Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 129: David Hatchell, Cybersecurity sales and business leader talks industrial controls systems and operational technology

Transcript

129: David Hatchell, Cybersecurity sales and business leader talks industrial controls systems and operational technology · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:32
  SPEAKER_01: Ever heard about a branch of cybersecurity that is out with mainstream enterprise security, which has terms in it such as ICS, IoT, OT, SCADA, SIP, NURC, FERC?
• 0:46
  SPEAKER_01: This is in fact the world where critical infrastructure and control systems are protected.
• 0:52
  SPEAKER_01: It's a similar but different world, and longtime cybersecurity sales executive Dave Hatchel tells us all about it in this episode.
• 1:11
  SPEAKER_01: Welcome to the Sales Bluebird podcast, which exists because at B2B startups it's hard to get consistent traction and scale the sales team.
• 1:21
  SPEAKER_01: Sales Bluebird gives you tips, tricks, experiences, examples, inspiration, and ideas from people who know a thing or can about selling at cybersecurity startups.
• 1:32
  SPEAKER_01: I am your host, Andrew Monahan, and our guest today is Dave Hatchel, a longtime cybersecurity salesperson, sales leader, and business leader.
• 1:42
  SPEAKER_01: Dave, welcome to Sales Blueboard.
• 1:45
  SPEAKER_02: Glad to be here, Andrew.
• 1:46
  SPEAKER_02: Great to see you again, my friend.
• 1:47
  SPEAKER_02: So really looking forward to this.
• 1:49
  SPEAKER_01: Yeah, this is going to be an interesting topic.
• 1:51
  SPEAKER_01: It's not the usual, you know, subset of security that many people know about.
• 1:57
  SPEAKER_01: And for me, in fact, I kind of view myself as going back to school a little bit today because we're talking about industrial cybersecurity as opposed to enterprise or corporate mid-market security.
• 2:08
  SPEAKER_01: But Dave, before we get into the business side of all this, let's get to know the real Dave Hatchel.
• 2:14
  SPEAKER_01: No better way than having some quick fire questions for you.
• 2:17
  SPEAKER_01: On my list here are 15 questions.
• 2:21
  SPEAKER_01: Pick a number, team, one and 15, and let's get this going.
• 2:24
  SPEAKER_02: 15, wow.
• 2:25
  SPEAKER_02: Can I do all 15 in 60 seconds?
• 2:28
  SPEAKER_01: No, we'll do three.
• 2:29
  SPEAKER_01: We'll do three at this point.
• 2:31
  SPEAKER_02: Lucky sevens, babe.
• 2:32
  SPEAKER_02: Let's start.
• 2:32
  SPEAKER_02: Let's start with seven.
• 2:33
  SPEAKER_01: Seven is what's one great airport you've been to?
• 2:39
  SPEAKER_02: One great airport.
• 2:40
  SPEAKER_02: I love Frankfurt.
• 2:41
  SPEAKER_02: You know, so some people hate Frankfurt.
• 2:43
  SPEAKER_02: I love Frankfurt just from all the different complexity of it.
• 2:46
  SPEAKER_02: It's like Denver, right?
• 2:47
  SPEAKER_02: Denver, Denver and Frankfurt are very similar.
• 2:49
  SPEAKER_02: Like you either love it or you hate it.
• 2:51
  SPEAKER_02: I like it.
• 2:52
  SPEAKER_01: Frankfurt is the airport with a nightclub in the basement.
• 2:55
  SPEAKER_01: Is that right?
• 2:56
  SPEAKER_02: Yeah, exactly.
• 2:57
  SPEAKER_02: Exactly.
• 2:57
  SPEAKER_02: You got the nightclub, you got the hotel, you got the weight room, you got anything you want there.
• 3:01
  SPEAKER_02: And it's just, you know, a a mix of a mix of everybody and everything.
• 3:05
  SPEAKER_02: And that's what that's right.
• 3:06
  SPEAKER_02: I like complexity in the airports.
• 3:08
  SPEAKER_02: Like I like complexity in what we do sometimes.
• 3:10
  SPEAKER_01: I remember 20 odd years ago going to a sales kickoff in Frankfurt, and we told us that the airport hotel, and I was like, oh my god, an airport hotel.
• 3:20
  SPEAKER_01: And then we got to realize there's actually a club in the basement of the airport.
• 3:24
  SPEAKER_01: And it turned out to be a fun, fun time.
• 3:26
  SPEAKER_01: Anyway, so that's question number one.
• 3:29
  SPEAKER_01: Give me another number, T1 in 15.
• 3:31
  SPEAKER_02: Okay.
• 3:31
  SPEAKER_02: We're gonna go for nines.
• 3:34
  SPEAKER_01: Nines.
• 3:35
  SPEAKER_01: What's uh a good book or a good movie?
• 3:38
  SPEAKER_01: What do you prefer?
• 3:40
  SPEAKER_02: Well, a good book or a good movie.
• 3:41
  SPEAKER_02: I'll just say both because uh, you know, now my kids are getting our kids are getting a little older and they're getting uh interested in the cultural side of things, and so I'm getting my kids into The Godfather, and we're attending my wife's family reunion, who is uh Sicilian in background.
• 3:54
  SPEAKER_02: So we're kind of having like the you know the mafia stories and the kind of the history of the family and all that kind of thing.
• 4:01
  SPEAKER_02: So the but the book and the movie were one of the things that always influenced me of like, hey, what's it like when a big family takes care of each other?
• 4:07
  SPEAKER_02: And I think we think that a lot in sales sometimes too.
• 4:10
  SPEAKER_02: Like we there's a big group of us here who all watch out for each other and have each other's best interests.
• 4:14
  SPEAKER_02: So I think that the story's very the story's very universal.
• 4:17
  SPEAKER_01: Very good.
• 4:18
  SPEAKER_01: All right.
• 4:19
  SPEAKER_01: And last question, give me another number.
• 4:22
  SPEAKER_02: Okay, I'm going for number three.
• 4:24
  SPEAKER_01: Three is tricky Jeep or German car with all the gadgets.
• 4:30
  SPEAKER_02: Well, German car with all the gadgets if I get to drive on an Autobahn, which I've never done.
• 4:36
  SPEAKER_02: We spent too much time in the Frankfurt airports, not driving in Germany.
• 4:39
  SPEAKER_02: So I'm going for the German car all the way.
• 4:42
  SPEAKER_01: Fair enough.
• 4:43
  SPEAKER_01: Uh like that.
• 4:44
  SPEAKER_01: All right, well, let's get down to business.
• 4:45
  SPEAKER_01: So this is a discussion about a whole aspect of security that, you know, if I'm honest with myself, I I've heard the terms, understand probably a lot less than I let on to people I did, but it's all around industrial cybersecurity.
• 4:59
  SPEAKER_01: And Dave, you've you spent many years now in that whole world of what it's all about.
• 5:04
  SPEAKER_01: You you were originally doing enterprise, traditional enterprise sales, but made the switch over to industrial cybersecurity.
• 5:10
  SPEAKER_01: Why did you make that switch?
• 5:12
  SPEAKER_02: Well, it was really interesting.
• 5:14
  SPEAKER_02: This is going back about 12 years ago where I was over at a company and our CEO had attended the Davos World Economic Forum and was really convinced it was an opportunity to put endpoint security on smart meters, right?
• 5:23
  SPEAKER_02: We could have millions of these devices, and like, and so you know, how do we monetize?
• 5:28
  SPEAKER_02: We can monetize endpoint on millions of these things.
• 5:30
  SPEAKER_02: And we really started looking at the problem along with the chief revenue officer and uh around what it was, and really uh came to the conclusion around this industrial control system problem, you know, which is really you know, it's a very vertical problem, but it's also very horizontal in terms of the way manufacturing, energy, utilities all do it.
• 5:45
  SPEAKER_02: But it's different applications, different products.
• 5:48
  SPEAKER_02: And and so, you know, then it became stuck's neb and some of the other attacks we saw, which really kind of germinated a lot of the interest in it.
• 5:55
  SPEAKER_02: And so, you know, it's just I think, Andrew, I've always been lucky in my career that I've been able to do really cool and fun stuff.
• 6:01
  SPEAKER_02: And I think security has been one of those fascinating fields that you and I have enjoyed for the past 20 years.
• 6:05
  SPEAKER_02: But you know, going prior to that, I was very lucky to have done the first sales deal and the first MP3 player that ever existed, right?
• 6:12
  SPEAKER_02: And the first consumer CD-ROM game.
• 6:14
  SPEAKER_02: And so I've always been involved with some really interesting and unique technologies and approaches.
• 6:20
  SPEAKER_02: And the this the problem around this appealed to me of how we approach a very vertical problem, how we kind of get deeper into business value, into you know, kind of how customers are running their business and how we protect that end.
• 6:31
  SPEAKER_02: It's fine to sell the IT side, but you're selling the stuff that runs their business, it's a whole different problem.
• 6:35
  SPEAKER_02: So that's really what got it got me into it.
• 6:37
  SPEAKER_01: Yeah.
• 6:38
  SPEAKER_01: So let's define then a little bit.
• 6:40
  SPEAKER_01: You know, in the traditional world, we're working with corporate infrastructure, corporate IT, maybe mid-market as well.
• 6:46
  SPEAKER_01: And it's you know, the things we talk about, things in the cloud, things on-prem, and all the rest of it.
• 6:51
  SPEAKER_01: So, what exactly is different?
• 6:54
  SPEAKER_01: Where are these protections, controls placed?
• 6:57
  SPEAKER_01: What sort of, I don't know, is it machines?
• 7:00
  SPEAKER_01: Is it big systems that's protecting?
• 7:02
  SPEAKER_01: Give us a sense of really what the difference is.
• 7:04
  SPEAKER_02: Yeah, I think you kind of have to define the, you know, the problem by what you're talking about, right?
• 7:08
  SPEAKER_02: So essentially the nomenclature around it.
• 7:10
  SPEAKER_02: When we talk like industrial control systems, ICS, OT, operational technology, all these are things kind of referring to, as I said, the business end of the stick, you know, that's you know, running the production of a manufacturing line, you know, protecting nuclear power plant, upstream operations extracting oil out of the Mideast, those things, right?
• 7:29
  SPEAKER_02: So that's essentially what we call industrial control systems, right?
• 7:31
  SPEAKER_02: So that's kind of the protection you call it critical infrastructure protection.
• 7:35
  SPEAKER_02: There's a lot of things you can kind of use there.
• 7:37
  SPEAKER_02: Then there's kind of this IoT problem, which is essentially you've got unmanaged devices on your enterprise network, and saying, look, I've got this whole dark side of my, I'm a healthcare operator, I've got a clinical network that's operating MRIs and patient bed stations, et cetera.
• 7:51
  SPEAKER_02: But then I've got all these other devices that are on the network, which are unmanaged and you know, vectors of attack, right?
• 7:57
  SPEAKER_02: The target problem is we solve with HVAC contractors and so forth.
• 8:00
  SPEAKER_02: So I kind of put that in the IoT bucket of like the CISO is responsible for this, they need to do something about it.
• 8:06
  SPEAKER_02: But the OT problem or the ICS problem is a little different because you're impacting availability by introducing security into this problem, right?
• 8:13
  SPEAKER_02: So if I put if I go put an endpoint security agent on a machine that's running a process and that machine stops the process, you've got problems.
• 8:21
  SPEAKER_02: And so it's just a it's kind of a it's a different culture, it's kind of a different buyer because you're kind of interoperating with, you know, essentially the person who's running the plant.
• 8:30
  SPEAKER_02: So that person with the plant doesn't want to inject anything into the process that would impact availability.
• 8:35
  SPEAKER_02: Different nomenclature, you know, a lot of other things we'll kind of discuss here over time.
• 8:39
  SPEAKER_02: That's fundamentally just the the differences in the approach in kind of markets.
• 8:43
  SPEAKER_02: Obviously, there's consumer IoT with yeah, we secure things in PKI with like you know, smart homes and so forth.
• 8:49
  SPEAKER_02: There's companies kind of going after that space, but that's kind of not really in the traditional enterprise problem that we see.
• 8:56
  SPEAKER_02: But there's definitely people going after that space as well.
• 8:59
  SPEAKER_01: Okay.
• 8:59
  SPEAKER_01: So it's this whole other world outside of enterprise IT, but I mean, why is it so different?
• 9:05
  SPEAKER_01: Is it not just the same technology but in different devices that has the same level of you know technology controls, or or is it not?
• 9:13
  SPEAKER_01: It's a whole different paradigm about how you go about doing that.
• 9:15
  SPEAKER_02: Well, it's a similar paradigm to what we face in security, where we kind of just think, you know, visibility is everything, right?
• 9:21
  SPEAKER_02: So you can't manage what you can't see.
• 9:23
  SPEAKER_02: And so traditionally these networks have been closed, or there's been no access into them.
• 9:28
  SPEAKER_02: And so that's kind of there's one element of now these are being connected.
• 9:31
  SPEAKER_02: And so essentially the problem you have of what we call IoT is that you've got like a G or Siemens or Honeywell that's trying to kind of get access into these networks, they can kind of tell you, hey, your turbine is going to fail based on my algorithms at this level.
• 9:46
  SPEAKER_02: And so there's a need for connectivity into these, right, into these areas.
• 9:49
  SPEAKER_02: And with those connectivities, now there's a need to secure them.
• 9:53
  SPEAKER_02: And so the challenge is that you can kind of get access into the basic level, you call these Windows machines that kind of operate the plant.
• 10:00
  SPEAKER_02: But then there's a whole host of other embedded devices that are down there that are essentially running the operations, uh, things like program uh PLCs, programmable logic controllers, our remote terminal units, et cetera, whole mishmash of other things.
• 10:13
  SPEAKER_02: And so the CISO is kind of charged with getting visibility in this area and say, where do I start?
• 10:18
  SPEAKER_02: First thing I've got to do is have my plant team be able to talk to me and to say I'm not gonna introduce anything that's gonna impact availability.
• 10:24
  SPEAKER_02: And so taking basic approaches in visibility, like, hey, I can hang something off a span port and look at traffic, but then I gotta I've got to understand that proprietary traffic of what that device is.
• 10:34
  SPEAKER_02: It's not an IT protocol, right?
• 10:36
  SPEAKER_02: It's not an IT system.
• 10:38
  SPEAKER_02: And so there's this whole host of the various companies out there, Clarity, Nazomie, Dragus, Armis, et cetera, all of which are doing a really good job of trying to understand the visibility problem.
• 10:47
  SPEAKER_02: And then obviously the what I've got and then what's vulnerable, right?
• 10:51
  SPEAKER_02: What's next, right?
• 10:52
  SPEAKER_02: What are the associated vulnerabilities in those environments?
• 10:55
  SPEAKER_01: So even though it's not traditional IT, the CISO still still rolls up to them, usually, is that right?
• 11:01
  SPEAKER_02: Well, yeah, it depends.
• 11:02
  SPEAKER_02: Over the past 10, 12 years I've been doing this.
• 11:05
  SPEAKER_02: It's been a shared responsibility.
• 11:07
  SPEAKER_02: Sometimes the plant has driven all the technology decisions in this area.
• 11:10
  SPEAKER_02: That's changing because the board level is saying, look, I've got to have somebody that's responsible for this.
• 11:15
  SPEAKER_02: There's been major attacks, be it ransomware, that's saying, hey, shut down plant lines to nation-state targeted attacks, as we've seen kind of enumerated in the past few weeks, which I'll get to later.
• 11:24
  SPEAKER_02: The CISO and the CIO are being held accountable, uh, is ultimately where it's kind of come from.
• 11:29
  SPEAKER_02: But that depends also by verticals.
• 11:30
  SPEAKER_02: Sometimes there's compliance and regulations that are kind of coming out.
• 11:34
  SPEAKER_02: We think of in North America and utilities.
• 11:36
  SPEAKER_02: There's NERC SIP, which is a popular regulation that kind of mandates some security controls.
• 11:41
  SPEAKER_02: Uh so yeah, there's a whole variety of verticals and sector-specific problems that you're dealing with.
• 11:48
  SPEAKER_02: But in general, the responsibility is switching over the CISO and the C out.
• 11:51
  SPEAKER_01: Okay.
• 11:52
  SPEAKER_01: So same but different then, right?
• 11:55
  SPEAKER_01: It's the same sort of ideas, principles behind it, but actually how you go about getting the visibility and protecting the systems gonna be using different ways, different protocols, different OSs to go do that.
• 12:07
  SPEAKER_01: So if I'm a rep at a cybersecurity company, am I right in saying there's a fair chance that my stuff probably doesn't naturally work in right in the depths of the critical infrastructure?
• 12:19
  SPEAKER_01: It might maybe on the control side, but maybe not actually inside the depths of that world.
• 12:23
  SPEAKER_01: Is that fair?
• 12:24
  SPEAKER_02: Yeah, that's fair.
• 12:25
  SPEAKER_02: If you're an IT-based security company and you've kind of had that pedigree, the large security companies we all know, it's generally been some adaptation to get your product into those areas.
• 12:35
  SPEAKER_02: And so you can do things like traditional firewalls and segmentation between your IT and your plant, but to really have the context and understand all these vertical systems is a large problem.
• 12:45
  SPEAKER_02: And so you're seeing a lot of kind of you know startups kind of pop up to address some of these vertical-specific challenges, right?
• 12:51
  SPEAKER_02: So there's one specific for medicals, there's some specific for transportation, there's some like Armists that are going kind of cross-vertical around the problem.
• 12:58
  SPEAKER_02: And so, so in general, as a sales rep, the first thing I try to encourage people to do is really sit and talk and understand their customer and understand the relationship with the people who are operating the plant, right?
• 13:10
  SPEAKER_02: Is that something where they're they're okay with putting in security there?
• 13:14
  SPEAKER_02: Right?
• 13:15
  SPEAKER_02: Do they have a relationship of friction, right?
• 13:17
  SPEAKER_02: Where essentially the plant people saying, You can't touch, don't touch my systems, right?
• 13:21
  SPEAKER_02: But a lot of times the plant people will say, Look, you want to put endpoint security on my Windows machine, but I don't buy from you, I buy from Honeywell or Siemens or GE.
• 13:30
  SPEAKER_02: And so it's got to be certified and interoperated with that system so I make sure that I don't impact availability.
• 13:36
  SPEAKER_02: So the first thing I try to encourage sales reps to do in understanding their market is you know, understanding that relationship, understanding the business drivers and saying, hey, is a Ciso and CO responsible for this?
• 13:46
  SPEAKER_02: Are they knowledgeable, educated, mature on their processes to do it?
• 13:50
  SPEAKER_02: Who are the partners that are the you're going to use to do around it, right?
• 13:54
  SPEAKER_02: So those types of things to really understand how big a problem versus the other 20 things they're trying to do in cybersecurity is.
• 14:01
  SPEAKER_02: And a lot of times this is on top of their list, and it's a lot of times they want you as a vendor to solve, or at least a system with a key IT vendor, or at least have a strategy.
• 14:11
  SPEAKER_01: And you you've given examples so far, such as the manufacturing production line.
• 14:15
  SPEAKER_01: You've talked about power stations, grid, oil distribution and pumping and things like that.
• 14:22
  SPEAKER_01: Yeah, this is this is a little bit more than you know a few people's laptops, right?
• 14:27
  SPEAKER_01: What's the implications if these things don't go well?
• 14:31
  SPEAKER_01: And who who is it that's going after it?
• 14:33
  SPEAKER_01: Is it is it ransomware or is it nation states?
• 14:35
  SPEAKER_01: Who's who's really attacking this infrastructure?
• 14:38
  SPEAKER_02: It's been a little bit of both.
• 14:39
  SPEAKER_02: I mean, certainly we've seen you know ransomware and other things kind of proliferate from the IT infrastructure into the OT infrastructure, either accidentally, where the the actor essentially had an understanding of the tradecraft necessary to penetrate that system, right?
• 14:54
  SPEAKER_02: But what you're seeing is this has been more evidenced by the whole you know past few weeks and past few months of the Russia-Ukraine conflict, is that a lot of the we'll say the kind of intersection of cyber and kinetic activity, of like how you can actually shut down an impact, you know, a plant or impact something like Stuxnet, which essentially did, you know, essentially shut down a nuclear reactor and centrifuge, right, through a cyber attack.
• 15:18
  SPEAKER_02: Or with the Russia Russia-Ukraine attack, where Russia actually had some knowledge, was able to infiltrate the Ukraine grid and shut down the transformers that are kind of running the substations and simultaneously disrupt the phone lines.
• 15:31
  SPEAKER_02: So essentially the outage couldn't be reported.
• 15:33
  SPEAKER_02: So there's some knowledge and some tradecraft out there, which is coming out a lot because of this nation-state conflict.
• 15:39
  SPEAKER_02: And so a lot of the customers out there are concerned with both, right?
• 15:43
  SPEAKER_02: Like how do I mitigate my ransomware and unintentional impact into the control system?
• 15:47
  SPEAKER_02: But how am I kind of threat hunting against this whole nation-state problem that I potentially have with adversaries trying to kind of probe the grid?
• 15:54
  SPEAKER_02: And I mean, it's it's not just grid, it's not oil, it's the it's also things that are just sheer safety.
• 16:00
  SPEAKER_02: Yeah, actually, who I consider one of the more advanced companies in this area is a certain theme park operator, an entertainment company, essentially protecting their rides, right?
• 16:09
  SPEAKER_02: The rides we go do with our kids and say, hey, my PLCs are locked down and protected, so there's no way anybody can hack into this.
• 16:17
  SPEAKER_02: The loss of life and safety impact is a huge one for me.
• 16:20
  SPEAKER_02: And so they're advanced, quite more frankly, than some of these uh some of the oil and gas companies I talked to, right?
• 16:26
  SPEAKER_02: So uh so it really depends on you know the industry and the problem.
• 16:29
  SPEAKER_02: But in general, you're seeing two kind of two drivers that are you know kind of predominantly driving the threat piece.
• 16:36
  SPEAKER_02: And then the other piece is really just from the connectivity area of like, hey, my manufacturer's coming in trying to deliver this connected service.
• 16:42
  SPEAKER_02: So how do you know what do I do with this?
• 16:44
  SPEAKER_02: So then you kind of you know kind of bring in your cloud people who are trying to kind of deal with the digital transformation of their business, and so you're kind of hitting another buyer set of like how the the company's operating as a whole.
• 16:57
  SPEAKER_01: And when you look at the the two sides of the fence, I mean, uh would you say that on the on the ICS OT side, it's just as attacked or or gone after as it is on the corporate side, but we maybe just don't hear about it, or is it less or more?
• 17:15
  SPEAKER_02: Well, I can't really say it was less or more.
• 17:17
  SPEAKER_02: I think it's I think more what you've seen over the past few months, right, is more the Biden administration started to kind of release some of the knowledge that we've kind of all been seeing in the industry, which is yes, there have been these attacks.
• 17:29
  SPEAKER_02: You know, there have been Russia and other countries kind of doing this.
• 17:32
  SPEAKER_02: And so there was a recent attack kind of called Pipe Dream, which was uh announced about uh April, I believe, about a month ago, where a nation-state adversary was able to kind of attack at that lowest level, right?
• 17:44
  SPEAKER_02: Essentially, like, hey, I'm I'm on the ground, I'm I'm on a uh penetrating in from a Windows environment into the PLCs is essentially operating the plant.
• 17:51
  SPEAKER_02: I can then go laterally in that environment and understand the different protocols and systems that are beneath it, right?
• 17:58
  SPEAKER_02: And so that is uh a huge watershed moment, I think, in the industry where we've seen that level of attack and that that's been publicized and people understanding, you know, and thinking of how to defend against it.
• 18:09
  SPEAKER_02: And so thinking beyond the problem of where we just look at it of visibility, right?
• 18:13
  SPEAKER_02: Say, great, I now know all where my assets are, I now some basic vulnerabilities, but as an industry, we're starting to think of like how do we protect and defend against that, right?
• 18:22
  SPEAKER_02: And so so I think you're starting to see a lot more of that become public, and obviously beyond just the geopolitical tensions of you know what could happen, I think we're starting to see some tangible output of actual tradecraft that that does make sense that we need to fight against.
• 18:39
  SPEAKER_01: Interesting.
• 18:40
  SPEAKER_01: One of the things that I hear in the work that I do with with early stage companies is when they get to a certain size, I don't know whether it's Series B or C, you know, they're looking for additional revenue streams for the technology that they've they've built up.
• 18:53
  SPEAKER_01: And one of the natural areas is is with what we have, does it have a role to play inside that market and what would it take to get in there?
• 19:03
  SPEAKER_01: Do you think that's a a good conversation for people to have and to think about?
• 19:07
  SPEAKER_01: Are people having it in a very thoughtful way right now?
• 19:10
  SPEAKER_02: In terms of trying to expand their business into you know to this area and say, hey, I've got a I've got a denny now, we go zero trust into ICS or OT.
• 19:19
  SPEAKER_02: Absolutely.
• 19:20
  SPEAKER_02: I mean, I think there's, you know, kind of what you're seeing right now is, you know, just kind of across the board, you know, say cloud service providers, right?
• 19:28
  SPEAKER_02: They're saying, look, I've got this whole massive growth area of getting in cloud services into things like ICS and OT that were never there.
• 19:36
  SPEAKER_02: And so the Deloitte's and the Accentures are people like, look, I've tapped out on my security business.
• 19:41
  SPEAKER_02: This is a growth area that I need to address.
• 19:43
  SPEAKER_02: It's the top growth area I need to address.
• 19:45
  SPEAKER_02: The Fortinet CEO went out uh this week and said, look, I consider OT and ICS a bigger opportunity than ICS D-WAN, right?
• 19:53
  SPEAKER_02: So I think there's a lot of interest in the space, and I think there's a lot of people, obviously, this is a very it kind of conjures up unique emotional problem, right?
• 20:01
  SPEAKER_02: Which essentially you're doing something to save the country, and you know, there's some this great god guns and apple pie, you know, kind of satisfaction you get at doing this that makes CEOs and others want to just say, look, we've got to be in this business, so what do we do?
• 20:15
  SPEAKER_02: And yeah, I've I've been through this many times in my career where I've been with a very excited CEO who wants to develop a plan, wants to go do it immediately.
• 20:23
  SPEAKER_02: But the you know, the kind of vertical calculus that's kind of necessary to go at this systematically, understand these markets, understand the unique areas, and target your product and positioning to that in partnerships, you know, takes a while, right?
• 20:37
  SPEAKER_02: So enter carefully, you know, and we can kind of get some of the strategies and so forth later, but but yeah, it's definitely a growth area and a hot market, and everybody's trying to kind of tap into it.
• 20:47
  SPEAKER_02: And I think there's some really good opportunities right now for companies to kind of position themselves there.
• 20:52
  SPEAKER_01: Well, let's do it now then.
• 20:53
  SPEAKER_01: Let's put ourselves in the shoes of a Series C CEO, let's say.
• 20:58
  SPEAKER_01: Yeah.
• 20:58
  SPEAKER_01: What are the things that they should be thinking about when they're saying is this something that we invest in or or don't invest in?
• 21:04
  SPEAKER_02: Yeah.
• 21:05
  SPEAKER_02: Well, I think just a matter of it, is this a natural vertical fit to other verticals they're in, right?
• 21:11
  SPEAKER_02: So if I'm solving, for example, healthcare problems, right?
• 21:14
  SPEAKER_02: If I get a strong healthcare practice on the IT side, going after the medical devices of the clinical side is a really natural adjunct.
• 21:21
  SPEAKER_02: And so then sitting there saying, okay, so what's the ecosystem that I need to really support this?
• 21:26
  SPEAKER_02: Because now you're, you know, it's understanding the buyer, right?
• 21:29
  SPEAKER_02: Uh saying, hey, now I'm dealing with a different buyer.
• 21:31
  SPEAKER_02: So the clinical buyer is actually kind of running the clinical operations.
• 21:35
  SPEAKER_02: And so, as I said, Hayes' ecosystem is GE, Siemens, you know, Phillips, et cetera.
• 21:40
  SPEAKER_02: And so can you target your product and service to that, to those areas, right?
• 21:45
  SPEAKER_02: And so if it's a natural adjunct to some of the verticals you're serving, you always say yes.
• 21:49
  SPEAKER_02: If this is truly a diversification play where you kind of have to look at, I've got to change my product, you know, I've got to change my market, right?
• 21:57
  SPEAKER_02: I have, I have essentially what's a horizontal problem, and now I'm trying to entering a market which is you know largely a vertical problem.
• 22:04
  SPEAKER_02: Or do I have something, and I'll use a good example of like SBOM, a software bill of materials and things like we saw after Log4J and so forth.
• 22:12
  SPEAKER_02: It's really a universal problem of what software components I have.
• 22:15
  SPEAKER_02: If you're an end user that you need to know about from a vulnerability perspective, or if you're a product security lead, you're gonna need to know about from the components you ship out the door.
• 22:24
  SPEAKER_02: That's truly a horizontal problem.
• 22:26
  SPEAKER_02: That could be very vertically focused.
• 22:28
  SPEAKER_02: And I'm advising the company right now that's that's doing this right now.
• 22:32
  SPEAKER_02: But it's good that it's looking at the S-BOM and also the embedded firmware that's kind of behind this.
• 22:36
  SPEAKER_02: And so I think there's things that are, you know, kind of a horizontal problem that can be quickly applied vertically with a limited amount of context in a few, you know, kind of good mix of product positioning and partnerships, right?
• 22:46
  SPEAKER_02: So it's kind of one third, one third, one third.
• 22:48
  SPEAKER_02: You need some different partnerships than you're kind of used to doing in the space.
• 22:52
  SPEAKER_02: You need a little bit of a different positioning, and you know, the product needs to be, you know, equally fitting the market need.
• 22:59
  SPEAKER_01: And you brought up partnerships now two, three times.
• 23:01
  SPEAKER_01: So I'm sensing that there are those big players who do they control the devices and the infrastructures that these are in, and therefore that's the route through.
• 23:11
  SPEAKER_01: Is that what it's about?
• 23:12
  SPEAKER_02: Yeah, I mean, I think the the partnerships in this are really interesting space because you take like a Siemens or G or Honeywell or whomever, right?
• 23:21
  SPEAKER_02: So you're they're trying to kind of build their own security practice, right?
• 23:24
  SPEAKER_02: Essentially, they want to be able to manage their customers because they you know, they're like, hey, we want to manage the security operations of the customers that are then running the rock the Rockwell or Honeywell systems in the plant, right?
• 23:36
  SPEAKER_02: So essentially they're a channel.
• 23:38
  SPEAKER_02: They're also positioning of like, hey, if you're in a vertical, if you're trying to kind of position in a vertical, say, look, I want to be in healthcare, so I want a partnership with GE that gives me the credibility to address customers in the space.
• 23:48
  SPEAKER_02: But the other important thing is they're also product development, right?
• 23:51
  SPEAKER_02: So essentially the whole problem of what we're seeing in this visibility area is all these different manufacturers have different protocols, different kind of applications of the system where your product needs to understand how to decode that in order to return the visibility or return the detection and response to get there.
• 24:07
  SPEAKER_02: And so it's really those three things that you have to look at and say, Am I expecting the partnership to be you know a go-to-market channel?
• 24:15
  SPEAKER_02: Am I expecting it to be kind of a certification where, like, if I'm an endpoint security company, I want to make sure that I test and validate with a Honeywell or a GE so I don't break their systems, but yet my sales channel is something different.
• 24:26
  SPEAKER_02: And so then, you know, from a product requirement stand, it's like, okay, how do I understand the unique systems they have?
• 24:32
  SPEAKER_02: And essentially, what uh this is this is not a space where you just walk into a national lab and you've got every single control system from manufacturing to rides and safety and go develop a product, right?
• 24:44
  SPEAKER_02: The the devil's in the details of these individual verticals and individual manufacturers and kind of the understanding of it.
• 24:50
  SPEAKER_02: So it's kind of aligning your product and partnerships and positioning kind of around those three.
• 24:55
  SPEAKER_02: It's like what do you want out of these partnerships that then kind of gives you the return that you need.
• 25:00
  SPEAKER_01: So from a CEO's perspective, the the natural expansion is into verticals they're already in, as it were.
• 25:06
  SPEAKER_01: So more use cases, different use cases in verticals in which we play, we can understand a little bit.
• 25:12
  SPEAKER_01: We might even have a role to play already, if if only tangentially in the overall protection of that vertical.
• 25:19
  SPEAKER_01: But then you have to think about the product fit, right?
• 25:21
  SPEAKER_01: Yes.
• 25:22
  SPEAKER_01: What is unique about the OS firmware environment in which we need to operate and who controls those systems?
• 25:29
  SPEAKER_01: Because I'm gonna guess that Honeywell doesn't like people coming in and installing stuff all over all over their systems, right?
• 25:36
  SPEAKER_02: Yeah, it's understanding does the does the manufacturer want to monetize the relationship, right?
• 25:41
  SPEAKER_02: Do they want to own and do that?
• 25:42
  SPEAKER_02: Or is there another provider that you know is more capable of doing it?
• 25:46
  SPEAKER_02: Did it be trust you know, a Honeywell or Siemens, or do you is it gonna be like a NTT or Kadelski or whomever that's kind of managing it?
• 25:54
  SPEAKER_02: And the answer kind of depends on the verticals.
• 25:56
  SPEAKER_02: I think there's a real big debate in the industry, and I know you've had a gentleman from the managed service industry in in the past on your podcast, but managed service providers are looking at this saying, look, we want to expand and kind of manage this OT environment, but developing the templates and the playbooks and the understanding of the systems is very different than the IT side.
• 26:14
  SPEAKER_02: And so, you know, is a customer gonna kind of trust you know their manufacturer, or they're gonna trust a security provider to do this?
• 26:22
  SPEAKER_02: And so it kind of depends.
• 26:24
  SPEAKER_01: And would someone then basically want to white label what you have then and then have it uh under their on their price books and everything?
• 26:30
  SPEAKER_02: Oh, absolutely.
• 26:31
  SPEAKER_02: Yeah.
• 26:31
  SPEAKER_02: I mean, I think a lot of what I've been successful in doing is building these these channels, these alternate channels with the automation manufacturers that do want to do this, they do want to monetize the relationships.
• 26:41
  SPEAKER_02: Actually, the very first, you know, after Stuxnet, this is going back about 10 years ago, Siemens came across the pond and we had a conversation around their problem of how they saw the world and how they wanted to manage product security after Stuxnet, but also how they wanted to have this security plus IoT services to deliver the results to their customers, right?
• 26:59
  SPEAKER_02: They they wanted all that to be one.
• 27:00
  SPEAKER_02: And so we built a strategic partnership to address that together.
• 27:03
  SPEAKER_02: And I think that was a real eye-opening experience for me where I saw this is this is what needs to be done.
• 27:09
  SPEAKER_02: And essentially, as a security professional, kind of developing this alternate channel and understanding it, understanding how their buyer thinks about security and to what extent that they want to kind of you know buy it, consume it, manage it, et cetera, right, is a is a very important part of this this industry.
• 27:27
  SPEAKER_01: Just as you were talking, something kind of sprang to mind, and I'll be interested to get your reaction to this.
• 27:32
  SPEAKER_01: You know, if you look at startups in general, but certainly in our space, you know, they they get going because they've got a good idea, they develop an MVP, they start doing the design partner validation and maybe get some installs somewhere.
• 27:45
  SPEAKER_01: And they start small and dirty, right?
• 27:47
  SPEAKER_01: How do we get going to get something going?
• 27:49
  SPEAKER_01: It feels to me like in the industrial side, that's probably not the best option.
• 27:54
  SPEAKER_01: You probably have to have something more substantial to be able to work with these partners within even the one I taught to you, I guess.
• 28:00
  SPEAKER_01: Am I right?
• 28:00
  SPEAKER_01: Or is there still room for the kind of gorilla let's get going in a very small and dirty way?
• 28:06
  SPEAKER_02: Well, I think it depends.
• 28:07
  SPEAKER_02: It's all in the context of how you position it, because there's some things that have come and come out of the industrial world, you know, as technologies, which aren't what we could consider cybersecurity professionals, is really exciting, right?
• 28:18
  SPEAKER_02: Essentially, uh, I'll use is you know, things like remote access as one of those areas, which is like this whole problem of how do you kind of manage this access that the vendors have into your plant.
• 28:29
  SPEAKER_02: And so there's things we consider not even remotely secure as VPN that you know vendors have been using to manage this.
• 28:36
  SPEAKER_02: And they've been accepted because essentially what it's been is the operator, the plant, is like, look, I care about mean time to response, right?
• 28:44
  SPEAKER_02: My mean time to response is how fast I can fix that problem and get in and get out.
• 28:49
  SPEAKER_02: And so security, it's essentially availability is everything, then integrity, then confidentiality, right?
• 28:54
  SPEAKER_02: So it's the inverse of the triad.
• 28:57
  SPEAKER_02: So the technology end of it, you know, hey, I'm not adding any latency, I'm not adding any encryption or anything like this in the problem.
• 29:03
  SPEAKER_02: The MT MTTR to kind of respond to that instance, what I care about.
• 29:07
  SPEAKER_02: So so essentially it's been a lot of the the companies that are in the space have been about the positioning of how they understand the operator in this area and then how they best, you know, not interfere with availability, so to speak.
• 29:21
  SPEAKER_01: I love that actually.
• 29:22
  SPEAKER_01: It takes you right back to first principles, right?
• 29:24
  SPEAKER_01: Business impact, yeah.
• 29:25
  SPEAKER_01: Things that people care about, you know, forget how cool and awesome your stuff is.
• 29:29
  SPEAKER_01: Exactly.
• 29:31
  SPEAKER_01: And yeah, and classic example, right?
• 29:33
  SPEAKER_01: You've got people that buy security technology again and again.
• 29:37
  SPEAKER_01: We're really what they're after is some sort of more business impact or operational impact as opposed to security mitigation play, right?
• 29:43
  SPEAKER_02: Completely.
• 29:44
  SPEAKER_02: And you know, and then what this really does, it kind of converges two things, right?
• 29:47
  SPEAKER_02: So we kind of think as sales leaders a lot of times that you know we're so used to saying, hey, over the past 20 years of being doing cybersecurity, looking like, where's the buyer?
• 29:57
  SPEAKER_02: How does the buyer interoperate?
• 29:58
  SPEAKER_02: How do the the teams interoperate between each other?
• 30:01
  SPEAKER_02: Now you're kind of seeing this trend, obviously, from the product side to improve called product line growth, right?
• 30:06
  SPEAKER_02: Which essentially how can I deliver a user experience and essentially you know change it from like a buyer experience to user experience, where like how is the user interacting with it, right?
• 30:16
  SPEAKER_02: How the integrations and things like this, you know, improve their experience.
• 30:20
  SPEAKER_02: And so, yeah, so like the Atlassians and the Zooms and the people like this, they kind of really went on a really lean model in a very competitive market and said, look, I'm not completely overinvesting in sales in doing this.
• 30:32
  SPEAKER_02: I want to understand how the user thinks, how they interoperate with a product, and then have the sales function hold in earlier, right?
• 30:39
  SPEAKER_02: So that essentially, you know, you you've got your minimum viable product, you've got your sales lead kind of interoperating very deeply with the product team around how that user is experiencing in the product.
• 30:48
  SPEAKER_02: And so I think that kind of collapses those things a lot in this area because now you've got a user experience which is different based on where the buyers you're you're talking to.
• 30:56
  SPEAKER_02: So that's kind of one of the things that we've kind of seen a lot in this industry.
• 30:59
  SPEAKER_01: So let's talk again then about the the CEO, right?
• 31:02
  SPEAKER_01: They've done some investigation.
• 31:04
  SPEAKER_01: At what point do they hire some specific town in this area?
• 31:07
  SPEAKER_01: And who do they hire?
• 31:08
  SPEAKER_01: What should they be looking for?
• 31:09
  SPEAKER_02: As a CEO or as a like a chief revenue officer, hey, look, I've got a product, like how do I how do I scale to the market?
• 31:15
  SPEAKER_01: Well, we'll start with the CEO, right?
• 31:17
  SPEAKER_01: Do they need a whole different division through this or or or what?
• 31:21
  SPEAKER_02: Well, yeah, I mean, I think as a CEO of one of these companies, I'm talking to several venture capitalists right now on this kind of topic.
• 31:27
  SPEAKER_02: And I think you know, somebody that knows the industry and somebody essentially can kind of pivot in between these verticals, right?
• 31:33
  SPEAKER_02: And essentially the there's some people who see this as a technology problem, as we just discussed, of like, hey, look, I have a really you know neat feature of people saying, look, as you're seeing a lot of the companies and their valuations, I mean the armistice, clarities, dragus, etc., and and then the startups kind of come under that, which are addressing unique vertical problems.
• 31:51
  SPEAKER_02: The devil's in the details of the go-to-market, right?
• 31:53
  SPEAKER_02: The devil's in the details of how you manage the horizontal to vertical problems.
• 31:58
  SPEAKER_02: And so somebody who's fluent to your point in business value, right, and how you kind of abstract to that level is very valuable.
• 32:04
  SPEAKER_02: And essentially, you know, in my background, I've come from a sales career, as we talked about, but you know, I'm looking at these type of roles and I've been a general manager in my past that have kind of run the product, I've run the positioning, right?
• 32:15
  SPEAKER_02: So some people don't see it that way, but a lot of the VCs are really increasingly see this of like the long tail of this market.
• 32:21
  SPEAKER_02: And I think the the other thing, the other common theme that people are seeing is like the time to value, right?
• 32:27
  SPEAKER_02: Essentially, this is space where you've got a long sales cycle, right, to kind of educate the buyer of saying this is what my technology does in an immature industry where you've got you know very little compliance or regulation, and you know, the the CISO is just taking a responsibility.
• 32:42
  SPEAKER_02: So, what do I do?
• 32:43
  SPEAKER_02: Where do I start?
• 32:44
  SPEAKER_02: And then you kind of compound that with time to value from the product, where if I'm like doing that visibility product first, I'm putting something on a span port, it's gonna take a while before I get that visibility and kind of return that into revenue, right?
• 32:57
  SPEAKER_02: And so essentially a lot of the concerns that VCs are having in this is like if it's one of those products, what's the time to value, right?
• 33:04
  SPEAKER_02: Like, how can I, if if I sell a deal that's two million bucks, like when are they gonna deploy it, right?
• 33:09
  SPEAKER_02: In my past life, I did a major deal with a major oil and gas company where you know we sold it two years later, we were only 20% deployed.
• 33:17
  SPEAKER_02: And so we needed a different architecture and form factor to really go after that and kind of get fully deployed.
• 33:23
  SPEAKER_02: And so so so generally I'm seeing a lot of these companies are trying to try to hire a very strong go-to-market leader as well.
• 33:31
  SPEAKER_02: So put in the product experience.
• 33:33
  SPEAKER_02: And so I think for a career perspective of you know, people looking to either make a move in the space and become a chief revenue officer because I can understand the positioning and I can understand the vertical market targeting really well, or I want to be CEO because I kind of understand the go-to-market complexities and I know enough about the product and so forth to be a good steward.
• 33:54
  SPEAKER_02: It's it's an excellent career opportunity for people.
• 33:57
  SPEAKER_01: Yeah, so it feels like you know, having that more business-oriented leader who can tackle it from a revenue side, but also from a product side and a positioning and a suits or fit standpoint, right, is going to be important.
• 34:10
  SPEAKER_01: Would you then want to put your sellers or your partnership development people under that person or under the main CRO?
• 34:19
  SPEAKER_02: Yeah, it's a really good question.
• 34:20
  SPEAKER_02: I mean, I I think as a you know, as a chief revenue officer or CEO, whatever it is, the business development aspect of this and you know, can't be underestimated.
• 34:30
  SPEAKER_02: There are some markets you're gonna go have to create a market for, right?
• 34:34
  SPEAKER_02: And essentially what we did see in say the visibility market was that you know, kind of a lot of the the buyers in the space all kind of came to the problem at the same time, which is hey, this is the thing we can kind of do first.
• 34:44
  SPEAKER_02: We can get visibility first, it's network visibility.
• 34:46
  SPEAKER_02: We can't, we can have we uh segmentation projects are taking too long, they're not returning the value we want.
• 34:52
  SPEAKER_02: Endpoint technologies are complicated because the manufacturer is saying, don't touch my system, so it's a little bit more difficult to do the traditional endpoint detection response.
• 35:00
  SPEAKER_02: And so they kind of came to this problem as a community almost to said, hey, this is something we can effectively do as that first step.
• 35:06
  SPEAKER_02: But how I take the next step, like how do I protect?
• 35:09
  SPEAKER_02: How do I get sore in this space?
• 35:11
  SPEAKER_02: Like, how do I operationalize it?
• 35:12
  SPEAKER_02: How does my managed service provider manage this and give me actionable items that the plant can respond to and remediate?
• 35:18
  SPEAKER_02: So I think it's it's it's kind of those things.
• 35:21
  SPEAKER_02: And so the business development aspect of this is you kind of have people that understand, you know, the OT buyer that understand the partnerships and how that ecosystem works, they can kind of talk the language, right?
• 35:32
  SPEAKER_02: There's one deal that I I kind of one of my sales reps you know did in an IT-based company.
• 35:37
  SPEAKER_02: He just was able to go talk the language in 30 minutes.
• 35:39
  SPEAKER_02: The customers say, Yes, I trust you and bought, right?
• 35:42
  SPEAKER_02: So there's a lot of times we think in security about how we bring in field CTOs and people like this who understand, you know, hey, I've been a CISO and I understand how to talk that language.
• 35:52
  SPEAKER_02: This kind of requires a vertical knowledge of how I can kind of you know pivot between the different vertical areas, but also requires kind of a business development aspect of like, hey, I might understand how to talk it, but how to understand to manage and monetize these various partnerships I need so that you know, if I'm talking to you know, a healthcare customer, understand their environment, but also know how G and Siemens and Phillips work so they can deliver the outcome that they want on the plant floor.
• 36:17
  SPEAKER_01: Yeah, it feels like you have a wider perspective than just selling whatever you have to a you know a buying team at a company and in corporate IT.
• 36:26
  SPEAKER_01: There's lots of levers to pull and things to be aware of, at least, right?
• 36:30
  SPEAKER_02: Well, yeah, I think it's that.
• 36:32
  SPEAKER_02: It's just kind of like I think it's the security industry, it's like how we see the security channel too.
• 36:36
  SPEAKER_02: Because I think it's you're in general understanding the channel because we think of the typical value added resellers and so forth, the security bars.
• 36:44
  SPEAKER_02: That's kind of one element.
• 36:45
  SPEAKER_02: And so building a channel program, you want to make sure that you know you have that.
• 36:48
  SPEAKER_02: But also, you know, now we're seeing so much of the work being put in the influencers, right?
• 36:52
  SPEAKER_02: The Deloits, the KPMGs, all that are saying influencing a project.
• 36:56
  SPEAKER_02: And you know, and so you need to understand how to work with those teams.
• 37:00
  SPEAKER_02: Now, this kind of introduces a different part of the channel called the certification arm, right?
• 37:04
  SPEAKER_02: Like the manufacturer and what relationship they have with the customer.
• 37:07
  SPEAKER_02: Do they have to certify the technology?
• 37:09
  SPEAKER_02: Do they want to sell it?
• 37:10
  SPEAKER_02: And so it's kind of like this 360-degree view of your security channel, right?
• 37:16
  SPEAKER_02: And essentially, you know, and so many times I think in in training salespeople, we're really good at doing the first piece and understanding the basic partner ecosystem, but training in that next level of like how you're working with the Deloits and so forth that kind of hold paper in some of these contracts, but then working with a partner like this, you know, it's a little more of a complex security channel than you see.
• 37:37
  SPEAKER_02: That I see a lot of the companies, you know, in general, the large security companies, struggling in the education process with their sales force, just in general, right?
• 37:45
  SPEAKER_02: And so this you know adds a whole nother uh level to that, which you're gonna have to manage.
• 37:50
  SPEAKER_01: And if I'm an executive or even an individual contributor at a company and I'm getting into this space, what's the career mobility like?
• 38:00
  SPEAKER_01: I mean, is there just is it way understaffed and there's options all over the place, or is it a pretty small, tight-knit circle that move around from company to company?
• 38:09
  SPEAKER_02: No, I mean, I think there's a lot of career paths here.
• 38:11
  SPEAKER_02: I mean, and obviously, you know, I became kind of you know, fascinated by it years ago and kind of done many different things from business development to product management to partnerships, all the above.
• 38:22
  SPEAKER_02: But if you're kind of the it's ultimately the same path I've been traveling for 20 years, which is like, look, how do you get deeper in business value and understand, you know, what the customer's deepest problems are and how do you position to that?
• 38:33
  SPEAKER_02: And so that can lead yourself to you know, doing business development, you know, channels, um, partnerships.
• 38:40
  SPEAKER_02: A lot of what I've spent a lot of my time doing over the past few years is some very deep technical integrations, like understanding how to, you know, it's another part of the security channel, like how do you work with your technical integration partners to deliver value?
• 38:52
  SPEAKER_02: And so I think it offers you know a lot of different career paths.
• 38:57
  SPEAKER_02: And I think kind of seeing this bifurcation now between a lot of people you know that are kind of going and saying, hey, look, I'm getting a very deep sales operational background as a result of some of the tools and processes we're kind of developing.
• 39:07
  SPEAKER_02: I know that's a lot what you work with every day, but I think there's also the people who are kind of kind of get deeper into the business value angle and say, look, how do I go really doing business development in this area?
• 39:17
  SPEAKER_02: So in that, as I said, that's partnerships, tech alliances, blah, blah, blah, right?
• 39:21
  SPEAKER_02: You know, chief strategy officer, right?
• 39:23
  SPEAKER_02: So how do you run the strategy of a company and kind of be the catalyst and change agent to you know bring some of these teams together, you know, between like your sales and your product teams.
• 39:32
  SPEAKER_02: And so, but bottom line, it's any, you know, you work a lot with in uh with smaller size startups.
• 39:37
  SPEAKER_02: It anytime we go in from sales into those areas to be able to be a good collaborator with our product teams, our marketing teams, et cetera, that gets you deeper into the understanding of their processes and what they go through.
• 39:48
  SPEAKER_02: That's a must, right?
• 39:49
  SPEAKER_02: I mean, that's the the difference between a successful sales leader in a startup and one who's not, right?
• 39:55
  SPEAKER_01: When you look back, Dave, on the companies that you've seen make efforts, investments to get into this space outside their core business, but ultimately they they don't make inroads or they they they stop and kind of wind the club back a little bit.
• 40:09
  SPEAKER_01: What what's the reason for that mostly, do you think?
• 40:12
  SPEAKER_02: The reason for why they've been challenged?
• 40:14
  SPEAKER_01: Yeah, the reason why they said uh this is harder than we thought, or we we uh after all, it's gonna be not for us.
• 40:20
  SPEAKER_02: Yeah, I I mean I think one thing is obviously sales cycles, right?
• 40:24
  SPEAKER_02: Say, hey, look, this is not the market is immature, right?
• 40:27
  SPEAKER_02: This isn't a, you know, hey, we've got a problem that addresses a compliance regulation that I could lather in and repeat, right?
• 40:34
  SPEAKER_02: I I was at a company this is going back about six, seven years ago, a company, uh industrial automation company that bought a security company.
• 40:40
  SPEAKER_02: So this security company had a very specific play around compliance around utilities in Nurk SIP.
• 40:45
  SPEAKER_02: And so the thesis of the whole acquisition of the company was that we're gonna take this product and expand it to all the verticals that we service.
• 40:52
  SPEAKER_02: That doesn't work very well, right?
• 40:54
  SPEAKER_02: Because it's a compliance-driven problem, as we know, doesn't necessarily equate to a threat-driven problem.
• 40:59
  SPEAKER_02: And so essentially the thesis was wrong in in terms of the integration.
• 41:04
  SPEAKER_02: And so I think that's been the challenge.
• 41:12
  SPEAKER_02: And then you know you don't get the you have difficulty getting renewal.
• 41:17
  SPEAKER_02: You have to then kind of invest in the tech integrations and you know, in the product even further to kind of you know reduce that time to value on a go forward basis.
• 41:25
  SPEAKER_02: And so that's a whole nother cost that people don't want to do it.
• 41:28
  SPEAKER_02: Say, hey, great, so I've sold essentially what's a network product, but hey, in order, if I really want to scale this, now I have to come out with a whole different form factor, right?
• 41:35
  SPEAKER_02: I have to come with an agent or a collector that's cloud-based, et cetera, that I have to shift from a on-prem to cloud, I have to shift from a perpetual to ARR model.
• 41:45
  SPEAKER_02: I mean, there's a lot of things that kind of get into this of you know where companies get scared.
• 41:49
  SPEAKER_02: And I think that you're seeing a lot of the mid-sized companies, the B2C rounds right now struggling with their identity and saying, what do I do?
• 41:57
  SPEAKER_02: I'm like, this is an on-premise play that I need to turn into a cloud play because my investors want me to go this way.
• 42:02
  SPEAKER_02: So how do I sustainably do that?
• 42:04
  SPEAKER_02: But yet the market's saying you can't do cloud because Nurksip says no, right?
• 42:10
  SPEAKER_02: So there's a lot of things where I think people make missteps.
• 42:13
  SPEAKER_02: And but I think there's a lot of companies that are doing a really great job.
• 42:17
  SPEAKER_02: But I think from a large security company wanting to make a move into this space because it's uh of interest, because they see a great revenue opportunity.
• 42:25
  SPEAKER_02: You know, a lot of what I do all day is like consult with these companies, say, this is what you should do, right?
• 42:30
  SPEAKER_02: These are verticals you want to service.
• 42:31
  SPEAKER_02: This is how where your MVP needs to be, this is how I'd approach it.
• 42:35
  SPEAKER_02: And so get some help, right?
• 42:36
  SPEAKER_02: Don't assume you can figure this out all yourself, and don't figure, don't assume that you can kind of throw a lot of salespeople at the problem and to go do all your vertical and business development for you, right?
• 42:47
  SPEAKER_01: It feels like you know that there is this excitement and there's a big, you know, hopefully a big prize at the end of it, but how you get there is you know a field full of minds potentially.
• 42:58
  SPEAKER_01: You don't really know the the factors, the influencing, the channels, the the product uh nuances that are needed to get there.
• 43:05
  SPEAKER_01: And I guess I could see that if you if you don't if you don't fully committed to something after a year or so, you might be wanting to back out.
• 43:12
  SPEAKER_01: I I I talked to some of my clients the idea of you're you're either all in or you're all out, right?
• 43:16
  SPEAKER_01: Yeah.
• 43:17
  SPEAKER_01: There's no let's dip our toe in for six months and see what we think.
• 43:20
  SPEAKER_01: Let's just really commit to things and follow them through, knowing that they're probably gonna take longer than than you thought, like over time is gonna have a big impact.
• 43:29
  SPEAKER_02: Well, it is.
• 43:29
  SPEAKER_02: And and some people want to do it because it's the noble and the right thing to do.
• 43:32
  SPEAKER_02: And those of us have been in cybersecurity for a long time said, great, this is a neat problem to solve, right?
• 43:37
  SPEAKER_02: Uh, but I think that what people are seeing now is like, you know, as CISOs and so forth, like, look, I wanted to solve this problem now for a long time, for 10 years, because I've known that I've got all these IoT devices on my network and I don't know what to do, or I've got my OT problem, but but my plant people won't talk to me because they're 24-7 availability.
• 43:58
  SPEAKER_02: Now, obviously, the you know, everything that's in the news and everything, you know, that's going on is making people have to solve that problem.
• 44:03
  SPEAKER_02: I talked with a one of the companies I'm advising yesterday.
• 44:06
  SPEAKER_02: I said I talked to the chief revenue officer and said, so why are you doing this?
• 44:10
  SPEAKER_02: Right.
• 44:10
  SPEAKER_02: And he's like, you know, it's like, look, people are coming to me and say, I need to solve this problem.
• 44:14
  SPEAKER_02: I have to solve this problem.
• 44:15
  SPEAKER_02: You know, the time is now.
• 44:17
  SPEAKER_02: And so I can't ignore it anymore.
• 44:20
  SPEAKER_02: So there's a lot of people that I've talked to that have been skeptics about this space that have said, you know, you know, the time is here.
• 44:26
  SPEAKER_02: Now it's just having a, you know, a sustain, a really sustainable, focused go to market plan.
• 44:32
  SPEAKER_02: Of how to do it.
• 44:33
  SPEAKER_01: So final question for you, Dave.
• 44:35
  SPEAKER_01: What do you think the big topics, big themes are in the next few years that are gonna either have already emerged and need tackling or are on the horizon that this whole subset of industry is gonna be tackling?
• 44:48
  SPEAKER_02: Well, I think it's a number of things, right?
• 44:50
  SPEAKER_02: I think it's kind of the shift.
• 44:52
  SPEAKER_02: You've got aging out of this automation workforce, right?
• 44:54
  SPEAKER_02: So essentially if you are you know in your 50s and 60s, you'd be doing automation all your life, you run control systems, you run you know plants, et cetera, you know, the service-driven economy of the manufacturers to kind of run this for you, right?
• 45:07
  SPEAKER_02: And essentially the aging out of this workforce is kind of demanding that a lot of these things take place, right?
• 45:12
  SPEAKER_02: That the service economy drives uh our business, right?
• 45:17
  SPEAKER_02: So I look at a Rockwell, for example.
• 45:19
  SPEAKER_02: Rockwell said, look, you then the CEO had said in the next three years, 24% of our business has got to be you know ARR.
• 45:25
  SPEAKER_02: That's a huge step for you know a brick and mortar manufacturing company to do that.
• 45:30
  SPEAKER_02: And so that's kind of predicated on this aging out of the workforce.
• 45:33
  SPEAKER_02: And so with that, you lose a lot of the experience and the knowledge and so forth of how to safely protect these systems, but also into enable the business.
• 45:40
  SPEAKER_02: And so I think you know, the this this entry point of what we're doing in ICS security to solve some of the foundational problems is this is gonna enable this business transformation, you know, for the the next gen of the service economy.
• 45:53
  SPEAKER_02: And so that's what I see.
• 45:55
  SPEAKER_02: And I think the obviously, you know, the geopolitical situation, we don't know obviously what's gonna happen in terms of you know nation-state aggression in this area, but the attackers are developing a lot more understanding and sophistication around these systems in the same way that we as the industry are in order to defend against it.
• 46:12
  SPEAKER_02: And so, look, if I kind of understand you know how a semen system works as a security person, that same adversary of bad guys could be able to do the same thing and develop attack factors against it.
• 46:22
  SPEAKER_02: And so I think the confluence of those two problems of you know, the knowledge, the kind of shift from proprietary and you know, into kind of ubiquity, where essentially, you know, I've got to kind of look at what was decades old vulnerabilities, now things that are kind of right there in front of me and that are kind of everywhere.
• 46:40
  SPEAKER_02: You know, and how we kind of respond to that as a service economy is going to be one of the big areas.
• 46:46
  SPEAKER_01: Got it.
• 46:46
  SPEAKER_01: Well, listen, I've enjoyed my time back at school today.
• 46:50
  SPEAKER_01: Uh actually really interesting discussion, right?
• 46:52
  SPEAKER_01: There's so much, so different points of dynamism and transition going on in this area.
• 46:58
  SPEAKER_01: And it sounds like you've let them breathe it for quite a while.
• 47:01
  SPEAKER_01: If someone is one of those people who wants to find out more or is considering what this might mean for their company, how do they get a hold of you, Dave?
• 47:08
  SPEAKER_02: Sure.
• 47:09
  SPEAKER_02: They they can hit me on LinkedIn or David at industrialcybersecure.com.
• 47:12
  SPEAKER_02: There's a lot of great resources out there for people wanting to learn about this.
• 47:15
  SPEAKER_02: Uh, the Dragus folks do a really good job of publishing some good information.
• 47:19
  SPEAKER_02: Uh ICS Cert uh and the ICS JWG, there's a lot of basic entry conferences for people to learn.
• 47:25
  SPEAKER_02: Sans ICS, I mean, there's a lot of resources for people to kind of get up to speed on this space.
• 47:30
  SPEAKER_02: And um, so happy to help.
• 47:32
  SPEAKER_02: And also, I think, too, and Andrew, to give you credit on this, I mean, I think there's a lot of need and knowledge for people entering this space to have you know more basic sales tooling, right?
• 47:41
  SPEAKER_02: To understand the business value and the proposition and so many of the basics that need to apply here to kind of run the play to be focused.
• 47:48
  SPEAKER_02: And essentially you can be very distracted by either the you know, the challenge of the problem or the uniqueness of the business value, but having a basic focus approach and getting off the ground and basic sales hygiene is is what matters.
• 48:01
  SPEAKER_02: You know, even after all this, as much as I talk about the art, there's still a science here that we need to kind of focus on.
• 48:07
  SPEAKER_01: And it's funny how a lot of the challenges that we probably create for ourselves in sales can be solved by going back to some of the fundamentals completely in many different environments.
• 48:17
  SPEAKER_01: Completely.
• 48:18
  SPEAKER_01: Well, Dave, I've enjoyed it.
• 48:19
  SPEAKER_01: So it's uh David Hatchel at LinkedIn, and you said David at industrial cybersecure.com.
• 48:26
  SPEAKER_02: Exactly.
• 48:26
  SPEAKER_01: Great.
• 48:27
  SPEAKER_01: Well, Dave, enjoy the conversation.
• 48:28
  SPEAKER_01: Let's keep in touch.
• 48:29
  SPEAKER_02: Me as well.
• 48:30
  SPEAKER_02: Looking forward to it.
• 48:32
  SPEAKER_01: Well, I really enjoyed that conversation with Dave.
• 48:34
  SPEAKER_01: As you might have been able to tell, he's uh he's someone I've known for many years, worked with in a prior life or two, and he transitioned his career into this world of operational technology and critical infrastructure security about 10 or 12 years ago.
• 48:48
  SPEAKER_01: And it's a world that he knows very well.
• 48:50
  SPEAKER_01: For me, there were three takeaways from this.
• 48:53
  SPEAKER_01: First of all, was the importance of partnerships.
• 48:57
  SPEAKER_01: You know, you're operating in a world where there is technology, there's hardware, software that's being developed specifically for these worlds, for the use cases that are in them.
• 49:07
  SPEAKER_01: And the vendors of those technologies are actually got a key role to play in terms of access to the tools and also support and go to market initiatives as well.
• 49:16
  SPEAKER_01: So partnerships more than ever are uh super important in this world.
• 49:21
  SPEAKER_01: Secondly, I liked how we talked about sometimes you do need to adapt the technology that you you already have.
• 49:28
  SPEAKER_01: So you're thinking about how do we take whatever products that we have and apply them to this new world, they may need some changes, they may need some tweaking to make them work well.
• 49:38
  SPEAKER_01: Sometimes to do with legacy operating systems and things like that, and sometimes just the nature of communication channels and things like that.
• 49:45
  SPEAKER_01: But there is sometimes a need to adapt technology.
• 49:47
  SPEAKER_01: And then despite all that, my third takeaway was the foundations of selling still apply, right?
• 49:51
  SPEAKER_01: The the people that operate in this world still think about business risk, business operational risk.
• 49:57
  SPEAKER_01: They still think about how do they operate cost effectively in that world.
• 50:01
  SPEAKER_01: All the main drivers that we're used to in the traditional enterprise security world still apply in that other world.
• 50:09
  SPEAKER_01: So it was a really good conversation for me.
• 50:11
  SPEAKER_01: Good takeaways there.
• 50:12
  SPEAKER_01: I'm sure you've got some great takeaways as well as well.
• 50:14
  SPEAKER_01: And uh hope you enjoyed uh learning all about this world.