to their existing customer base.
• 43:29
  SPEAKER_01: Like that's typically the playbook for the acquisitions.
• 43:32
  SPEAKER_01: If the intent is to build like a multi-billion dollar company, it it's a very different playbook.
• 43:38
  SPEAKER_01: Although at the beginning, they all start very similar, like right fundamentally, you need to find, you need to understand what is it that you are trying to solve, why nav, like why is nav the right time to do it.
• 43:50
  SPEAKER_01: Like have a fairly strong opinion about the future perspective and you know the the the the way you believe the industry is going to develop and unfold over the coming like half a decade or a decade.
• 44:02
  SPEAKER_01: And then based on that, finding a wedge, finding that initial use case that will enable you to you know to enter the market.
• 44:10
  SPEAKER_01: And that's like that's one of the hardest parts because in this day and age, if you like if you just look at the surface level, it does indeed appear that all the impactful problems have been solved, but there are some that haven't, you know, and I'm a big believer that you know at times it's very hard to think of a specific new solution or a specific new problem area that has a good potential, but we all know that there will be more successful cybersecurity companies built over the next decade, right?
• 44:40
  SPEAKER_01: We know that the market is just not going to stop where it is today.
• 44:44
  SPEAKER_01: And so because there are going to be more companies built, the question is what will those companies look like?
• 44:50
  SPEAKER_01: And uh that question is not necessarily easy to answer, but what's very easy to say is that each of those solutions is going to have a one specific wedge, one specific angle through which they enter.
• 45:00
  SPEAKER_01: And then once you've identified that wedge, once you found that there are enough early adopters that are going to buy those solutions and that are that actually care about that's like solving that specific problem uh that you've identified, there is there is this land and expense strategy that has frankly been really the like in the enterprise space, like in the enterprise B2B space, really the only fundamentally way for companies to grow, right?
• 45:27
  SPEAKER_01: You identify one specific problem area that people are willing to pay for solving today, and then from there you look to expand into solving other problem areas adjacent to the main one over time.
• 45:40
  SPEAKER_01: Uh, it's very hard to do, particularly today when every single startup enters the enterprise environment with a very similar approach.
• 45:49
  SPEAKER_01: So you've you have like 60 cybersecurity startups within the company trying to expand into each other's areas, and it it becomes a very, like a very competitive and a fairly toxic uh environment.
• 46:02
  SPEAKER_01: But at the same time, that is the state of the market, and I believe that the execution will continue to define and continue to separate winners from losers, or winners and companies who win and companies who like win to a lesser degree or don't win at all.
• 46:17
  SPEAKER_01: Um but but the playbook for building companies is is likely to remain very similar.
• 46:22
  SPEAKER_01: Like in cybersecurity, there are some variations when it comes to you know how do you define the market, whom do you target?
• 46:27
  SPEAKER_01: Do you target CISOS?
• 46:28
  SPEAKER_01: Do you target security practitioners?
• 46:30
  SPEAKER_01: Do you target both?
• 46:31
  SPEAKER_01: Do you go and sell through channel exclusively?
• 46:34
  SPEAKER_01: Do you go like there are those variations in how you get to the market, but fundamentally identify the problem, find the veg, and find a way, a way in, and then from there uh solve one problem incredibly well, you know, a thousand times for a thousand customers, and then look to expand into adjacent areas.
• 46:51
  SPEAKER_00: Well, Ross, look, enjoyed having you on the podcast.
• 46:53
  SPEAKER_00: Uh, I'll put your LinkedIn link into the show notes.
• 46:57
  SPEAKER_00: Is that the best way to get hold of you, or do you want someone to contact you a different way?
• 47:01
  SPEAKER_01: Absolutely.
• 47:01
  SPEAKER_01: No, LinkedIn is is is is a perfect way to do.
• 47:04
  SPEAKER_00: All right.
• 47:05
  SPEAKER_00: Well, listen, I'm wishing you all the best with uh Cyber for Builders and uh hope to pump into you at RSA in a couple weeks as well.
• 47:11
  SPEAKER_01: Thank you so much, Andrew.
• 47:12
  SPEAKER_01: Looking forward to it.