Latest / The Neon Show / Why Super Intelligent Models Write Super Dangerous Code | Varun Badhwar, Endor Labs

Transcript

Why Super Intelligent Models Write Super Dangerous Code | Varun Badhwar, Endor Labs · The Neon Show

• 0:00
  SPEAKER_00: Nation state actors, North Korea, China, Russia, others, are completely dominating the ability to push malicious code through open source because we have entirely left this space open.
• 0:11
  SPEAKER_00: If you think about Red Log, three years we went from first idea to an exit, a very large successful exit.
• 0:17
  SPEAKER_00: But three years and one day later, we were thinking about how to service 65,000 Palo Alto Networks customers post-acquisition.
• 0:24
  SPEAKER_00: And we took that business from five, 10 million error to 100 million RR.
• 0:28
  SPEAKER_00: Anybody can go take over an account without a lot of effort in open source and push malware that affects 500 million downloads of people.
• 0:36
  SPEAKER_01: Why is security improving much more slowly than the generation of code?
• 0:41
  SPEAKER_00: Every model from every lab is learning coding based on open source.
• 0:44
  SPEAKER_00: They go index the last 20, 30, 40 years of code that exists on the internet.
• 0:47
  SPEAKER_00: The models are learning not just the good behavior, they're learning all of the inherent security problems that the training code has introduced at the same time.
• 0:58
  SPEAKER_01: Warren, uh welcome to the Neon Show.
• 1:01
  SPEAKER_01: Excited to be doing this.
• 1:02
  SPEAKER_01: Thanks for giving us the space for doing this today.
• 1:05
  SPEAKER_00: Yeah, great to have you.
• 1:06
  SPEAKER_00: All the energy you guys are bringing and uh great conversations.
• 1:09
  SPEAKER_01: So so I think you have a very, very interesting journey.
• 1:12
  SPEAKER_01: You come from Deradun, right?
• 1:14
  SPEAKER_01: You belong to an army background.
• 1:16
  unknown: Right.
• 1:16
  SPEAKER_01: So you would have moved a lot while growing up.
• 1:19
  SPEAKER_00: Yeah, you know, spent many years domestically in India between, you know, I was born in Delhi, uh did a lot of my schooling in Darudun, but in between also lived in the Middle East when my dad was uh working in uh in Oman in Muscat.
• 1:34
  SPEAKER_00: So yes, you know, we've seen a lot of different things, but ultimately got rooted in Darudun.
• 1:40
  SPEAKER_00: My uh formative years of growing up were in Daradun.
• 1:44
  SPEAKER_00: Uh my grandparents used to be there.
• 1:45
  SPEAKER_00: It's a great place for you know people in the Indian military to retire with IMA and a great um community and system there.
• 1:54
  SPEAKER_00: So grew up there when it was a small little town pre uh pre it becoming a capital of uh Uttarakhand.
• 2:01
  SPEAKER_00: And uh in 2002 I moved to the United States for my undergrad.
• 2:07
  SPEAKER_01: So so one of the qualities that I have seen some of the best founders is in their earlier years they moved a lot.
• 2:15
  SPEAKER_01: Do you think that contributed to to your shaping up?
• 2:20
  SPEAKER_00: I don't know how much that did.
• 2:21
  SPEAKER_00: You know, my parents will tell you I was born a businessman.
• 2:25
  SPEAKER_00: I was from the time I remember, I was trading bicycles, buying, selling.
• 2:30
  SPEAKER_00: I was, you know, during my summer breaks, I would be doing projects.
• 2:33
  SPEAKER_00: And every time uh my parents were very social, every time their friends would come, I would have something out built, uh heart handicraft, arts and crafts that I would be selling.
• 2:42
  SPEAKER_00: Um so I guess I was just always gravitated towards entrepreneurship, if you may want to call it that, uh, starting very early days.
• 2:50
  SPEAKER_00: You know, is that something you're born with?
• 2:52
  SPEAKER_00: Is that a gift uh that you come to this earth with, or is it something you learned?
• 2:57
  SPEAKER_00: I think it's much more of a natural instinct because you know, even much later in life, there was a question of do I go start my first company in 2010, CypherCloud, or I was very close to going to business school uh for an MBA at Kellogg in Northwestern.
• 3:14
  SPEAKER_00: And again, I kind of chose the entrepreneurial route.
• 3:16
  SPEAKER_00: It was just the natural pull for me.
• 3:19
  SPEAKER_01: And and can you describe your first two entrepreneurial journeys before we come to Endor?
• 3:25
  SPEAKER_00: Sure.
• 3:25
  SPEAKER_00: So 2010, as I was just mentioning, I was in this crossroads.
• 3:28
  SPEAKER_00: I was I had a great run at Salesforce.com.
• 3:31
  SPEAKER_00: I was four years in.
• 3:32
  SPEAKER_00: I had joined them when there were 1,500 employees.
• 3:34
  SPEAKER_00: I had seen it scale up to six, seven thousand employees, but I was bored.
• 3:39
  SPEAKER_00: I would come in at nine, I'd leave by six o'clock, uh, working on great groundbreaking stuff around cloud security.
• 3:45
  SPEAKER_00: But I wanted to do something different.
• 3:47
  SPEAKER_00: And uh it so happened that I uh met and reconnected with somebody I'd known for a long time who had a design who was a multi-time entrepreneur and founder, and he had a desire to start a cloud security company.
• 4:01
  SPEAKER_00: Well, I had the domain expertise.
• 4:03
  SPEAKER_00: And so we got together and in late 2010 started this company to secure uh cloud-based applications.
• 4:10
  SPEAKER_00: The idea was as people start moving from enterprise app, remember this time, it was a crazy idea to think you would put your customer data in a SaaS application in the United States.
• 4:20
  SPEAKER_00: Um, so how do we work around that?
• 4:22
  SPEAKER_00: How do we get people comfortable with data security and privacy and regulation?
• 4:26
  SPEAKER_00: Is what we built the first company around, a company called CypherCloud.
• 4:30
  SPEAKER_00: Uh, and that's what we did.
• 4:32
  SPEAKER_00: And I did that for about five years, had a great run, learned a lot of things about how to build and scale, but also learned a lot about the mistakes we make.
• 4:40
  SPEAKER_00: And thankfully, I was not in the CEO seat where the pressure and stakes are so much higher.
• 4:45
  SPEAKER_00: But I got to be kind of the right hand to the CEO and really learn.
• 4:49
  SPEAKER_00: And then in 2015, I uh felt confident and comfortable and found the opportunity to build something in the cloud infrastructure security space because now the talk of everybody's kind of conversations at dinner and coffees was why are we building data centers anymore?
• 5:07
  SPEAKER_00: There's AWS, there's Azure, GCP.
• 5:10
  SPEAKER_00: And so Redlock is the company I founded in 2015 that was focused on securing all of your applications as you entirely shift from a perimeter you control in your four walls of a data center to compute your rent from third-party hyperscalers.
• 5:28
  SPEAKER_00: And so the commonality in CypherCloud and uh later Redlock, and as we talk about Endor, I'm sure we'll get to that, but was always these big technology shifts and its implication to cyber and cybersecurity and safety, um, and really creating new markets for problems most people couldn't even comprehend, and how we had to educate the market, create budgets, and eventually create category-defining companies.
• 5:56
  SPEAKER_01: So, how was the journey, you know, when you became ultimately the CEO at Red Lock, raising money, getting the first few customers?
• 6:05
  SPEAKER_01: Because before that, you were mostly on the product and engineering side.
• 6:09
  SPEAKER_00: Look, I've I've always been obsessed with customers, customer needs, customer use cases.
• 6:14
  SPEAKER_00: And I've generally been um I've had enough uh to be dangerous knowledge on product and technical side as well as on the business and sales side.
• 6:25
  SPEAKER_00: And so I think for me it was a natural thing to become CEO.
• 6:29
  SPEAKER_00: But I'll tell you like nothing gets nothing prepares you for it.
• 6:32
  SPEAKER_00: It's a lonely job.
• 6:33
  SPEAKER_00: First thing I tell people is the buck stops with you, right?
• 6:36
  SPEAKER_00: The consequences of decisions you make for days, weeks, months, and years are based on what you chose.
• 6:42
  SPEAKER_00: As a founder, there's no book you you know you have read and you follow the track on.
• 6:47
  SPEAKER_00: The reason we're creating something is because you're trying to do something that hasn't been done before, or you're solving a problem that hasn't been solved before.
• 6:55
  SPEAKER_00: So it's not like I can follow somebody's playbook and do it.
• 6:59
  SPEAKER_00: And I think it's a lot of part art, part science.
• 7:03
  SPEAKER_00: So intuition matters a lot.
• 7:05
  SPEAKER_00: Instincts matter a lot.
• 7:07
  SPEAKER_00: To this date, I usually say that, you know, when I'm interviewing candidates as an example, usually I feel like in the first five minutes, I have a high degree of confidence if this person is gonna be the right fit for us or not.
• 7:21
  SPEAKER_00: This next 55 minutes or longer that I spend in the conversation is really getting to the details.
• 7:27
  SPEAKER_00: So instinct development matters a lot.
• 7:29
  SPEAKER_00: And I feel like I had developed that over my first two startups.
• 7:33
  SPEAKER_00: Uh, I'd also learned about just how important it is not to take shortcuts.
• 7:38
  SPEAKER_00: I think usually people will think about, well, I just got to get this out.
• 7:43
  SPEAKER_00: Let me just create something.
• 7:44
  SPEAKER_00: But if you think about Redlock, you know, in three years, we went from uh first idea to an exit, a very large successful exit.
• 7:54
  SPEAKER_00: But three years and one day later, we were thinking about how to service 65,000 Palo Alto networks customers post-acquisition.
• 8:01
  SPEAKER_00: And we took that business from five, 10 million ARR to 100 million error.
• 8:06
  SPEAKER_00: And I'm talking about doing this in 2018, 2019.
• 8:09
  SPEAKER_00: We couldn't have done it if we had all these shortcuts on our platform and everything was held by Band-Aid and Duct tape.
• 8:15
  SPEAKER_00: So, yeah, I think some foundational aspects of build for scale from day one.
• 8:20
  SPEAKER_00: Yes, you got to be scrappy, but you've got to really look around the corners.
• 8:24
  SPEAKER_00: Intuition and gut matters as much as science and what you've learned in school matters, were probably the big things I've taken away.
• 8:31
  SPEAKER_00: And the importance of investing in the right team upfront.
• 8:34
  SPEAKER_00: I think we made the mistake early on in the first couple of companies where it was like, well, we don't have a lot of funding.
• 8:40
  SPEAKER_00: Let's figure out how do we cut corners.
• 8:42
  SPEAKER_00: And I just realized eventually, even like your equity, right?
• 8:46
  SPEAKER_00: As a founder, you don't want to give up too much equity.
• 8:49
  SPEAKER_00: Um, but you can only build a successful company if you share the wealth and you find the best talent and kind of unconstrain yourself to do that.
• 8:58
  SPEAKER_01: So, so let's compare your journey now in Redlock, right?
• 9:02
  SPEAKER_01: How much did you raise in the first few rounds and how big did your team get before you got acquired?
• 9:07
  SPEAKER_00: So with Redlock, we had raised a 2.5 million seed and about an$8 million Series A.
• 9:15
  SPEAKER_00: So we were very capital efficient as a company.
• 9:17
  SPEAKER_00: We'd raised under$12 million in funding.
• 9:20
  SPEAKER_00: The company was about 85 people, split half and half between India, uh, Bangalore, and US.
• 9:27
  SPEAKER_00: And um, you know, we were closing in on the first 10 million of ARR, a short amount of time actually, from inception to that point.
• 9:36
  SPEAKER_00: And the exit was uh, you know, close to$250 million exit for the company, which was an incredible return for all our investors.
• 9:45
  SPEAKER_00: It was life-changing for every employee because, again, I believe in investing in people, you know, a lot of times people say, well, in India, when you're hiring employees, they care more about cash, less about equity.
• 9:55
  SPEAKER_00: And I would always educate people like, look, salaries pay the bills, but life-changing moments come from equity.
• 10:03
  SPEAKER_00: And I think it's really interesting, even when I look back now, many years from now, I'll get a text message from somebody saying, Look, I bought the second vacation house.
• 10:11
  SPEAKER_00: This is all thanks to you know the redlock run I had, or you know, I've got this nice new car, couldn't have it done without redlock.
• 10:18
  SPEAKER_00: So I think it's very fulfilling knowing that it was not just a wealth creation event for investors and founders, but for every individual that worked in this company.
• 10:26
  SPEAKER_01: And uh you ultimately created Prisma Cloud, which became uh one of the core infrastructures of Palo Alto.
• 10:35
  SPEAKER_00: Yeah.
• 10:36
  SPEAKER_01: Right.
• 10:36
  SPEAKER_01: So how was that so strategic to Palo Alto?
• 10:40
  SPEAKER_01: Did you realize that at that point in time?
• 10:43
  SPEAKER_00: I I don't know if anybody could have realized how strategic it could have been.
• 10:48
  SPEAKER_00: It was certainly strategic, and I'll tell you a small story around this.
• 10:51
  SPEAKER_00: Um Nikesh had just come in, Nikesh Aurora had just come in as the CEO of Palo Alto Networks.
• 10:58
  SPEAKER_00: Um it was the first acquisition he was making.
• 11:01
  SPEAKER_00: Remember at the time, people were wondering why this non-cybersecurity person is a Googler coming in and taking over the realm of a cybersecurity company.
• 11:10
  SPEAKER_00: Palo Alto was known for firewalls and network security.
• 11:14
  SPEAKER_00: And the craziest part that most people don't remember is a couple of months before Nikesh joined, Palo Alto Networks had made one of its biggest ever acquisitions of a direct competitor of Redlock, a company called Evident.io.
• 11:29
  SPEAKER_00: And the interesting thing is after that acquisition, you know, Endor, I'm sorry, Redlock was really deep into um winning even more accounts.
• 11:39
  SPEAKER_00: Like we got even more momentum after the acquisition while Evident was busy getting acquired, and you know, they were limited to AWS, Endor, uh, sorry, I keep saying Endoor, Redlock was much more gravitated around multi-cloud.
• 11:53
  SPEAKER_00: And you know, the architecture was fundamentally different.
• 11:55
  SPEAKER_00: And so we were scaling and we were beating Evident and Palo Alto Networks on a lot of deals.
• 12:00
  SPEAKER_00: And so when Nikesh came around and the team said, Hey, you should come meet Nikesh, I just said, like, you're my biggest competitor, you know, I'm not going to waste my time.
• 12:09
  SPEAKER_00: And long story short, Nikesh and I met had a meeting in the minds.
• 12:13
  SPEAKER_00: He said, Look, I'm making a bet in this, you have to make a bet in me.
• 12:17
  SPEAKER_00: He created very big goals that I thought were fundamentally unachievable.
• 12:21
  SPEAKER_00: But kudos to him because the only way it was possible to scale this thing up is to not tuck Redlock as part of the network security business.
• 12:30
  SPEAKER_00: But he allowed us to create an entirely new business unit that had never been done before.
• 12:34
  SPEAKER_00: We used to call it a speed boat.
• 12:35
  SPEAKER_00: So if you think about the big network security business as a mega yacht sailing in the middle of the ocean, cloud security was a new business.
• 12:42
  SPEAKER_00: You needed a speedboat to be scrappy, move fast, and catch up to the core business.
• 12:49
  SPEAKER_00: And so Nikesh was incredible at funding me and my team and giving me the opportunity to not just scale that team of 80 people up to eventually close to a thousand people in three years, but in that midst, we acquired nine other companies to fold them into the Red Lock architecture and really create this monster platform, which was for cloud security.
• 13:12
  SPEAKER_00: And to a great degree, I'll take a little bit of credit for Wiz's success because we showed such a great acceleration of revenue and path that Wiz eventually and the founders there were building something else, pivoted to cloud security, got funding on the backs of Palo Alto Network's Prisma Cloud Success.
• 13:30
  SPEAKER_00: And obviously, kudos to them.
• 13:32
  SPEAKER_00: They've built uh you know a 32 billion outcome for themselves and the teams there.
• 13:36
  SPEAKER_00: Did you angel invest in Wiz?
• 13:38
  SPEAKER_00: No, I couldn't.
• 13:39
  SPEAKER_00: I mean, it was a direct competitor to us.
• 13:40
  SPEAKER_01: Got it.
• 13:41
  SPEAKER_01: But but they started, I think, just at the time that you were leaving Polo to start Endor?
• 13:48
  SPEAKER_00: They started about 18 months before that.
• 13:50
  SPEAKER_00: They started right when COVID started, like at the beginning of 2020 is when they pivoted to cloud security.
• 13:55
  SPEAKER_00: They started a little bit before in 2019.
• 13:58
  SPEAKER_00: Uh, but yeah, 2020, and then I was still at Power Also Networks for another 18 months.
• 14:02
  SPEAKER_01: Yeah, probably, you know, if you hadn't known it's inside of 2020, that it was so strategic, you could have asked for a billion dollars.
• 14:10
  SPEAKER_00: People tell me that all the time.
• 14:12
  SPEAKER_00: They're like, hey, you sold Redlock too cheap.
• 14:13
  SPEAKER_00: And I like my my theory is I never look back and have regrets.
• 14:17
  SPEAKER_00: I think it was an amazing outcome even till this point.
• 14:19
  SPEAKER_00: Uh for those of uh the people that held on to the Palo Alto network stock, that stock is you know 15 times higher than what it was.
• 14:27
  SPEAKER_00: So, you know, if you take that bet that that was a multi-billion dollar acquisition now.
• 14:32
  SPEAKER_00: But but no, look, life is a matter of learnings.
• 14:35
  SPEAKER_00: I think startups, the the people almost think about the initiation and the incubation of a startup as the hardest part.
• 14:43
  SPEAKER_00: And I think in the moment it feels that way because it is really hard.
• 14:47
  SPEAKER_00: But I think startup building gets harder.
• 14:49
  SPEAKER_00: And um across the board, right?
• 14:53
  SPEAKER_00: When you're raising, you're raising on a dream, you're raising on an idea.
• 14:55
  SPEAKER_00: If you're a repeat founder like myself, we don't have to prove anything.
• 14:59
  SPEAKER_00: Money comes easy.
• 15:00
  SPEAKER_00: Fortunately, if you're a young founder, you still have to prove conviction in the business, but you're not showing for revenue and scale.
• 15:07
  SPEAKER_00: You're selling the TAM and you're selling the product architecture insights.
• 15:11
  SPEAKER_00: And you can raise the, you know, whatever valuation these days we see crazy valuations.
• 15:15
  SPEAKER_00: There's a bunch of cybersecurity companies starting out with$100 million seed funding now with near zero revenue.
• 15:20
  SPEAKER_00: And that's fine.
• 15:21
  SPEAKER_00: But what do you do when you have to scale revenue?
• 15:24
  SPEAKER_00: Now you could be the smartest founder with product instincts, but if you don't understand how to build go-to-market for scale, that's another hard problem to crack.
• 15:33
  SPEAKER_00: And engineering can be scientific.
• 15:36
  SPEAKER_00: Sales marketing is art and science, so it kind of starts getting more and more complicated.
• 15:41
  SPEAKER_00: And then initially you have one building block of engineering, then you had engineering and marketing and sales, and all of these building blocks have to connect.
• 15:50
  SPEAKER_00: And then people start asking you about go to market and efficiency and eventually CAC and LTV.
• 15:56
  SPEAKER_00: And so growing and scaling a healthy, sustainable business, I think over time gets harder.
• 16:03
  SPEAKER_01: So, what was the trigger point for you to start Endor?
• 16:06
  SPEAKER_01: Because you started during COVID time, a very uncertain time to begin a company.
• 16:11
  SPEAKER_01: You can you could have continued building Prisma to multi-multi-billion dollars in business.
• 16:18
  SPEAKER_00: That was my wife's uh argument against me starting a company, yes.
• 16:22
  SPEAKER_00: Uh look, you know, they say founders have this bug.
• 16:26
  SPEAKER_00: I mean, why is Travis Kalinick starting another company after Uber, right?
• 16:29
  SPEAKER_00: Why I I feel like us founders have this crazy gene in us, and that gene doesn't let us sit comfortably or see and be a part of status quo.
• 16:43
  SPEAKER_00: I feel like the natural instinct is if you see a problem, you want to go fix the problem.
• 16:48
  SPEAKER_00: And in 2021, while us were building this incredible business, um I saw a problem.
• 16:55
  SPEAKER_00: And that problem was software development was radically shifting from development to assembly.
• 17:01
  SPEAKER_00: 18% of our code wasn't even being written by developers, it was open source, it was all of these other things.
• 17:08
  SPEAKER_00: We had no idea who's written this code and published it on GitHub.
• 17:12
  SPEAKER_00: Yet we were blindly trusting all of this code and just in the spirit of moving fast, bringing it in and using it.
• 17:20
  SPEAKER_00: That's one side of the change.
• 17:22
  SPEAKER_00: The other side is you are analyzing this with incumbent tools and security scanning tools for code, and they would find a bunch of stuff.
• 17:32
  SPEAKER_00: And you would check a box and compliance reports that says, yes, I scanned my code for vulnerabilities.
• 17:37
  SPEAKER_00: But the reality was the volume of problems that were being discovered and the fidelity of that volume was really low.
• 17:45
  SPEAKER_00: So engineers just didn't trust the results.
• 17:47
  SPEAKER_00: So you're building apps, you're using all this code, you're relying on third-party open source.
• 17:53
  SPEAKER_00: And at the same time, you have all of these potential security issues, you couldn't figure out what's real, what's not, and how you're going to fix them.
• 18:01
  SPEAKER_00: And I think ignorance was bliss.
• 18:03
  SPEAKER_00: But like for me, as a problem solver, I was like, look, this is a bubble waiting to crash.
• 18:10
  SPEAKER_00: Like it this cannot sustain.
• 18:12
  SPEAKER_00: And you look forward, two years later, LLMs were starting to write code.
• 18:16
  SPEAKER_00: And if you look at 2026 today, what is the biggest topic of conversation?
• 18:21
  SPEAKER_00: The fact that every security vulnerability can easily be discovered faster than ever before by LLMs.
• 18:28
  SPEAKER_00: Like they're really good at finding bugs.
• 18:30
  SPEAKER_00: And so now the problems become well, if LLMs can find so many problems, why can't we secure that code and build it correctly from the first onset?
• 18:41
  SPEAKER_00: And the reality is historically, it's been a friction point.
• 18:44
  SPEAKER_00: Do you either ship code fast or do you ship it securely?
• 18:47
  SPEAKER_00: It's never been an end.
• 18:49
  SPEAKER_00: And our mission at Endor that I took on is we can help you ship fast and ship securely.
• 18:57
  SPEAKER_00: If you build the right architecture, the right technology, the right insertion point in the software development lifecycle, you can solve all of those problems.
• 19:05
  SPEAKER_00: We started that in 2021.
• 19:07
  SPEAKER_00: And I couldn't be happier because sitting here today, we've had the time to build and scale a platform, prove it out with the world's most amazing customers in technology, finance, insurance, et cetera.
• 19:19
  SPEAKER_00: And now this is the number one problem that is constraining us from adopting a gentic STLC is code generation is not the problem.
• 19:27
  SPEAKER_00: It's security, it's quality, it's everything to do with releasing of the software much faster, and we're primed to solve it.
• 19:33
  SPEAKER_01: And you operate on the left side completely?
• 19:36
  SPEAKER_00: The way I describe to be bill where Endor fits in is um if you want to draw a box around the entirety of the agentic SDLC from cloud code cursor, pick your favorite ID, agentic ID, through your pull requests, through your um CI CD pipeline till you have an artifact that is ready to be deployed in the cloud, container or jars, whatever, that is our zip code.
• 20:03
  SPEAKER_00: From the first intent of writing code to writing the code to checking it into your pull requests and GitHub to CI CD pipelines, securing all of that such that what is ready is the most secure piece of software you could possibly create without compromising on speed is the outcome that Android uh drives for our customers.
• 20:25
  SPEAKER_00: And kind of that, unfortunately, in security, that workflow continues post-deployment because now I deployed the product yesterday.
• 20:32
  SPEAKER_00: Now, today, 10 new things were found in security, like vulnerability discoveries.
• 20:38
  SPEAKER_00: Now you've got to figure out off that code base, off those 10 vulnerabilities, what actually affects me?
• 20:44
  SPEAKER_00: And how do I quickly pinpoint what affects me?
• 20:47
  SPEAKER_00: How do I fix it without breaking my application and redeploy really, really quickly?
• 20:52
  SPEAKER_00: And that time window to remediate used to be six to 12 months because, yeah, sure, somebody found a vulnerability yesterday, but the the likelihood that somebody's going to build an exploit and target you and come at you was like very low, 1%, 2%.
• 21:09
  SPEAKER_00: Today that's that's reality.
• 21:12
  SPEAKER_00: Within 10 hours, people have found and created working exploits for new vulnerabilities.
• 21:18
  SPEAKER_00: And so this loop of remediate triage and remediation of what affects my code, what do I need to fix?
• 21:25
  SPEAKER_00: Could literally become a full-time job for every engineering team on the planet.
• 21:29
  SPEAKER_00: But it's not sustainable.
• 21:30
  SPEAKER_00: So that's what we're automating for our customers.
• 21:32
  SPEAKER_01: And why is security improving much, much more slowly than the generation of code?
• 21:39
  SPEAKER_00: That's a great question.
• 21:40
  SPEAKER_00: One of my favorite topics I spent a lot of time on.
• 21:42
  SPEAKER_00: Because you know, conventional wisdom would say look, we these agents are getting so smart, models are getting so smart, we keep hearing how they can find every security bug.
• 21:52
  SPEAKER_00: Well, why can't it write code security?
• 21:55
  SPEAKER_00: We have to go trace back to the origins of how these models are trained.
• 22:00
  SPEAKER_00: Model from every lab that is learning coding is learning coding based on open source.
• 22:05
  SPEAKER_00: They go index the last 20, 30, 40 years of code that exists on the internet.
• 22:08
  SPEAKER_00: Most of it is on GitHub, maybe Stack Overflow, maybe other places.
• 22:13
  SPEAKER_00: That code has various forms and vectors of security, quality, reliability, et cetera.
• 22:20
  SPEAKER_00: The models are learning not just the good behavior, they're learning all of the inherent security problems that these uh the training code has introduced.
• 22:28
  SPEAKER_00: And it is a very hard technical problem to figure out how to piece away what the model has learned that subsequently was known to have security bugs, and how it was circumvented or fixed later.
• 22:43
  SPEAKER_00: And so models are producing way more code that is insecure than humans.
• 22:49
  SPEAKER_00: The other piece is at the same time, traditionally, at least we had some review processes.
• 22:54
  SPEAKER_00: Human in the loop for every pull request for regulated companies that would review the code base.
• 22:59
  SPEAKER_00: Today you can't do that.
• 23:00
  SPEAKER_00: Like the volume of code being generated is so high, human eyes can't pay attention to catch every security bug, logic bug, architecture bug in the code base.
• 23:10
  SPEAKER_00: And so, yeah, I think the combination of the models themselves generate more insecure code.
• 23:16
  SPEAKER_00: You have citizen developers that don't even understand what is being built and output, and you don't have enough people to review all of this code diligently.
• 23:24
  SPEAKER_00: That is causing much more of your code to be vulnerable.
• 23:29
  SPEAKER_00: That's on your code.
• 23:30
  SPEAKER_00: As it relates to all of the open source code you've been using and relying on, you're finding 10x more vulnerabilities there because, again, models are easily discovering more and more problems.
• 23:40
  SPEAKER_00: And if you're in the open source ethos, whose responsibility is it to fix?
• 23:44
  SPEAKER_00: If I was a hobbyist, I was a college graduate.
• 23:47
  SPEAKER_00: Over the summer, I created a project that became popular.
• 23:50
  SPEAKER_00: Now Anthropics is coming to me and saying, you got to fix these 20 vulnerabilities that we found?
• 23:55
  SPEAKER_00: I'm not interested.
• 23:56
  SPEAKER_00: I'm back to school, I'm busy.
• 23:58
  SPEAKER_00: Right?
• 23:58
  SPEAKER_00: So it's just a very strange world that we live in.
• 24:02
  SPEAKER_00: We rely on all of the software that isn't written by us, and more and more and more vulnerabilities that continue to be discovered.
• 24:10
  SPEAKER_00: But whose problem is to kind of fix things?
• 24:13
  SPEAKER_01: I think it requires a very different shift in mindset because earlier, when code was written, it was assumed to be secure.
• 24:22
  SPEAKER_01: And now we have to just give up with that mindset that any code written cannot be secure because the writing of code has become so easy.
• 24:32
  SPEAKER_00: Yeah, I think I think you had, I would say, three core assumptions.
• 24:36
  SPEAKER_00: That's one.
• 24:37
  SPEAKER_00: Second was the person writing the code was at least a trained software developer.
• 24:40
  SPEAKER_00: Right now, my mom and dad can write software.
• 24:43
  SPEAKER_00: Uh scary thought.
• 24:44
  SPEAKER_00: The third thing was if there was generally an implicit trust in open source.
• 24:51
  SPEAKER_00: If I'm grabbing it from open source, people have had eyes on it, it'll be fine.
• 24:55
  SPEAKER_00: Today, nation state actors, North Korea, China, Russia, others are completely dominating the ability to kind of push malicious code through open source because we have entirely left this space open.
• 25:10
  SPEAKER_00: Yeah.
• 25:10
  SPEAKER_00: It's like your doors may be locked, your windows are open.
• 25:14
  SPEAKER_00: Anyone can ship you any code.
• 25:16
  SPEAKER_01: Yeah.
• 25:16
  SPEAKER_00: And your pipelines are just pulling in automatically these updates.
• 25:20
  SPEAKER_00: It's a wild thought to think about right now when you think about the fact that anybody can go take over an account without a lot of effort in open source and push malware that affects 500 million downloads a week.
• 25:37
  SPEAKER_01: So I assume uh at Endor, raising money would have become much easier, right?
• 25:44
  SPEAKER_01: Because you had already made so$250 million for your stakeholders.
• 25:48
  SPEAKER_01: The first round on Endor was$25 million, I'm right.
• 25:52
  SPEAKER_01: And second round was 90.
• 25:53
  SPEAKER_00: Yes.
• 25:55
  SPEAKER_00: Yeah.
• 25:55
  SPEAKER_00: Yeah, look, I I am blessed to have a good track record, and fundraising has never been the issue here.
• 26:02
  SPEAKER_00: Every round has been preempted in this company.
• 26:05
  SPEAKER_00: We've never really had to go out officially and run a run a fundraise process.
• 26:10
  SPEAKER_00: Uh, but you know, at the same time, the expectations get higher too.
• 26:13
  SPEAKER_00: I don't think anybody is expecting Varun Badwar to go create another$250 million exit outcome, right?
• 26:22
  SPEAKER_00: I think the the belief, my personal belief, my own expectation of me, let alone everybody else, is that I've did that before.
• 26:31
  SPEAKER_00: I learned how to build a much bigger scale business within Palo Alto Networks.
• 26:36
  SPEAKER_00: And now I want to build an IP oval business independently.
• 26:41
  SPEAKER_00: So expectations get higher, pressure gets higher.
• 26:45
  SPEAKER_00: Also, I think we just we haven't talked about the elephant in the room.
• 26:48
  SPEAKER_00: Like building a business and navigating it through today is wild compared to 2020, you know, 2017, 2018.
• 26:57
  SPEAKER_00: CI, like the speed of change of technology.
• 27:00
  SPEAKER_00: I may have product market fit today, I may not have it in a quarter, even though I'm a scaled up startup.
• 27:06
  SPEAKER_00: Or, you know, a company with one-tenth of the capital could potentially race to building something relatively competitive much faster.
• 27:16
  SPEAKER_00: So the question always becomes like, what's the moat now, right?
• 27:19
  SPEAKER_00: How much of it is, you know, people say this is a system of record mode, data mode.
• 27:23
  SPEAKER_00: Sure, but I think I think those things matter.
• 27:26
  SPEAKER_00: Um ultimately, I think what your customers believe about you and your ability to support and service them, because they're all going through the same shifts.
• 27:35
  SPEAKER_00: Um, how we react, how we show our velocity of shipping with speed and thoughtfulness, um, how we help them navigate all these changes uh matter the most.
• 27:48
  SPEAKER_00: I think having loyal customers and loyal employees that help you navigate through this change is the best thing you can have.
• 27:55
  SPEAKER_00: But I call it wild because of certainly those two things I mentioned about competitive dynamics, product market fit dynamics.
• 28:04
  SPEAKER_00: Um but also it's like every morning when I wake up and before I get on my phone, there's this little thing in the back of my head.
• 28:10
  SPEAKER_00: I'm like, oh, like what's what's today?
• 28:12
  SPEAKER_00: What's today bringing out, right?
• 28:13
  SPEAKER_00: What is the what is the next big launch from a lab?
• 28:16
  SPEAKER_00: What is the next big thing happening in the industry?
• 28:18
  SPEAKER_00: What you know, we not talked about regulation yet, but there's so much chatter right now about open weight models and is US going to regulate.
• 28:26
  SPEAKER_00: Are certain things gonna get bought banned?
• 28:29
  SPEAKER_00: Like this has consequences.
• 28:31
  SPEAKER_00: These have lasting consequences for companies like us.
• 28:34
  SPEAKER_00: And uh the good news then, I comfort myself thinking I'm not the only one.
• 28:39
  SPEAKER_00: If you're Sam Altman, if you're Dario, it doesn't matter if you're running the best biggest labs in the world.
• 28:44
  SPEAKER_00: That same paranoia has to be living in the back of your head every single day.
• 28:48
  SPEAKER_01: Yeah, because uh Sam and Dario both have the fear of getting disrupted by Chinese open source, right?
• 28:56
  SPEAKER_00: So everybody has the fear of I am not in full control.
• 29:00
  SPEAKER_00: Uh, but you know, as a as a founder, multi-time founder, the last two times I built companies, I felt I have full control of this car.
• 29:08
  SPEAKER_00: And then there are things outside I don't control.
• 29:10
  SPEAKER_00: Now it's like I don't control the outside.
• 29:12
  SPEAKER_00: Also, who knows what shifts, right?
• 29:15
  SPEAKER_00: Um it's exhilarating, it's uh scary at the same time.
• 29:21
  SPEAKER_00: And so you just have to have a very balanced view of what are the things I control.
• 29:24
  SPEAKER_00: I usually chuckle when people ask me what's the two to three year roadmap of Endor.
• 29:29
  SPEAKER_00: I'm like, if I could tell you with high degree of confidence what six months holds, it would be a win.
• 29:34
  SPEAKER_00: Uh because I have now learned to live with situations where we literally last quarter, two of the products we shipped last quarter, if at the beginning of quarter you had asked me if we would be building those things, I would say no way.
• 29:49
  SPEAKER_00: So that's the pace of change that we're living in, and that's the pace of change I'm trying to help my employees understand is the new reality, is living in controlled chaos or organized chaos, as I call it.
• 30:01
  SPEAKER_01: And how big is the team today at Endor?
• 30:03
  SPEAKER_00: Endor is closing in to about 200 people.
• 30:06
  SPEAKER_00: Uh Bangalore has about 55, 60 people now, and then uh 140, most of whom are in the US.
• 30:17
  SPEAKER_01: And in US, everybody's here in the Bay Area?
• 30:20
  SPEAKER_00: So Bay Area is a high degree of concentration.
• 30:22
  SPEAKER_00: This is a headquarters where you're at today.
• 30:24
  SPEAKER_00: Um, but you know, our go-to-market team is fairly spread out because we have more geographic focus.
• 30:30
  SPEAKER_00: We also have an office in Europe, uh, in the Netherlands.
• 30:33
  SPEAKER_00: Uh, it's a kind of a lot of our deep researchers and engineering talent is built there.
• 30:38
  SPEAKER_00: Uh, and we're continuing to hire.
• 30:39
  SPEAKER_00: So if anybody's listening here and interested in working at the intersection of uh the biggest change of our time, which is agentix software development and how to secure it, then you know, we're looking for people around the world.
• 30:50
  SPEAKER_01: Why is there a Darth Vader in your office?
• 30:54
  SPEAKER_00: So um, if you haven't guessed it with Endoor Labs, the name Endor comes from um kind of inspiration from Star Wars.
• 31:02
  SPEAKER_00: The the quick story on that is you know, 2021, when I was starting the company, LLMs didn't exist, so I couldn't go to an agent and say, help me find a domain name and a uh, you know, uh company name that can align.
• 31:14
  SPEAKER_00: Two hours into this process of trying to find a domain name.
• 31:17
  SPEAKER_00: I was just tired.
• 31:18
  SPEAKER_00: We're watching Star Wars in the back.
• 31:19
  SPEAKER_00: And I needed this done that day because I had a term sheet, and literally the VC needed a name to put on the term sheet.
• 31:26
  SPEAKER_00: So uh my brother-in-law were and I were just joking around and he said, Well, let's try some Star Wars stuff.
• 31:32
  SPEAKER_00: And so I have to give him credit.
• 31:33
  SPEAKER_00: You know, Endor was the name that came from him, which is a forest moon.
• 31:37
  SPEAKER_00: It actually plays very nicely with the David and Goliath kind of storyline at Endor, you know, where the underdogs in security helping secure the world.
• 31:46
  SPEAKER_00: And we play a lot of Endor and Star Wars themes around here, and like the team really wanted Darth Vader around here.
• 31:54
  SPEAKER_00: And we also have Ewoks and little Ewok squishies around, and we call our employees Ewoks.
• 32:00
  SPEAKER_01: So you mentioned that today, for any founder, the market is obviously not in control.
• 32:05
  SPEAKER_01: Their product roadmap is also not in control.
• 32:08
  SPEAKER_01: So, what are the things that are really in control?
• 32:11
  SPEAKER_00: Um, I think the number one thing that is in control is the quality of talent you bring into the company, right?
• 32:18
  SPEAKER_00: So that is non-negotiable because you may think you're building A, you might end up building B.
• 32:24
  SPEAKER_00: Uh, you need the people that are first principles, system thinkers that will basically out-hustle the market.
• 32:32
  SPEAKER_00: So that's one.
• 32:33
  SPEAKER_00: The second thing you control is the culture you define in the company and some of the core things, like for us, customer obsession is critical.
• 32:42
  SPEAKER_00: In times of uncertainty, how do I decide if I do A versus B versus C?
• 32:47
  SPEAKER_00: We believe in our customers, we believe in understanding deeply their businesses, their pains, and understanding how to help them navigate it.
• 32:54
  SPEAKER_00: Because if we can help them navigate their challenges, we will win because then by nature we'll build a good product.
• 33:01
  SPEAKER_00: Uh, and the third thing I think fundamentally is I think entrepreneurship is not just always about solving the hardest unsolved problem.
• 33:09
  SPEAKER_00: It's about solving a large problem in the most practical way with the best distribution and reach you can create.
• 33:19
  SPEAKER_00: So oftentimes I talk to founders that I, you know, will come to me for advice saying, look, I've solved such a hard problem, but I can't get people's attention.
• 33:25
  SPEAKER_00: I'm like, maybe you solved a really, really hard problem, but did you connect it to what the customers' needs are?
• 33:30
  SPEAKER_00: The example I gave is if you're here in mainland USA and you're trying to build this amazing resort in a dream vacation place on an island, and you forget the transport problem, how are you gonna get people to come here to finally see your vision and realize your vision?
• 33:47
  SPEAKER_00: Then you miss the mark.
• 33:48
  SPEAKER_00: And so I always say you got to find a problem that is near-sighted for now, but there's a long path to build, and the arc is pretty uh significant.
• 33:57
  SPEAKER_00: And then work with your customers to get them there to the dreamland.
• 34:00
  SPEAKER_00: But don't be sitting there waiting for your customers, waiting where they are, because maybe you've missed the mark because you were just too far ahead.
• 34:09
  SPEAKER_01: And and how are you thinking about distribution this time?
• 34:13
  SPEAKER_01: And what have been some of the wins in distribution and GTM channels that you are built?
• 34:18
  SPEAKER_00: Look, this is this is always an interesting one, and I wouldn't say that I have solved it end-to end.
• 34:23
  SPEAKER_00: I think we are continuing to iterate on it.
• 34:25
  SPEAKER_00: Um I think to me, tactics have shifted.
• 34:29
  SPEAKER_00: For example, so we first and foremost, we are an enterprise-led, sales-focused company.
• 34:34
  SPEAKER_00: We're not product-led, we're not open source.
• 34:37
  SPEAKER_00: But even in enterprise, right?
• 34:39
  SPEAKER_00: 10 years ago, we would have big booths, large conferences, we would collect leads, we would follow up in leads, and we would close business.
• 34:45
  SPEAKER_00: I think today that doesn't work.
• 34:47
  SPEAKER_00: I think events are great to meet people you're already talking to, but not like the big funnel of people that you get leads for.
• 34:55
  SPEAKER_00: I think a lot of how people want to buy today and be sold to is independent research.
• 35:02
  SPEAKER_00: Like they, you have to be in the community, you have to have thoughtful content.
• 35:07
  SPEAKER_00: Um, you have to be in the places where they're doing their research about the space, about your competitors, about you.
• 35:14
  SPEAKER_00: Um, and you have to win them over without them having ever talked to you.
• 35:20
  SPEAKER_00: Because I feel like 80% of the buyer's decision about who they're gonna go with for enterprise technology is made before they have the first sales call with you.
• 35:28
  SPEAKER_00: So I look at that as a core part of opportunity or challenge and say, how do you build go-to-market messaging, brand, thoughtfulness, um, social proofs to make sure that people before they ever talk to you have already been won over by you, uh, even though you're not a PLG company.
• 35:49
  SPEAKER_01: Can you give some examples like where customers found of you from which reports?
• 35:54
  SPEAKER_00: Yeah.
• 35:55
  SPEAKER_00: I'll give you one concrete example.
• 35:57
  SPEAKER_00: We, you know, there's lots of benchmarks about how functionally correct the code is.
• 36:03
  SPEAKER_00: And we said, well, look, everybody's talking about, oh, the coding agents are so good because they can write functional code, but there's no benchmarks that exist to talk about how securely they are writing that code.
• 36:13
  SPEAKER_00: So we said, what can we do?
• 36:15
  SPEAKER_00: Carnegie Mellon and Columbia Universities were working on some research in their labs.
• 36:19
  SPEAKER_00: We partnered with them, we took harnesses that were believable and benchmarks that they had built, not us.
• 36:25
  SPEAKER_00: As a vendor, how are you gonna believe my benchmarks?
• 36:28
  SPEAKER_00: We took that, we invested around that, and we created the entire infrastructure and investment plan where now, every time there's any new model released within 24 to 48 hours, we will test the security efficacy as well as functional efficacy, and we'll publish those results.
• 36:44
  SPEAKER_00: It's called Agent Security League.
• 36:46
  SPEAKER_00: What does it do?
• 36:46
  SPEAKER_00: It just brings people, you know, there's conversation, people are sharing some of these benchmarks.
• 36:50
  SPEAKER_00: Those benchmarks are created by this company called Endoor Labs.
• 36:53
  SPEAKER_00: Maybe people will want to know what Endoor Labs does, how it can help.
• 36:57
  SPEAKER_00: But like we do a lot of unique research.
• 37:00
  SPEAKER_00: We've invested heavily on the research side of this company.
• 37:04
  SPEAKER_00: We uh, if you look at our blogs, most of our blog posts are written by engineers, not by marketing people and salespeople.
• 37:12
  SPEAKER_00: So we're very thoughtful about the depth and quality of the content we create.
• 37:16
  SPEAKER_00: So those would be a couple of examples.
• 37:19
  SPEAKER_01: So, but you're still going to these conferences?
• 37:21
  SPEAKER_00: Yes.
• 37:22
  SPEAKER_00: But we're going from a perspective of not let's have the biggest booth and let's lead scan, but it's presence and like again, it's the halo effect, right?
• 37:31
  SPEAKER_00: When somebody is ready to buy, they will come to us and want to talk to us because they have seen us at places, their friends talk about how great our product is, they have the best experience, we have solved really hard problems, they're seeing good quality research from us in the learning.
• 37:47
  SPEAKER_00: So, you know, you never know when a buyer is ready to engage, but you want to be there at the time and you want to be the top name in their mind when they're ready to engage in a problem that you can solve.
• 38:00
  SPEAKER_00: And so we create a lot more of that halo effect, the community, the content.
• 38:04
  SPEAKER_00: As an example, last week was Black Hat, one of the largest cybersecurity conferences in Las Vegas.
• 38:09
  SPEAKER_00: We didn't have a booth, but we had this incredible restaurant we had taken over inside the convention center that everybody had to pass through to get to the booth.
• 38:19
  SPEAKER_00: We had brunches and lunches and talks and dinners, and people could walk in, spend five minutes, relax, sit down, have a coffee, follow along, move along.
• 38:28
  SPEAKER_00: There's no sales pressure, there's nobody coming in, like, you know, forcing you to take certain actions to get in there.
• 38:34
  SPEAKER_00: And and you know, our hope is it's a memorable thing people leave behind with.
• 38:39
  SPEAKER_01: What are some of the things, you know, in Red Lock uh that you were not doing that you learned on distribution at Polo?
• 38:50
  SPEAKER_00: It's a good question.
• 38:52
  SPEAKER_00: Um look, I think the biggest thing is just scale and density, right?
• 38:56
  SPEAKER_00: As a startup, you're very scared about like I was, I'm a frugal guy.
• 39:01
  SPEAKER_00: I mean, you know, I I've come from where we had$10 million to go build and scale Radlock.
• 39:09
  SPEAKER_00: Um and what you realize, especially today, more so than ever, is the noise in the spaces is too high.
• 39:15
  SPEAKER_00: You have to build all the way to and get much closer and have the density.
• 39:20
  SPEAKER_00: Like if your competitor has 300 reps and you have three reps and you feel really good about your win rates, the problem is 98% of those conversations you're not even a part of.
• 39:31
  SPEAKER_00: So, and and Wiz did this really well, right?
• 39:34
  SPEAKER_00: You have to blitz really fast.
• 39:36
  SPEAKER_00: Like when you feel like you have product market fit and repeatability, you have to scale faster.
• 39:41
  SPEAKER_00: It's a bold move, it's a scary move, it requires heavy capital investment.
• 39:46
  SPEAKER_00: Because, like with sales, you know, you've got ramp times and other things, but you've got to do it fast.
• 39:51
  SPEAKER_00: The other thing that I'm a big believer in is you can't go at it alone.
• 39:55
  SPEAKER_00: So, like the alliances, the channel, the partnerships matter even more because the customers want a holistic problem to be solved.
• 40:04
  SPEAKER_00: No matter how much you try, you will solve maybe some part or a big part of that problem, but not chances are not the entirety of the problem.
• 40:13
  SPEAKER_00: So you have to pair up with the right like-minded companies where you have technical alignment, but also core fundamental alignment on ICP and um core how you sell and how you position.
• 40:25
  SPEAKER_00: And then you can take much stronger outcomes to the customer that don't necessarily have to be delivered by one company.
• 40:33
  SPEAKER_01: So, so a lot around how to build an ecosystem.
• 40:37
  SPEAKER_01: Yeah.
• 40:39
  SPEAKER_00: How to build an ecosystem, how to build trust with buyers, not be transactional.
• 40:45
  SPEAKER_00: Um I would say are probably the two big things.
• 40:49
  SPEAKER_01: And can you share an example of how at Endor, without selling, you are building trust with the buyer?
• 40:55
  SPEAKER_00: Um I think the you know, the the examples I gave you going back to the Asian Security League.
• 41:01
  SPEAKER_00: Um one of the core beliefs in this company is most of the content on our website is not gated.
• 41:07
  SPEAKER_00: You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper.
• 41:14
  SPEAKER_00: Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser.
• 41:19
  SPEAKER_00: When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website.
• 41:26
  SPEAKER_00: So everything is gated, a webinar is gated, and this is gated, and that is gated.
• 41:30
  SPEAKER_00: So I think that's one example.
• 41:32
  SPEAKER_00: The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other.
• 41:49
  SPEAKER_00: Um, that's another one.
• 41:51
  SPEAKER_00: Another one is like all of my sales team and go to market team.
• 41:53
  SPEAKER_00: Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner.
• 42:08
  SPEAKER_00: We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense.
• 42:18
  SPEAKER_01: And let's say who would be the other players in this market that you respect in app security and code security?
• 42:27
  SPEAKER_00: Uh that's a that's a good question.
• 42:30
  SPEAKER_00: Look, I think the um the question I think I I maybe answer that slightly differently is where are the most logical places that we can insert security that is most native to the experience?
• 42:44
  SPEAKER_00: And I would say like GitHub comes up as an obvious answer, right?
• 42:48
  SPEAKER_00: If if you could have security just be transparent, you don't even know it is there, it just works.
• 42:56
  SPEAKER_00: Developers love GitHub.
• 42:58
  SPEAKER_00: If you and I think GitHub had initially made some really good investments, you know, I think over the last year or so they're trying to figure out their strategy on some of these things.
• 43:07
  SPEAKER_00: But I have a high degree of respect for GitHub for what they've delivered around that.
• 43:11
  SPEAKER_00: Um, so I think that's one.
• 43:13
  SPEAKER_00: Uh beyond that, I think without naming specific companies, I'll say there are there are some of them that have truly taken the pain of figuring out what are real developer problems.
• 43:27
  SPEAKER_00: Let's not just build another compliance reporting tool.
• 43:30
  SPEAKER_00: But like what are real problems in the workflow and solve them?
• 43:33
  SPEAKER_00: And I think those companies that will tend to do well versus ones that'll put some checkboxes.
• 43:38
  SPEAKER_01: So let's say now coding market is getting reimagined.
• 43:43
  SPEAKER_01: Uh so what percentage of coding market would be the app security and the code security market?
• 43:52
  SPEAKER_00: So it's a great question.
• 43:53
  SPEAKER_00: And I kind of maybe go tie back to starting with the at the very top.
• 43:57
  SPEAKER_00: Most companies security budget is about 6 to 8% of IT budget.
• 44:06
  SPEAKER_00: Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS?
• 44:19
  SPEAKER_00: He said probably about the same.
• 44:22
  SPEAKER_00: We solved this problem first at Red Lock and PrismaCloud.
• 44:25
  SPEAKER_00: Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent.
• 44:34
  SPEAKER_00: So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security.
• 44:49
  SPEAKER_00: Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example.
• 44:57
  SPEAKER_00: The GitHub Enterprise License costs about$25, give or take, as a number, right?
• 45:04
  SPEAKER_00: Per developer per month.
• 45:06
  SPEAKER_00: GitHub's own security product add-on to this costs about$50.
• 45:13
  SPEAKER_00: So you can argue and say security is twice as much of value than the core GitHub.
• 45:20
  SPEAKER_00: So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along.
• 45:29
  SPEAKER_01: And do you imagine like how much people pay on cloud security and infra security, they would pay the same for code security and app security also?
• 45:41
  SPEAKER_00: Probably more.
• 45:42
  SPEAKER_00: Probably more.
• 45:44
  SPEAKER_01: Why?
• 45:45
  SPEAKER_00: Um just where in the value chain you sit.
• 45:47
  SPEAKER_00: Like if you think about it, like your revenue as a company, right?
• 45:51
  SPEAKER_00: If I'm Snowflake or MongoDB, my product, my software is my revenue.
• 45:58
  SPEAKER_00: I exist as a public company because of my software.
• 46:02
  SPEAKER_00: If I lose trust or erode trust, or there's an incident, or there's a security issue that affects my customers and my software, overnight I will erode 10 to 20% of my market cap.
• 46:15
  SPEAKER_00: That's probably 20, 40 billion dollars.
• 46:19
  SPEAKER_00: Will be eroded overnight if I have a security incident in my software.
• 46:24
  SPEAKER_00: So I think your software, if software is your business and your lifeline, security matters significantly.
• 46:32
  SPEAKER_01: But let's say for non-software companies like Ford or GM, General Motors, or anybody else, wouldn't that be still be critical for them?
• 46:42
  SPEAKER_00: Great question.
• 46:42
  SPEAKER_00: I guess the the thing I would ask you back is which company is not a software company today?
• 46:48
  SPEAKER_00: Do you think GM and Ford can operate without connected cars?
• 46:52
  SPEAKER_00: What if, and there's been lots of uh public um research on hacking cars?
• 46:58
  SPEAKER_00: How are the cars hacked?
• 47:00
  SPEAKER_00: Not through the engine, from the software.
• 47:01
  SPEAKER_01: Yeah.
• 47:02
  SPEAKER_00: What happens if somebody hacks and crashes cars now on the highway?
• 47:07
  SPEAKER_00: So I think software fuels the world.
• 47:10
  SPEAKER_00: Um yes, hardware is back again, not dismissing that, but software still fuels the world.
• 47:16
  SPEAKER_00: And I think any company where the core of your product somehow fits in software, maybe it's not more than 10%, but I think on a base case it should be 10% spent on your overall IT budget for code security as well.
• 47:30
  SPEAKER_00: Uh maybe take it from a different lens, okay?
• 47:34
  SPEAKER_00: Most companies I talk to, the engineering teams spend 20 to 30% of their time on just security issues.
• 47:43
  SPEAKER_00: Follow-ups, bugs, security bug fixes, vulnerability remediation, pen test report.
• 47:50
  SPEAKER_00: So take that and say, if I can give you back half of that, that economic impact is about 15% of your total payroll cost, fully loaded headcount cost of your engineers.
• 48:06
  SPEAKER_00: So if I'm gonna do that, arguably if you spend, you know, we're sitting in the Bay Area, so let's talk Bay Area salaries.
• 48:12
  SPEAKER_00: You're spending$300,000 a year on um an engineer's salary.
• 48:18
  SPEAKER_01: Yeah.
• 48:19
  SPEAKER_00: If$90,000 worth of their time is spent on security, and I can fix that for$9,000 a year, I think you would happily pay that.
• 48:28
  SPEAKER_01: Yeah.
• 48:29
  SPEAKER_00: Right.
• 48:30
  SPEAKER_00: And now is$9,000 a year for that security solve on where you're spending$300 for their GitHub license, you would still pay that if I can create the value connectivity and prove to you that I can give you back$90,000 worth of efficiency.
• 48:46
  SPEAKER_00: So that's how I think about kind of value-based selling.
• 48:49
  SPEAKER_01: And today, um, out of Fortune 500, how many logos would you have?
• 48:54
  SPEAKER_00: Look, I think what's interesting about our business is for the reasons we were just having this conversation on like software is the lifeline for tech businesses.
• 49:07
  SPEAKER_00: Um, a lot of our customers end up started out being the tech companies, companies like DoorDash companies, like the big labs that I can't name here on uh on air.
• 49:19
  SPEAKER_00: Cursor is a customer, Glean's a customer, Atlassian, MongoDB, Snowflake, Peloton, Robinhood.
• 49:27
  SPEAKER_00: So I think for us, where we were trying to drive efficiency are the companies that were really manically focused on that.
• 49:33
  SPEAKER_00: So you know, they weren't your legacy Fortune 500s, if you will.
• 49:36
  SPEAKER_00: But you know, over time we have several Fortune 500 companies, several of the world's top insurers, financial services.
• 49:42
  SPEAKER_00: But just as a metric, we focus and fixate less as our claim to success being the Fortune 500, versus we we kind of look at it more as are the world's most prolific software companies, how of those, how many are using an Endor?
• 49:55
  SPEAKER_00: And that number continues to uh you know go up and to the right.
• 50:01
  SPEAKER_01: And engineering wants to shift faster, always, right?
• 50:04
  SPEAKER_01: And never been fast as today.
• 50:07
  SPEAKER_01: And security wants to hold back and slow things down, making sure nothing breaks.
• 50:11
  SPEAKER_01: So you think that uh the equilibrium has further distorted than five years ago?
• 50:18
  SPEAKER_00: I I think it's a challenge and opportunity.
• 50:20
  SPEAKER_00: For sure, we're producing more code than ever before.
• 50:22
  SPEAKER_00: And so the bottleneck is no longer code generation.
• 50:24
  SPEAKER_00: That's not your constraint.
• 50:25
  SPEAKER_00: Generation is a solved problem.
• 50:27
  SPEAKER_00: Everything after that is where the bottlenecks are, security being a major one, quality being another one.
• 50:33
  SPEAKER_00: Um but yeah, I I think I think as people are moving even faster, now security looks like even slower because of that reason, unless they're retoolable.
• 50:44
  SPEAKER_00: And and I think this is also a great opportunity because all of the things that were unsolvable security problems, you can now do more efficiently with agents.
• 50:54
  SPEAKER_00: And so I think the whole idea here at Endoor Labs is how do you use a genetic software security solution to keep up and deliver far more effective security programs.
• 51:03
  SPEAKER_01: So, how do how do you make uh the engineering team and the secure team work in in uh in the same harmony at the same pace?
• 51:13
  SPEAKER_00: Yeah, I think it comes down to the metrics of what what matters to you.
• 51:16
  SPEAKER_00: It was the example I was giving you on cost efficiency.
• 51:18
  SPEAKER_00: What matters to the CTO is can they move fast and can they ship fast?
• 51:23
  SPEAKER_00: No CTO in the world wants to ship an unsafe application, but that's not the core metric.
• 51:28
  SPEAKER_00: Like I don't know too many engineering teams that are obsessing about security, they're obsessing about speed and quality.
• 51:34
  SPEAKER_00: And so for us, it's like we always think about Endor and our products called ORE, our platform, eugenic platform.
• 51:41
  SPEAKER_00: Even actually, the icon of ORE is a bridge.
• 51:44
  SPEAKER_00: And that's supposed to be a bridge between security and engineering team.
• 51:47
  SPEAKER_00: Security wants to move fast, we need to give them the tools to move.
• 51:50
  SPEAKER_00: Uh sorry, engineering needs to move fast, we need to give them the tools to move fast.
• 51:54
  SPEAKER_00: Security needs to move safe, we need to give them the tools to move safe.
• 51:57
  SPEAKER_00: The connective tissue is the developers should never get out of their workflow and should have minimal interrupts.
• 52:03
  SPEAKER_00: So Endor runs where the developers are.
• 52:07
  SPEAKER_00: Security gets the report where they want it, and that's how we design our interfaces of our product.
• 52:12
  SPEAKER_01: We would love to know some of the stories of what went right, some of the visions that went right in Endor and what didn't go right as planned.
• 52:20
  SPEAKER_00: Um maybe let's actually I want to start with some of the going right versus going wrong dating back to my first startup.
• 52:28
  SPEAKER_00: Because I think it's you know learnings have begun from there.
• 52:32
  SPEAKER_00: Um as I kind of touched on briefly before, I have come to realize and appreciate just how important having the right talent is.
• 52:41
  SPEAKER_00: At CypherCloud, our first company, uh, my co-founder CEO was self-funding a lot of that.
• 52:48
  SPEAKER_00: And so I think initially, as a self-funded company, we're scrappy about talent.
• 52:52
  SPEAKER_00: There's a lot of good talent, but very young, early in career talent.
• 52:57
  SPEAKER_00: And we didn't round that up with the right mix of uh seniority and experience.
• 53:03
  SPEAKER_00: And I think long term there was just a lot of technical debt in that architecture and that platform.
• 53:08
  SPEAKER_00: Because yes, we could deliver features really, really fast, but it was hard to understand at what cost and what we were compromising in doing so.
• 53:16
  SPEAKER_00: So I think that was kind of one of my learnings from there was the quality of talent.
• 53:21
  SPEAKER_00: I'd rather have fewer people than like earlier and cheaper.
• 53:28
  SPEAKER_00: Um and I think today, though, that's become easier because you just don't need the same volume of people with AI.
• 53:35
  SPEAKER_00: You can do a lot more with fewer people.
• 53:37
  SPEAKER_00: So that was kind of one there.
• 53:38
  SPEAKER_00: At Redlock, um, one of my big learnings was like when you hire salespeople, hire in pairs.
• 53:45
  SPEAKER_00: What I mean by that is oftentimes people will be like, oh, I'm hiring my first salesperson.
• 53:49
  SPEAKER_00: And I always say when you're hiring the first salespeople, what first person, what territory are you gonna put them in?
• 53:56
  SPEAKER_00: Right, how people on the west coast of US Buy is very different from how people on the east coast of US buy.
• 54:03
  SPEAKER_00: Uh also, what background do you want somebody to be?
• 54:07
  SPEAKER_00: Uh, do you want a startup background or is a large company background okay?
• 54:11
  SPEAKER_00: So, you know, the individual's background matters.
• 54:14
  SPEAKER_00: And the third thing is with sales, unlike many other functions where like I'll know in the week or two weeks or three weeks if this is working or not, in sales, you may not know for six months, nine months, maybe even twelve months, if it's actually working or not.
• 54:28
  SPEAKER_00: And if it's not working, is the problem that individual?
• 54:31
  SPEAKER_00: Is it the accounts you're targeting or your um product?
• 54:35
  SPEAKER_00: And so at Redlock, I originally started with that following that principle of higher-end pairs.
• 54:40
  SPEAKER_00: I hired two people, and I'm so grateful I did.
• 54:42
  SPEAKER_00: I put one person in California, one person in New York.
• 54:46
  SPEAKER_00: And I would say the person in New York probably had way higher of a more experienced background and became way more well referred and reputable, et cetera, et cetera.
• 55:00
  SPEAKER_00: The person on the west was just scrappy.
• 55:03
  SPEAKER_00: And it turns out nine months later, the person on the west had closed five deals, the person on the east had closed zero deals.
• 55:13
  SPEAKER_00: And I swear, if I didn't have the person on the west coast, I would have believed that Redlock, we had built the wrong product.
• 55:21
  SPEAKER_00: The reality was we had not built the wrong product, we had built the right product.
• 55:25
  SPEAKER_00: We actually were even targeting the right kind of accounts, but the individual was going through some life issues, personal life issues, and other things we didn't know at the time, that was affecting their ability to execute and perform.
• 55:38
  SPEAKER_00: And that's very hard to tell.
• 55:41
  SPEAKER_00: So I think come like tying all of that together today to uh endor, and you kind of asking about like what's working, what's not, I think you you have to when you're looking for talent, you need to find people that are you finding them at the right point in their career?
• 56:01
  SPEAKER_00: Are they ready and and willing and understanding of what it takes to be in a startup?
• 56:07
  SPEAKER_00: Because they could be extremely successful where they are, but the fit of your company, your stage, and your needs matters way more than you think.
• 56:17
  SPEAKER_00: Because a lot of times we want that brand, right?
• 56:18
  SPEAKER_00: I want to be able to go to an investor and say, look, I have five engineers from Meta.
• 56:22
  SPEAKER_00: But are those five engineers from Meta the right background and DNA of what you need to go find product market fit on a zero-to-one product?
• 56:31
  SPEAKER_01: And what do you say in Endor, finding product market fit is as hard as Redlock?
• 56:37
  SPEAKER_01: Or has it become easier also as like a third-time founder?
• 56:40
  SPEAKER_00: I wouldn't say it's easier.
• 56:41
  SPEAKER_00: I think it's also not a fair comparison because um red lock was a market creation moment.
• 56:49
  SPEAKER_00: We were creating a new category of products to solve a new pain.
• 56:54
  SPEAKER_00: At Endor, we have been creating a new architecture and paradigm, an entirely new way of solving an age-old problem.
• 57:05
  SPEAKER_00: It's almost like we at Redlock, we were inventing cars.
• 57:09
  SPEAKER_00: Cars didn't exist.
• 57:12
  SPEAKER_00: At Endor, we are moving from gasoline to electric cars.
• 57:16
  SPEAKER_00: Like we've changed the entire drivetrain of what a car looks, what is possible with a car, and introduce those self-driving capabilities that you can actually believe are safe and can work and scale that didn't exist.
• 57:30
  SPEAKER_00: So I think there's a completely different structure of how to compare a market creation versus a market disruption.
• 57:39
  SPEAKER_00: Um, so that's kind of why I don't think it's a fair comparison.
• 57:44
  SPEAKER_01: Got but has it been easier or more difficult?
• 57:46
  SPEAKER_01: What would you say?
• 57:47
  SPEAKER_00: It's been different.
• 57:48
  SPEAKER_00: And I say that because when when you are creating a category, there's no incumbency.
• 57:55
  SPEAKER_00: So whatever you define either solves the problem or doesn't.
• 57:59
  SPEAKER_00: When you're disrupting an existing category that's been around for 20 years, you need to build the differentiation, but you've got to build the long tail of every other feature function that existing products have and support and integrations, because that's what a customer has been using for many years.
• 58:16
  SPEAKER_00: So they need all of that that they use, and they need a significant order of magnitude differentiation to go through the work and pain of removing an incumbent tool and swapping it out.
• 58:30
  SPEAKER_00: The thing that then shifted and put this into hyperdrive for Endor was when AI coding came along.
• 58:38
  SPEAKER_00: Because until AI coding came along, it was like, look, you've had this problem, you've tolerated it, now you need to change your way so you can get a better experience.
• 58:48
  SPEAKER_00: The AI coding agent disrupted entirely what a workflow looks like, what an agentic STLC, how you create software.
• 58:56
  SPEAKER_00: It completely disrupted this whole idea of, you know, today we're identifying 16 times more vulnerabilities than we can fix.
• 59:05
  SPEAKER_00: That gap has widened more in the last year than it has in the last 10 years.
• 59:10
  SPEAKER_00: That pain didn't exist for the last 10 years.
• 59:12
  SPEAKER_00: So I would say the hyperdrive is coming from AI coding agents are now saying, well, not only is this a disruption of an existing category, but it's an entire rewrite of the entire workflow of how you do the moving forward.
• 59:26
  SPEAKER_01: So hypothetically, if you imagine at a company, a tech forward company, if 100x more code is getting written, are the vulnerabilities also increasing by 100x?
• 59:39
  SPEAKER_00: Easily, yes.
• 59:41
  SPEAKER_00: Because I think the linear formula would say that.
• 59:51
  SPEAKER_00: It's not just you're creating more software, you're also creating them at a more faster pace.
• 59:56
  SPEAKER_00: The other challenge, I was with a CIO of a very large entertainment company.
• 1:00:01
  SPEAKER_00: And he said, Warren, look, my problem is not just I have citizen developers.
• 1:00:06
  SPEAKER_00: My finance team is building a forecasting app.
• 1:00:09
  SPEAKER_00: And we happened to go analyze that code, we found a security bug.
• 1:00:15
  SPEAKER_00: We emailed the individual who is writing that code, and we said, Here, could you please fix this vulnerability?
• 1:00:21
  SPEAKER_00: Do you want to guess what the response of that individual was to the security team?
• 1:00:25
  SPEAKER_01: I didn't create it.
• 1:00:26
  SPEAKER_01: The agent created it.
• 1:00:27
  SPEAKER_01: So please ask me.
• 1:00:28
  SPEAKER_00: Actually, even more fundamental, which is what's a vulnerability?
• 1:00:31
  SPEAKER_00: Like now you're talking about securing an ecosystem of code that is being generated 10 times faster with more security problems, but also the dynamics of the individuals you're working with, is you're going back to their baseline.
• 1:00:46
  SPEAKER_00: So at that point, to your, I basically where you're going with your idea is security just needs to be autonomous.
• 1:00:52
  SPEAKER_00: Security just needs to be handled for the user, not being something that a user needs to think about and be trained about.
• 1:00:59
  SPEAKER_00: And I think that opportunity exists.
• 1:01:01
  SPEAKER_00: Think about this.
• 1:01:02
  SPEAKER_00: For the last 20 years, for people who are on this podcast that are listening, that are software engineers.
• 1:01:09
  SPEAKER_00: Every year in your company you go through an annual security training.
• 1:01:14
  SPEAKER_00: They teach you how to write code.
• 1:01:15
  SPEAKER_00: But then there are 20,000 of you in the company.
• 1:01:18
  SPEAKER_00: Do we realistically believe that 20,000 people will remember and follow all the instructions on how to do things manually?
• 1:01:25
  SPEAKER_00: Unlikely.
• 1:01:26
  SPEAKER_00: But with agents, you can actually give agents consistent instructions to follow the same parameters if you can infuse that intelligence to them.
• 1:01:35
  SPEAKER_00: So like at Endor, our product infuses that intelligence into cloud code, into cursor, into codecs.
• 1:01:41
  SPEAKER_00: And just make sure when they are creating these loops of code, the security intelligence is fused in and they're instructed to fix the problems they're introducing right at the source.
• 1:01:51
  SPEAKER_00: And I think agents are far more capable to do that consistently than humans can.
• 1:01:55
  SPEAKER_00: I think that's the we've been talking a lot about like the risks of AI.
• 1:01:59
  SPEAKER_00: But that's the boon of AI.
• 1:02:00
  SPEAKER_00: We can now solve these problems that have been unsolved for 20 years, despite more volume, despite reduction in time we have to fix these differently.
• 1:02:11
  SPEAKER_00: And that's what I'm most excited about.
• 1:02:13
  SPEAKER_01: So uh at Endor, when the code is getting reviewed as it's getting written, is it completely autonomous?
• 1:02:24
  SPEAKER_00: It can be.
• 1:02:44
  SPEAKER_00: Some of our customers are in the everything is fairly autonomous unless it's a known large disruptive change, you gotta bring a human in the loop.
• 1:02:55
  SPEAKER_00: There are others that are still using our context to create gear tickets and not be in the developer workflow.
• 1:03:02
  SPEAKER_00: This goes back to my uh example of meet customers where they are and then take them to your promised land and dreamline.
• 1:03:11
  SPEAKER_00: If we had designed the product to just be autonomous, what would we do with all the customers that are not ready?
• 1:03:17
  SPEAKER_00: And so I think it becomes really important to think about designing your product for the masses.
• 1:03:22
  SPEAKER_00: And that's kind of where one of the common fallacies a lot of startups in Silicon Valley have is they'll talk to their friends in Silicon Valley, understand the problem, build a product, and be like, oh, well, nobody else is really thinking of it this way.
• 1:03:34
  SPEAKER_00: And so I always tell people when they're ideating, don't be in the bubble.
• 1:03:39
  SPEAKER_00: Get out of the bubble and go talk to you know the company that has a 40-year-old code base or has 100,000 employees worldwide that is regulated entirely differently than how Silicon Valley operates.
• 1:03:52
  SPEAKER_01: But but your agents are always watching the AI coding agents, whatever they be.
• 1:03:59
  SPEAKER_01: Yes.
• 1:03:59
  SPEAKER_00: So our security agents essentially get integrated into the um your favorite IDE, and they are established through workflow and requirements to be a step in the coding process.
• 1:04:17
  SPEAKER_00: So when Claude is iterating on your spec and writing the code, Claude's job is not done till it has gone through Endorse feedback on that code, seen what problems it introduced, fixed them, re-verified them, and when Endor says good, that's when the plan is complete.
• 1:04:36
  SPEAKER_01: So whose responsibility is that uh the Endor's plan is executed?
• 1:04:42
  SPEAKER_01: Is it Claude's responsibility?
• 1:04:44
  SPEAKER_01: Is it Endor's responsibility?
• 1:04:46
  SPEAKER_00: Uh it's a it's a shared responsibility.
• 1:04:49
  SPEAKER_00: It's the way you um insert the product into the workflow.
• 1:04:53
  SPEAKER_00: So with Claude, with Cursor, they're now giving you more and more tools to enforce certain tools to be run or certain actions to be taken.
• 1:05:01
  SPEAKER_00: And so using those things, specifically, uh Claude has something called Claude Hooks.
• 1:05:07
  SPEAKER_00: You can actually mandate deterministically that Claude has to abide by the instructions of Endor.
• 1:05:14
  SPEAKER_00: So that's how it works.
• 1:05:16
  SPEAKER_00: We use their configurations to put ourselves in the workflow.
• 1:05:22
  SPEAKER_01: So does Endor today become like a firewall, like omnipresent and um there are components of it that does.
• 1:05:32
  SPEAKER_00: Actually, it's interesting you bring up the word firewall.
• 1:05:35
  SPEAKER_00: With malicious open source, right?
• 1:05:37
  SPEAKER_00: I told you this is free for all.
• 1:05:39
  SPEAKER_00: You pull this, by the way, it'll surprise you to hear that the agents, a third of the time when they're recommending open source libraries and dependencies, they're making it up.
• 1:05:52
  SPEAKER_00: They are not real names, they're not real versions, or they're pulling really outdated stuff.
• 1:05:58
  SPEAKER_00: So if you think about the Firewall concept.
• 1:06:00
  SPEAKER_00: What Endor will do is any developer or any agent that is pulling an open source package or an open source model or a skill that is malicious, that has malicious instant intent because we're evaluating them, we can block them.
• 1:06:17
  SPEAKER_00: We actually call it a package firewall.
• 1:06:20
  SPEAKER_00: So in some use cases, yes.
• 1:06:22
  SPEAKER_00: But I think firewall also annotates a slightly different meaning to me, which in package firewall case is like a yes-no.
• 1:06:30
  SPEAKER_00: It's a guard at the gate.
• 1:06:33
  SPEAKER_00: We're not just a guard at the gate that is one use case.
• 1:06:36
  SPEAKER_00: It's also we're the fitness trainer, we're teaching that agents how to write more secure code for you.
• 1:06:42
  SPEAKER_00: We are your house manager, right?
• 1:06:46
  SPEAKER_00: When all of this pile of more new vulnerabilities comes in, we're figuring out what you need to fix, how to fix it, getting that job done for you.
• 1:06:53
  SPEAKER_00: So I think it's all of the above, right?
• 1:06:54
  SPEAKER_00: We we want to run your house as effectively as you can.
• 1:06:57
  SPEAKER_00: So we're a house manager, we're a cleaner, we're a security guard, all of that.
• 1:07:05
  SPEAKER_01: And uh, you know, one of the things, you know, before we dive into the last part of the podcast, which is Rapid Fire, uh, is you know, for the founders that are listening and their companies are in acquisition discussions, what have been some of your best learnings on the ground on acquisitions, on the process, price, getting multiple LOIs to make sure that, you know, uh in US the uh the LOI drop rate is one by third.
• 1:07:34
  SPEAKER_01: Like only one by three, one out of three LOI LOIs get converted into.
• 1:07:38
  SPEAKER_01: Yeah.
• 1:07:39
  SPEAKER_00: I think we can probably record a whole podcast on this topic.
• 1:07:43
  SPEAKER_00: Um in a rapid fire style, no particular order, I'll I'll share a few things.
• 1:07:47
  SPEAKER_00: One, you know, you can't when I start with saying as a founder, never a lot of people come to me and say, well, I'm just building this because I want to get acquired in the next year.
• 1:07:56
  SPEAKER_00: And I say, like, you're building for the wrong reasons then.
• 1:07:59
  SPEAKER_00: Um, your job is to be bought, not to sell.
• 1:08:04
  SPEAKER_00: And in order to do that, you have to be in a position of strength.
• 1:08:06
  SPEAKER_00: In order to be in a position of strength, you don't think about and build a company to get acquired.
• 1:08:11
  SPEAKER_00: You build it to be the best or the second best at worst case in whatever problem you're solving.
• 1:08:17
  SPEAKER_00: So I think that's one thing for me.
• 1:08:19
  SPEAKER_00: The second thing is these relationships start long before transactions.
• 1:08:23
  SPEAKER_00: So, you know, if you know that you would love to, or you think your target, ideal targets are these three companies, you should be finding ways to prove the better together stories years before.
• 1:08:35
  SPEAKER_00: A lot of times manifests as potential investment, strategic investment, could be them being a customer of your product, could them being doing co-selling of your product, there being technical integrations and value delivery.
• 1:08:47
  SPEAKER_00: So that value and engagement needs to start way before, months to years before a potential acquisition.
• 1:08:54
  SPEAKER_00: Because you want to show, like, this is so obvious.
• 1:08:56
  SPEAKER_00: Like, why aren't we doing more of this?
• 1:08:59
  SPEAKER_00: Um, most acquisitions also fail.
• 1:09:04
  SPEAKER_00: Like, I think you talked about the LOI rate.
• 1:09:05
  SPEAKER_00: I would say 90% of the acquisitions probably fail post-closing if just like didn't deliver the promise.
• 1:09:13
  SPEAKER_00: And as I've kind of inspected that much more closely as to why that happens, I think the fundamental mistake, the obvious mistake every company makes is great, I acquired this company.
• 1:09:23
  SPEAKER_00: There's 500 people from this company I acquired.
• 1:09:26
  SPEAKER_00: I'm a 5,000-person company, so guess what?
• 1:09:30
  SPEAKER_00: The hundred engineers will go into my 2,000-person engineering org.
• 1:09:34
  SPEAKER_00: And the 50 sellers will go into my thousand-person sales org.
• 1:09:39
  SPEAKER_00: And you know, and you just break the entire culture of the company.
• 1:09:45
  SPEAKER_00: And you'll usually put them under a GM of a business that likely has failed to solve this problem internally.
• 1:09:52
  SPEAKER_00: Because if they hadn't, you would have not gone out and acquired a company.
• 1:09:55
  SPEAKER_00: If you could have done it better, you would have.
• 1:09:57
  SPEAKER_00: You're buying this because it's an important problem to solve and you haven't been able to solve it fast enough or well enough.
• 1:10:02
  SPEAKER_00: And now you'll put this founder and this company under this individual.
• 1:10:07
  SPEAKER_00: And I think all of that is so wrong.
• 1:10:08
  SPEAKER_00: Because one, you take the entire existence of the company, is the culture and the operating rhythm that the startup has created to work together.
• 1:10:16
  SPEAKER_00: And you shouldn't, on day one, split it up and break it.
• 1:10:19
  SPEAKER_00: Maybe there's a day and time to do that.
• 1:10:20
  SPEAKER_00: But I think for until stabilized, you need to keep that unit as tightly coupled as possible to keep doing what they're doing while it's they integrate into your acquired company.
• 1:10:32
  SPEAKER_00: The second thing is there's something to be said about the founder hustle and the founder mindset.
• 1:10:36
  SPEAKER_00: And like there's instincts, there's a reason you were successful and the big company wasn't.
• 1:10:41
  SPEAKER_00: And so I think you have to be very careful in the dynamics of who's leading what part of the business.
• 1:10:46
  SPEAKER_00: And I think going kudos back to Nikesh and Palo Alto Networks, they were very good at making sure the founders were leaders of whatever this business was they were acquiring and were continuing to lead to the greatest degree possible their integrated teams, as is, with maybe more fuel, more capital, to scale faster.
• 1:11:05
  SPEAKER_00: Like the first thing wasn't break down the company, first thing was scale it 10 times faster and then go figure out the right natural multi-year uh evolution of the organization.
• 1:11:17
  SPEAKER_01: So, so in your case, did you have a relationship with Polo much before the acquisition happened?
• 1:11:23
  SPEAKER_00: Uh not besides when they bought my biggest competitor, they had also talked to us and perceived us to be too small at the time.
• 1:11:31
  SPEAKER_00: So, so no, we didn't have a actually my whole most of my rule on that one failed.
• 1:11:36
  SPEAKER_00: That was just a very unconventional um acquisition, to be honest.
• 1:11:40
  SPEAKER_01: So, why did they they they buy Red Lock when they had already bought the computer?
• 1:11:46
  SPEAKER_00: Uh because we were kicking their butt in the field.
• 1:11:48
  SPEAKER_00: Like we were we were a better long-term architecture that was multi-cloud.
• 1:11:56
  SPEAKER_00: Um and and frankly, I think that was one of the core pieces of like our architecture was much more extensible.
• 1:12:04
  SPEAKER_00: Like you could build, sell, and scale a lot more capabilities on the uh Redlock architecture than the evident I.O.
• 1:12:15
  SPEAKER_00: architecture.
• 1:12:15
  SPEAKER_00: I would say that's probably where it came down to the most.
• 1:12:18
  SPEAKER_00: And of course, the results in the field.
• 1:12:21
  SPEAKER_00: Like Palo Alto customers were preferring Redlock.
• 1:12:26
  SPEAKER_01: So they were hearing from their customers.
• 1:12:28
  SPEAKER_01: I think that's the best way.
• 1:12:30
  SPEAKER_00: That's right.
• 1:12:30
  SPEAKER_01: When you are able to beat them at their customers, which is a very tough thing to do for a younger startup.
• 1:12:36
  SPEAKER_00: Yeah.
• 1:12:36
  SPEAKER_01: With only$10 million raised.
• 1:12:38
  SPEAKER_00: Yes.
• 1:12:38
  SPEAKER_01: But today Palo Alto is a very different beast from that point in time, right?
• 1:12:44
  SPEAKER_00: Yes.
• 1:12:46
  SPEAKER_01: In your opinion, because you acquired nine companies for Polo, right?
• 1:12:51
  SPEAKER_01: What makes Polo so successful?
• 1:12:55
  SPEAKER_00: I think all the mistakes that I said most companies make, they don't make those mistakes.
• 1:13:01
  SPEAKER_00: They keep the units as closely together.
• 1:13:04
  SPEAKER_00: If you listen to a lot of Nikesh's public wisdom on MA, he says the same thing.
• 1:13:08
  SPEAKER_00: Usually the founder of the business, the CEO, or the founder specifically, will get to lead this business inside of Palo Alto Networks.
• 1:13:17
  SPEAKER_00: They will keep the unit as closely intact as together as they can.
• 1:13:23
  SPEAKER_00: I think it's really the mindset.
• 1:13:25
  SPEAKER_00: The mindset's not, hey, we're the bigger guys, we know what we're doing.
• 1:13:27
  SPEAKER_00: It's like we bought you because you're doing something right that we couldn't do.
• 1:13:31
  SPEAKER_00: And we want you to show us how it can be done even better at a bigger scale here.
• 1:13:36
  SPEAKER_00: And we'll give you the resources.
• 1:13:39
  SPEAKER_00: Like, think of it as you got a growth stage investor with a blank checkbook that's going to allow you to do everything you can with a long-term play in mind.
• 1:13:47
  SPEAKER_01: But but then uh every founder that Paulo acquires would stay for an infinite period of time.
• 1:13:53
  SPEAKER_01: Because if their incentives are aligned, they're getting infinite capital.
• 1:13:57
  SPEAKER_01: Why would they then go out?
• 1:14:00
  SPEAKER_00: Because remember, I told you at some point, it's unsustainable for Palo Alto to can't run 25, 30, whatever acquisitions they've done as 25 business units.
• 1:14:11
  SPEAKER_00: Some point these things at their natural point come together.
• 1:14:15
  SPEAKER_00: And look, that period of time is usually finite, two to three years.
• 1:14:20
  SPEAKER_00: Um I will say though, a lot of founders there have stayed on.
• 1:14:24
  SPEAKER_00: I stayed beyond my retention period and golden handcuffs period.
• 1:14:28
  SPEAKER_00: Others I know have stayed beyond.
• 1:14:29
  SPEAKER_00: So I will say Palo Alto is probably, by the track record, most successful at keeping founders around and motivated and excited to do what we do.
• 1:14:37
  SPEAKER_00: It's one thing to be on payroll and just be there.
• 1:14:40
  SPEAKER_00: It's another thing to be adding value and making a dent.
• 1:14:43
  SPEAKER_00: And I think a lot of people are very motivated, Paulo, to I think they've had the highest success rate in terms of odds of acquisitions that have done well.
• 1:14:54
  SPEAKER_01: So let's say if you start at some point of time acquiring companies at Endor, you would follow some of these principles.
• 1:15:02
  SPEAKER_00: Yeah, I think so.
• 1:15:03
  SPEAKER_00: Totally.
• 1:15:06
  SPEAKER_01: Now, you know, one liner's question on rapid fire.
• 1:15:10
  SPEAKER_01: What's one thing about AI you have changed your mind this year?
• 1:15:16
  SPEAKER_00: Um it's more real and more impactful than you know the pessimist side of me wanted to believe.
• 1:15:26
  SPEAKER_01: Three AI tools that you are using right now.
• 1:15:30
  SPEAKER_00: Um Claud Code, of course.
• 1:15:33
  SPEAKER_00: Um also codecs.
• 1:15:36
  SPEAKER_00: And um we have a new tool we use in marketing that is showing very promising results, which is called AirOps.
• 1:15:49
  SPEAKER_01: One interesting GTM hack that we never discussed during the podcast.
• 1:15:54
  SPEAKER_00: I think I think it's just as a founder, you never get away from being the best sales development rep in the company.
• 1:16:01
  SPEAKER_01: Uh founder, slash operator or slash investor, you wish that could be part of your team.
• 1:16:06
  SPEAKER_00: I think Nikesh is phenomenal, as I said, right?
• 1:16:09
  SPEAKER_00: Like I think his instincts on some things are incredible.
• 1:16:12
  SPEAKER_01: God.
• 1:16:12
  SPEAKER_01: A book that you would recommend for every founder?
• 1:16:16
  SPEAKER_00: Uh I'm not a big book by book guy.
• 1:16:18
  SPEAKER_01: Or a podcast or anything.
• 1:16:22
  SPEAKER_00: I think in the AI world right now, I'm I was very skeptical about the all in podcast.
• 1:16:27
  SPEAKER_00: And I think now and now recently there's just more insightful things coming out of there about just as a business, as regulation, as macro to think about.
• 1:16:35
  SPEAKER_00: So all in podcast is kind of back on the top of my list again.
• 1:16:39
  SPEAKER_01: Well, thank you so much, Varon.
• 1:16:40
  SPEAKER_01: I enjoyed a lot this conversation with you.
• 1:16:42
  SPEAKER_01: I learned a lot.
• 1:16:43
  SPEAKER_00: Thank you so much for having me.
• 1:16:45
  SPEAKER_01: It's been a pleasure.
• 1:16:46
  SPEAKER_01: Thank you so much.
• 1:16:47
  SPEAKER_00: Awesome.