Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 136: Peter Prizio, CEO of SnapAttack talks the value in combining disparate tools to make the lives of red and blue teams easier

Transcript

136: Peter Prizio, CEO of SnapAttack talks the value in combining disparate tools to make the lives of red and blue teams easier · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_00: Combining desperate tools to make operations easier is a powerful play, especially in cybersecurity.
• 0:39
  SPEAKER_00: Peter Prizio, the CEO at Snap Attack, joins me to talk about how they're doing that for red teams and blue teams.
• 1:04
  SPEAKER_00: Sales Bluebird gives you tips, tricks, experiences, examples, ideas, and inspiration from people who know a thing or ten about building startups.
• 1:14
  SPEAKER_00: I am your host, Andrew Monahan.
• 1:16
  SPEAKER_00: Our guest today is Peter Prizio, CEO at SnapAttack.
• 1:20
  SPEAKER_00: Peter, welcome to Sales Bluebird.
• 1:23
  SPEAKER_01: Hey Andrew, thank you for having me.
• 1:24
  SPEAKER_00: Yeah, I'm looking forward to our conversation.
• 1:26
  SPEAKER_00: SnapAttack is part of the early stage expo at RSA coming up.
• 1:30
  SPEAKER_00: And I really enjoy having these conversations with earlier stage companies when you're in that formation and fighting your feet and trying to get the traction and grow.
• 1:38
  SPEAKER_00: It's always a really interesting view on how to do that and how to go about getting that business going.
• 1:43
  SPEAKER_00: But before, Peter, before we get into the uh business end of this, let's get to know the real you a little bit here.
• 1:49
  SPEAKER_00: I've got 15 questions on a list.
• 1:51
  SPEAKER_00: And if you randomly pick a number to one and 15, I'll read the question it corresponds to.
• 1:56
  SPEAKER_00: Are you good with that?
• 1:57
  SPEAKER_01: Sure.
• 1:58
  SPEAKER_01: Yeah, yeah.
• 1:58
  SPEAKER_01: Let's go with number three.
• 2:00
  SPEAKER_00: Number three, tricked out Jeep or German car with all the gadgets.
• 2:05
  SPEAKER_01: That's a tough one.
• 2:06
  SPEAKER_01: I probably have to go with the German car.
• 2:08
  SPEAKER_00: Do you have one right now?
• 2:10
  SPEAKER_01: I do, actually.
• 2:11
  SPEAKER_01: Yes.
• 2:12
  SPEAKER_01: But it's not why day.
• 2:13
  SPEAKER_01: Not totally tricked out, but yeah, it's German.
• 2:16
  SPEAKER_00: If it's German cars, got some gadgets, that's for sure, right?
• 2:20
  SPEAKER_00: Next number.
• 2:22
  SPEAKER_01: Number eight.
• 2:23
  SPEAKER_00: Eight is tea or coffee.
• 2:26
  SPEAKER_01: Coffee.
• 2:27
  SPEAKER_00: Do you have a particular brand or region that you like your coffee from?
• 2:30
  SPEAKER_01: You know, I actually my favorite is we've got a little local roastery here in Old Town Alexandria.
• 2:36
  SPEAKER_01: And I'll give them a quick plug.
• 2:38
  SPEAKER_01: They're called Misha's Coffee.
• 2:39
  SPEAKER_01: They do this Brute 66 blend.
• 2:41
  SPEAKER_01: It's like a French roast.
• 2:42
  SPEAKER_01: That's a favorite in the house.
• 2:43
  SPEAKER_00: That's awesome.
• 2:44
  SPEAKER_00: And do you grind and make your espresso yourself or do you put them in a machine to do that?
• 2:48
  SPEAKER_01: You know, I would love to do that, but it's timing.
• 2:51
  SPEAKER_00: So yeah.
• 2:54
  SPEAKER_01: Put it in the machine.
• 2:55
  SPEAKER_00: Yeah, no, I'll put it on that.
• 2:57
  SPEAKER_00: And final number for me.
• 2:59
  SPEAKER_00: Number 11.
• 3:00
  SPEAKER_00: 11 is one event, doesn't have to be business, one event that you haven't been to in the world, but would love to attend.
• 3:10
  SPEAKER_01: Oh, that's a really interesting one.
• 3:12
  SPEAKER_01: I'd love to do the running of the bulls in Pamplona.
• 3:17
  SPEAKER_00: Yeah.
• 3:17
  SPEAKER_00: I heard something that they were trying to phase that out.
• 3:19
  SPEAKER_00: I could be wrong, but I did too.
• 3:21
  SPEAKER_01: I don't I don't, it's probably not super friendly to the animals.
• 3:26
  SPEAKER_01: But last time I was in Spain, I went to um it was kind of like a mock bowl fight, you know, so they didn't do any of the really negative things and they seem to be treating the animals pretty well.
• 3:35
  SPEAKER_01: And that was good fun.
• 3:36
  SPEAKER_01: So maybe they'll be able to transition it into something that's a little bit more approachable.
• 3:40
  SPEAKER_00: Yeah, it is something that I'd love to go to as well just to experience.
• 3:43
  SPEAKER_00: I don't know if I'd actually run.
• 3:44
  SPEAKER_00: I don't know if I'd be the right person for that, but I'd like to at least watch for a little bit if they're you know toning down a little bit, maybe.
• 3:50
  SPEAKER_00: But yeah, it's one of those landmark events, right, in the world.
• 3:53
  SPEAKER_01: Yeah, absolutely.
• 3:54
  SPEAKER_00: Well, let's talk about SnapAttack.
• 3:56
  SPEAKER_00: You know, so Peter, I'm a sales guy, simple person from Scotland.
• 4:00
  SPEAKER_00: I like things to be obvious and logical to me.
• 4:03
  SPEAKER_00: So can you explain SnapAttack, what you do in words that I would understand?
• 4:08
  SPEAKER_01: Yes.
• 4:09
  SPEAKER_01: So Snap Attack, one, we're a product company, we're not a services company.
• 4:13
  SPEAKER_01: So we sell a product, and our platform, also called SnapAttack, is really a continuous purple teaming platform.
• 4:20
  SPEAKER_01: And for those that don't know, what that really means is we try to allow people who work on offensive cybersecurity and defensive cybersecurity to come together and play off of each other, right?
• 4:33
  SPEAKER_01: So every defensive measure you take should be informed by some offensive, you know, attacker-threat-informed kind of tradecraft.
• 4:42
  SPEAKER_01: So that's what we do.
• 4:43
  SPEAKER_01: We we make that process super easy and collaborative and you know, pretty quick to get a new hunt package or deploy alerts to your alerting tools.
• 4:53
  SPEAKER_00: And what are companies doing right now then before Snap Attack?
• 4:57
  SPEAKER_01: It's a wide mix of activities.
• 5:00
  SPEAKER_01: Some of it's a homegrown process, you know, managing this on spreadsheets, a lot of people power.
• 5:05
  SPEAKER_01: And then for those that you know maybe have made investments in tools, there are a number of tools that you know do part of that workflow.
• 5:14
  SPEAKER_01: You have reach attack simulation tools.
• 5:16
  SPEAKER_01: They are focused entirely on that red team type of activity, all of that attacker tradecraft and injecting that into your network and showing you kind of where it breaks down.
• 5:27
  SPEAKER_01: And then you've got communities that are sharing detection analytics that people are contributing to, and you can grab them and use them.
• 5:36
  SPEAKER_01: But there's nothing that's really tying those two together.
• 5:39
  SPEAKER_01: That's where we come in.
• 5:40
  SPEAKER_01: That's really what makes us unique is that interplay between that offensive and the defensive tradecraft.
• 5:45
  SPEAKER_01: And we can really help you determine, you know, will this detection or this hunt query that I built actually find the thing that I intended to.
• 5:58
  SPEAKER_00: Okay.
• 5:59
  SPEAKER_00: So the combination of the two is where your secret sauce is.
• 6:03
  SPEAKER_00: If I'm a CISO though, what's the pithy way to describe the problem you're solving for the CISO?
• 6:09
  SPEAKER_01: So we can kind of immediately tell you if you're covered against a threat.
• 6:13
  SPEAKER_01: So if a new threat pops in the news, a new breach, a new vulnerability gets announced, you can hop in our platform, do a quick search for it.
• 6:22
  SPEAKER_01: We're going to tell you everything we know about it, and we're going to tell you whether or not you have protections deployed in your network already.
• 6:29
  SPEAKER_01: So you can immediately get an idea of coverage.
• 6:32
  SPEAKER_01: And because we do a big mantra of ours is, you know, validated.
• 6:36
  SPEAKER_01: So everything is validated against that offensive tradecraft.
• 6:39
  SPEAKER_01: It allows you to really have confidence in the fact that yes, you've got something deployed, but it's also a high quality, robust detection analytic that you can use and rely on.
• 6:50
  SPEAKER_01: So our pitch to CISOs is really around that coverage and confidence.
• 6:55
  SPEAKER_01: So getting away from that question that keeps all the CISOs up at night is like, you know, am I going to be the next one?
• 7:01
  SPEAKER_01: Are we susceptible to this threat or this attack, this new thing that's popping up in the news?
• 7:07
  SPEAKER_01: We can help them answer that question, you know, almost immediately, and we can show them where they have gaps.
• 7:11
  SPEAKER_01: And if they have gaps, they can take some action to remediate it.
• 7:15
  SPEAKER_00: Is there a certain size of company that you'd best play in?
• 7:18
  SPEAKER_01: Right now we are definitely up in the upper echelon, you know, the Fortune 1000s, large enterprise, managed services providers, federal government, really folks who have at least one half of those teams that we're talking about.
• 7:33
  SPEAKER_01: So, you know, you have to have people who are managing your detections, or you have to have people who are focused on the attacks.
• 7:40
  SPEAKER_01: We can augment in some capacity, but you know, having that maturity really helps.
• 7:44
  SPEAKER_00: Yeah, I'm wondering what the number of companies that actually have the red team aspect as well as the blue team already in their headcant.
• 7:54
  SPEAKER_01: Yeah, the red team, so you know, we love to refer to them as cyber ninjas, the folks that can kind of do it all.
• 7:59
  SPEAKER_01: The red teamers are definitely much fewer in this world.
• 8:03
  SPEAKER_01: The way that we approach red team is, you know, oftentimes red teamers are structuring an attack or injecting a particular exploit that they can push into the network.
• 8:16
  SPEAKER_01: And they're doing that, you know, over and over and over again.
• 8:18
  SPEAKER_01: And the way that we approach that problem is we say, hey, you can do that once, and we're gonna capture all of the information, all of the keystrokes, all of the telemetry, all of the data that gets generated.
• 8:31
  SPEAKER_01: We're gonna put that on a shelf.
• 8:33
  SPEAKER_01: And now, once it's on the shelf inside Snap Attack, anybody who has access to Snap Attack can leverage that thing that's on the shelf and use it to inform their defensive posture.
• 8:43
  SPEAKER_01: So ours is a write once, run many, hunt many, use many kind of model.
• 8:49
  SPEAKER_01: We also have a community edition as well.
• 8:52
  SPEAKER_01: So we do have content that any user can log in and either add to the platform or consume from the platform.
• 8:58
  SPEAKER_01: And that all works to you know help that problem of not having enough red teamers.
• 9:03
  SPEAKER_01: So if you've got an independent security researcher or something like that who's really good at what they do, but maybe they're not associated with a company, they could hop in and you know contribute high quality content to the platform, and then anybody can use it as it gets disseminated out.
• 9:18
  SPEAKER_00: Got it, got it.
• 9:19
  SPEAKER_00: Well, being part of the early stage expo means that you're early stage.
• 9:22
  SPEAKER_00: I wonder what you can share with us about where you are in your journey right now.
• 9:26
  SPEAKER_01: So we're a little unique because we actually were a spin-out company.
• 9:30
  SPEAKER_01: Our company was officially formed this past November, November 2021.
• 9:36
  SPEAKER_01: But the product itself was really born out of who's Allen Hamilton's work with the uh Department of Defense, the intelligence community.
• 9:44
  SPEAKER_01: They have this team called Dark Labs.
• 9:46
  SPEAKER_01: It's really an incubator for RD and products that they would pitch and inform their services delivery.
• 9:51
  SPEAKER_01: And this started there and it really helped to inform those threat hunt services.
• 9:56
  SPEAKER_01: And then as it got legs and it grew and it matured, they determined that it had better viability being a standalone company.
• 10:04
  SPEAKER_01: So we kind of got the benefit of having um the bootstrapping portion of the journey was within the protection of a large enterprise.
• 10:13
  SPEAKER_01: And then when we moved out, now we're in a bit of you know standing up those sales operations and executing on what our strategy is.
• 10:21
  SPEAKER_00: And are you completely separate now from Booze Allen?
• 10:24
  SPEAKER_01: Absolutely.
• 10:25
  SPEAKER_00: Okay.
• 10:26
  SPEAKER_00: And on the go-to-market side, have you started building out the sales team yet?
• 10:30
  SPEAKER_01: We have.
• 10:30
  SPEAKER_01: So we've got a CRO, chief growth officer.
• 10:33
  SPEAKER_01: And so that's I'll say the crux of the sales team.
• 10:37
  SPEAKER_01: We do focus in on our commercial customers, commercial prospects through that person.
• 10:43
  SPEAKER_01: And then federally, we are still aligned with a lot of the Booz Allen work that was being performed with the product beforehand.
• 10:50
  SPEAKER_00: Got it.
• 10:51
  SPEAKER_00: Got it.
• 10:51
  SPEAKER_00: How did you know it was the right time to bring on that first person?
• 10:55
  SPEAKER_01: It was, you know, the timing comes to the point where certain business activities are getting dropped because there's too many conversations happening.
• 11:05
  SPEAKER_01: And then the handling of those conversations were maybe not as timely as they could be, really, you know, pointing to that we needed an extra set of hands.
• 11:15
  SPEAKER_01: And uh, we chose to bring on a person in a senior role in a senior capacity to really try to give them uh more of a stake in the company and get some more skin in the game rather than going the approach of bringing on a more you know account exec or a you know junior junior salesperson.
• 11:34
  SPEAKER_01: From my perspective, my background is really in product building and in go-to-market fit.
• 11:39
  SPEAKER_01: So training up a junior salesperson was not necessarily in my bag of tricks.
• 11:45
  SPEAKER_01: So uh bringing somebody who who was knowledgeable and also you know believed in our product and wanted to wanted to join was a no-brainer.
• 11:53
  SPEAKER_01: It made sense.
• 11:55
  SPEAKER_00: Yeah, it's an interesting question, right?
• 11:56
  SPEAKER_00: Which direction do you go?
• 11:57
  SPEAKER_00: I talk to people that go both directions, right?
• 12:00
  SPEAKER_00: They'll you know choose either of those.
• 12:01
  SPEAKER_00: I guess the the thing that puts them off going with the the leader first is is that person really willing to roll their sleeves up and go out there and basically be a salesperson for a while until they could justify bringing more heads on.
• 12:16
  SPEAKER_00: It sounds like you found someone though you felt like could do that as well.
• 12:20
  SPEAKER_01: Yes.
• 12:20
  SPEAKER_01: And I will say the strategy for us going in was we wanted to find a person who wasn't solely a salesperson.
• 12:28
  SPEAKER_01: So we actually found somebody who was a cybersecurity practitioner, past life was a CISO, owned a MSSP services provider, and really had their head in the problem statement, right?
• 12:43
  SPEAKER_01: And they really understood what our value prop was.
• 12:46
  SPEAKER_01: And that really helped accelerate one, their their ramp up time, right?
• 12:51
  SPEAKER_01: They were able to basically land and understood exactly what we were trying to do.
• 12:56
  SPEAKER_01: They just had to get the messaging under their belt, then execute.
• 13:00
  SPEAKER_00: How about on the demand gen side then, when you've got someone like that, you don't have the I don't know what, the the sales DNA to pick up the phone necessarily.
• 13:09
  SPEAKER_00: You thinking about demand gen a little bit differently?
• 13:12
  SPEAKER_01: We do, we do.
• 13:13
  SPEAKER_01: We have a pretty strong board of advisors.
• 13:16
  SPEAKER_01: So we're leveraging a lot of relationships for our first set of targets.
• 13:20
  SPEAKER_01: So a lot of uh you know relationship building and relationship-driven sales.
• 13:24
  SPEAKER_01: And while we're you know kind of standing up that lead gen engine in parallel, so we fully anticipate that you know these bigger enterprise deals they do require that more of a touch, right?
• 13:37
  SPEAKER_01: We're not gonna get a customer who just like goes onto our website, clicks the buy now button, and you know, deposits a large chunk of Bitcoin or something in our account.
• 13:45
  SPEAKER_01: Like that that's not that's not gonna happen for us.
• 13:48
  SPEAKER_01: So really having that that relationship-driven approach has proven fruitful.
• 13:53
  SPEAKER_00: And when do you think you're gonna bring on the next hires in the sales team?
• 13:58
  SPEAKER_01: We're probably gonna be looking to bring somebody on in beginning a Q4 this year, depending on our traction.
• 14:05
  SPEAKER_01: Our hiring in the sales department for this year is really focused in on you know, need-based.
• 14:10
  SPEAKER_01: So, you know, hiring accounting Zec, once we get enough accounts that they need to manage and pull through the funnel, and then you know, hiring some of like the customer success side of the house once we get enough customers that we're unable to support them as the team currently sits.
• 14:24
  SPEAKER_00: Right.
• 14:25
  SPEAKER_00: Because demand demands it, as it were.
• 14:27
  SPEAKER_00: You think it's sales-led growth, or are you thinking the product is gonna lead some growth for you?
• 14:32
  SPEAKER_01: The product will definitely lead some growth.
• 14:34
  SPEAKER_01: You know, like I said, we do have the community model, and obviously in enterprise sales, freemium conversions maybe isn't something that's been you know tried and true as a slam dunk, but the product is unique and it gets a lot of people talking about it.
• 14:49
  SPEAKER_01: So getting the product in front of people seemed to be the most successful way for us to get swings at the bat or get swings at the plate and knock down some deals.
• 14:57
  SPEAKER_01: So uh that's really been our bread and butter is you know getting in front of the right people and then letting the product do the talking.
• 15:05
  SPEAKER_00: That's correct.
• 15:06
  SPEAKER_00: And who is the buyer of SnapAttack in an enterprise?
• 15:11
  SPEAKER_01: Uh it's either gonna be somebody like the CISO SOC manager, sock leader, our champions are the users, right?
• 15:17
  SPEAKER_01: The folks in the trenches who are dealing with all of the noise, a lot of the alerts and things like that, who are, you know, hands-on keyboard.
• 15:24
  SPEAKER_01: They're really the people who benefit from using this, but the buyers and the budget holders are gonna be like your sock manager, your CISO.
• 15:31
  SPEAKER_00: Okay.
• 15:32
  SPEAKER_00: And any learnings so far about profiles that just are not a fit?
• 15:36
  SPEAKER_00: I don't know, size or type of people they have, things like that.
• 15:39
  SPEAKER_01: I would say the biggest learning that we had was our original approach was a little bit technical.
• 15:45
  SPEAKER_01: And we were getting faced with, you know, hey, we're just not mature enough for you guys.
• 15:48
  SPEAKER_01: You guys are too far in front of where we are.
• 15:52
  SPEAKER_01: And a lot of it was, you know, candidly messaging.
• 15:55
  SPEAKER_01: The platform is super easy to use and you know, pretty intuitive.
• 15:59
  SPEAKER_01: So we altered our messaging a little bit, appealed to the CISO pain points a little bit better, and that you know, kind of dialed it in.
• 16:06
  SPEAKER_00: Do you remember what the messaging was before you made the change?
• 16:09
  SPEAKER_00: Just so we can compare it.
• 16:11
  SPEAKER_01: We were very heavy in you know, threat hunting and detection as code.
• 16:17
  SPEAKER_01: And we are uh our whole basis, and I didn't mention this from a technical perspective.
• 16:23
  SPEAKER_01: If you're thinking about detections in a SOC, a lot of people in the industry, they look at what's called an indicator of compromise.
• 16:30
  SPEAKER_01: And so those are things like an IP address or a domain or a file hash for a particular piece of malware.
• 16:37
  SPEAKER_01: And um those are fairly ephemeral, they're relatively easy to change.
• 16:41
  SPEAKER_01: And so you dump those into you know a block rule or an alerting rule, and you kind of hope for the best.
• 16:47
  SPEAKER_01: And then the you know, bad actor changes their approach, and your rule now misses the thing that you were trying to block.
• 16:56
  SPEAKER_01: So we move up.
• 16:57
  SPEAKER_01: There's this thing called the pyramid of pain, which really talks to uh how hard it is for a bad actor to alter something and change a behavior.
• 17:06
  SPEAKER_01: And so we go up to the top there, and that focuses on like if you're familiar with MITRE attack framework, all the TTPs, and we detect on those TTPs, or we enable detection on those TTPs, I should say.
• 17:17
  SPEAKER_01: So those are all behaviors.
• 17:19
  SPEAKER_01: And so when we're talking a lot about behaviors, if we go in headfirst and to a company that's really just standing up a threat-informed defense program, and they're you know, plugging in some threat intel feeds into their stack and they're setting blocking rules.
• 17:37
  SPEAKER_01: We come in talking this big game of, you know, hey, you got to go TTPs and behavioral and this and that.
• 17:42
  SPEAKER_01: They're like, well, we're you know, you guys are you guys are here and we're back here.
• 17:47
  SPEAKER_01: And it's not a it's not a bad thing, right?
• 17:49
  SPEAKER_01: You like our perspective is you need both to have a really successful depth in your defense.
• 17:56
  SPEAKER_01: But we were expecting them to make that mental leap themselves and really bringing them on that journey, you know, at the end of the day, it's all storytelling, right?
• 18:04
  SPEAKER_01: And being able to tell our story as to why we're important and better and can help solve a problem, that really paid off.
• 18:12
  SPEAKER_00: I love the fact that you had those conversations though with the prospects to be able to understand there was that disconnect.
• 18:20
  SPEAKER_00: And as you say, it can be solved with describing things differently, as opposed to having to somehow re-engineer the product most times.
• 18:27
  SPEAKER_00: It's just you're asking someone to take a big leap, you know, what's the small leap?
• 18:31
  SPEAKER_00: What's the fourth step they can take to get going?
• 18:34
  SPEAKER_01: Exactly.
• 18:34
  SPEAKER_01: I would say we tended to talk to, you know, hey, you can create all of this red team content and you could create all this blue team content.
• 18:43
  SPEAKER_01: And we weren't doing justice to the fact that we have this massive library of content that you can just use.
• 18:49
  unknown: Right.
• 18:50
  SPEAKER_01: And that's a very different value proposition.
• 18:53
  SPEAKER_01: You know, we like to say that we can color your team purple regardless of where they are.
• 18:58
  SPEAKER_01: So if you have a team that you know leans more on the defensive side and the detection side, blue team, we can color them purple by taking all of our red content.
• 19:08
  SPEAKER_01: So our messaging shifted much more into you know driving that efficiency that's scalable and driving that confidence and coverage, and then also enabling that collaboration and then rounding it out with just you know a fully integrated tool that can plug into your security stack that you currently have.
• 19:27
  SPEAKER_01: So it was very much around, you know, can can we help you get more out of the tools you have and more out of the people that you have by leveraging content that either we create or our partners create or the community creates or other customers are choosing to uh contribute back into the platform.
• 19:47
  SPEAKER_01: So it's really much a rising tides kind of play for us when it comes to that content.
• 19:52
  SPEAKER_01: And that lowers the barrier to entry for many, many organizations.
• 19:57
  SPEAKER_00: Yeah, and I bet by the same token, you've got the companies or the organizations that are further down the road, and they've got people who do want to create their own attacks and defense packages or whatever, right?
• 20:08
  SPEAKER_00: And I don't know if they would even do this, but they might look down a little bit on the library, I don't know, but but they certainly like their own stuff, right?
• 20:15
  SPEAKER_01: For sure.
• 20:15
  SPEAKER_01: Absolutely.
• 20:16
  SPEAKER_01: And some people love to queue up their own stuff.
• 20:19
  SPEAKER_01: There's, you know, there's definitely something to be said for emulating those attacks in an environment that you know most closely mirrors the environment that you're in as an infrastructure, you know, and and making sure that the telemetry kind of matches as close as possible.
• 20:35
  SPEAKER_01: A lot of folks do that.
• 20:36
  SPEAKER_01: And we do have some interesting use cases though, around anytime you create an attack and push it into our platform, and conversely, anytime you create an analytic and push that into the platform, we run these scripts that bang them all against each other, and we do a little bit of machine learning type algorithms to rank how well those things are performing.
• 20:58
  SPEAKER_01: And so if you put a new attack in the environment, even if it's something that you created yourself, we're going to immediately tell you, okay, these are the detections that hit on the attack, and these are the ones that have low false positive counts, and these are the ones that maybe are very noisy, and here's a critical piece of malicious activity that was in that attack that didn't get detected.
• 21:17
  SPEAKER_01: Maybe you want to create a detection.
• 21:19
  SPEAKER_01: And then conversely, when you create a detection, we run it against all of our attacks and we say, hey, this one detection has coverage across 15 different attacks because a lot of attacks tend to, you know, maybe leverage the same technique at some point along in their kill chain.
• 21:34
  SPEAKER_00: Got it.
• 21:35
  SPEAKER_00: And as you're thinking about the next few years, Peter, and where Snap attack, but also maybe the market is going to go, what are the big themes that you're thinking about right now?
• 21:45
  SPEAKER_01: So for us, it's really around how do we enable as many companies as possible to switch to a threat-informed posture.
• 21:54
  SPEAKER_01: So that's a big theme that you're going to hear.
• 21:57
  SPEAKER_01: And another common theme that's happening in the world is also collective defense.
• 22:01
  SPEAKER_01: And so the two ideas there are threat informed is if you kind of know thy enemy, you can take defensive actions based on what that attack might look like and be better set for success from a defensive perspective.
• 22:16
  SPEAKER_01: And then the collective defense is a much more of a stronger together kind of message, right?
• 22:21
  SPEAKER_01: Like, how can we, as a community or an industry, get together and share information more easily and quicker and of higher quality to enable people to respond.
• 22:32
  SPEAKER_01: To new threats faster.
• 22:35
  SPEAKER_01: And so, from a theme for Snap Attack, is we're, you know, firmly believe that we're converging those two.
• 22:42
  SPEAKER_01: With our purple platform, that's really a threat-informed defense.
• 22:47
  SPEAKER_01: But then the act that it is a community-driven library really starts to speak to that collective defense.
• 22:54
  SPEAKER_01: And so we're trying to converge threat-informed with collective and strengthen everybody and kind of raise everybody's posture while we're allowing people to mature the types of things that they're looking at.
• 23:08
  SPEAKER_00: It's interesting you say on the collective defense.
• 23:11
  SPEAKER_00: I think the idea of collaboration has been around for many years in security world.
• 23:15
  SPEAKER_00: It kind of makes a lot of sense until the rubber hits the road and people are something a little bit reluctant to share too much.
• 23:21
  SPEAKER_00: And I know the ISACs have helped a lot with creating that safe zone to have that, but still I sense there's still a little bit of reluctance.
• 23:29
  SPEAKER_00: Are you seeing people leaning in now more to that than they perhaps have done in the past?
• 23:33
  SPEAKER_01: In certain ways, yes.
• 23:35
  SPEAKER_01: We're seeing much more sharing or willingness to share information that doesn't tie back to them specifically or doesn't have information or content that might expose who they are.
• 23:48
  SPEAKER_01: And, you know, some of it's a reluctance of, you know, it could be competitive advantage if you know your competitor maybe is seeing some sort of a cyber attack.
• 23:57
  SPEAKER_01: Or, you know, you could start to poke holes of like, hey, this uh this financial doesn't have good cyber hygiene, so you should you should come with us.
• 24:05
  SPEAKER_01: So, you know, it's understandable that people are reluctant to share.
• 24:08
  SPEAKER_01: What we're trying to do, especially with the TTP-based content that we have and the threat and the attack-based content, it's really kind of extrapolating the organization out of it, right?
• 24:20
  SPEAKER_01: Like an attack is an attack, is an attack.
• 24:22
  SPEAKER_01: If you're running a particular piece of malware in a sandbox, it's a piece of malware in a sandbox and you can upload it either named or unnamed.
• 24:31
  SPEAKER_01: And same thing on a detection side.
• 24:33
  SPEAKER_01: It's a behavioral detection.
• 24:34
  SPEAKER_01: We're saying, hey, look for this process spawning this DLL and flag us if that happens.
• 24:41
  SPEAKER_01: And that has nothing to do with a particulars of a network or a particular of an organization.
• 24:47
  SPEAKER_01: And again, you could publish it anonymously or named.
• 24:50
  SPEAKER_01: Where our platform shines, where we feel some of the others kind of fell down, is we now bang those two things against each other and validate that they're going to function.
• 25:00
  SPEAKER_01: And a lot of community contributed content, albeit you know very well meaning or intended, might work for the case that it was developed for, but maybe not for all cases, for all people.
• 25:13
  SPEAKER_01: So you can get a false sense of security.
• 25:15
  SPEAKER_01: If you just grab a detection out of the community library and you dump it into your network, you might say, hey, I'm protected against this threat.
• 25:23
  SPEAKER_01: But you might be protected against that threat on a Linux machine, but not on a Windows machine.
• 25:28
  SPEAKER_01: But it wasn't described that way in the community content.
• 25:31
  SPEAKER_01: And so we bang it against each other.
• 25:33
  SPEAKER_01: We'll actually show you visually, hey, this is what this is actually detecting.
• 25:38
  SPEAKER_01: And if you want to create a you know companion detection, you just clone the one that you have and tweak it, and you don't need to, you know, do any coding or anything like that.
• 25:47
  SPEAKER_00: Well, it sounds like you're really getting to the heart of what the issue is there with collaboration about trust and suitability and things like that as collaboration happens.
• 25:55
  SPEAKER_00: And also, you know, congrats on how far you've got in the journey you're on.
• 25:59
  SPEAKER_00: It seems like you're well positioned right now with RSA coming up, but also and beyond.
• 26:03
  SPEAKER_00: I'm wondering if you're hiring right now, Peter, and if you want to share any contact information if someone wants to reach out to you.
• 26:09
  SPEAKER_01: Sure.
• 26:09
  SPEAKER_01: Yeah, we're definitely hiring.
• 26:11
  SPEAKER_01: We're always looking right now.
• 26:12
  SPEAKER_01: Some key hires is a uh threat researcher that we're looking to grow our internal threat research team.
• 26:19
  SPEAKER_01: And obviously, we're always looking for good engineers, you know, React front-end engineers and back end engineers.
• 26:25
  SPEAKER_01: And then I think we talked about a couple months down the line, you know, hopefully we're going to be hiring some folks on the sales and customer facing side.
• 26:33
  SPEAKER_00: Great.
• 26:33
  SPEAKER_00: And if someone wants to get a hold of you, how do they do that?
• 26:35
  SPEAKER_01: They can hit me up, Peter at snapath.com.
• 26:39
  SPEAKER_01: Our website's www.snapattack.com.
• 26:41
  SPEAKER_01: There's a contact us button or you know, request a demo button.
• 26:45
  SPEAKER_01: It all lands and they can hit us up or join the community and they can self-service that way too, if they're just interested in taking a look.
• 26:52
  SPEAKER_00: Well, I hope uh RSA has a great success for you guys and uh also for the rest of the year.
• 26:57
  SPEAKER_01: Uh thank you.
• 26:57
  SPEAKER_01: Appreciate it.
• 26:58
  SPEAKER_01: Yeah, we're looking forward to it.
• 27:00
  SPEAKER_00: I really do enjoy these conversations with earlier stage companies, with the CEO of these companies, because they're at a unique time, right?
• 27:08
  SPEAKER_00: They're forming the product, they're forming the go-to-market, they're learning along the way about how to describe things and which parts of the market to go after.
• 27:16
  SPEAKER_00: And I got three takeaways from this conversation today.
• 27:19
  SPEAKER_00: The first one was how they learned around the product positioning when they're talking to prospects who weren't as mature, let's say, as some other ones.
• 27:28
  SPEAKER_00: So, what they learned, what I heard from Peter, was they learned that it couldn't be too much of a leap for the targets they were talking to to get to where they wanted to get to, right?
• 27:38
  SPEAKER_00: They thought it would be obvious that's where they would go.
• 27:41
  SPEAKER_00: But for many of the prospects they were talking to, it sounded like they were a little bit more immature, and therefore that seemed very daunting for them to want to get there.
• 27:49
  SPEAKER_00: So the question becomes you know, how do you fix that with positioning and how you describe the path to get there, to get to the promised land that you're articulating to them?
• 27:58
  SPEAKER_00: And that's so important.
• 27:59
  SPEAKER_00: And it sounds like that was a great learning from them early stage.
• 28:02
  SPEAKER_00: Uh the second takeaway I took was that their first hire to lead growth, lead sales, lead the go-to-market was actually someone who was super experienced in security, who's actually a former CISO, but also super experienced in terms of having his own company as well.
• 28:19
  SPEAKER_00: Now, not the usual profile where you don't get someone with it seems like not much sales experience.
• 28:25
  SPEAKER_00: But I think what Peter was saying was that because the person understands the market, understands the problem, understands the CISO persona so well, then when they do get on the phone and meet with these people, they're so compelling and they just kind of get it, right?
• 28:41
  SPEAKER_00: And as I say, it's not entirely normal to have someone with that background come in as a sales leader.
• 28:45
  SPEAKER_00: What usually happens I've seen is you have a sales leader with maybe more of a background in sales, but then you augment that with the evangelist type person who comes in, who is the farmer CISO, who wants to start working with vendors and has that level of knowledge, the network, the expertise to convey.
• 29:02
  SPEAKER_00: But it sounds like this slightly different approach is working for them.
• 29:05
  SPEAKER_00: And the third thing I took away was what he talked about towards the end there of the collected defense.
• 29:10
  SPEAKER_00: And yeah, definitely in cybersecurity, a lot of great talk has happened over the years about collaboration.
• 29:15
  SPEAKER_00: But when it really comes down to it, collaboration, when bad things are happening, seems to go by the wayside a little bit.
• 29:22
  SPEAKER_00: And uh, Peter very informed way of thinking about it, about how their collective defense is going to come to the market.
• 29:28
  SPEAKER_00: I thought that was very powerful.
• 29:29
  SPEAKER_00: So those are the three takeaways I had.
• 29:31
  SPEAKER_00: You may have had different ones, but I really enjoyed that conversation.
• 29:34
  SPEAKER_00: I wish Step Attack all the success this year and beyond the thing.