Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 201: Varun Badhwar - securing the software supply chain with Endor Labs

Transcript

201: Varun Badhwar - securing the software supply chain with Endor Labs · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

0:32
SPEAKER_01: Barun Badwar is the CEO of Endor Labs.
0:36
SPEAKER_01: This is the third startup that he's founded.
0:38
SPEAKER_01: The first was sold to Lucad and the second to Palo Alto.
0:42
SPEAKER_01: So as he's starting Endor, he's drawing on his experiences from the first two companies.
0:47
SPEAKER_01: Listen out for how he is keying into a big driver today of not giving security teams a ton more alerts to chase down, the characteristics of the salespeople he likes to hire, and finally whether he prefers a cocktail bar or a dive bar.
1:03
SPEAKER_01: Don't go away.
1:19
SPEAKER_01: I am your host, Andrew Monahan.
1:21
SPEAKER_01: Our guest today is Varun Badwar, founder and CEO of Endoor Labs.
1:26
SPEAKER_01: Varun, welcome to Sales Bluebird.
1:29
SPEAKER_00: Thanks so much for having me, Andrew.
1:31
SPEAKER_00: Excited to be here.
1:32
SPEAKER_01: Yeah, this is going to be an interesting conversation, I think, for me and the audience.
1:36
SPEAKER_01: This is not your first rodeo.
1:38
SPEAKER_01: You've you started uh you founded a couple of companies already, and therefore you know you've got the experience of of uh starting and scaling as well.
1:46
SPEAKER_01: So I'm keen to get into some of that and learn from you about how you've how you've done that in the past and how you're doing it this time around.
1:54
SPEAKER_01: A quick break to say that this episode is sponsored by IT Harvest.
1:59
SPEAKER_01: With over 3,200 vendors in cybersecurity, it is hard to keep track of all the latest developments as well as research and analyze categories and subcategories within cybersecurity, which is where the IT Harvest cybersecurity platform comes in.
2:16
SPEAKER_01: Want to know which subcategories in cloud security are growing the fastest?
2:20
SPEAKER_01: You'll get it in a few clicks.
2:22
SPEAKER_01: Want to know and track everything about your main competitors and keep up with their hiring and news?
2:28
SPEAKER_01: Simple search to be done.
2:30
SPEAKER_01: Want to know the top 20 fastest growing companies based out of Israel?
2:34
SPEAKER_01: Easy, just a couple of clicks to get that.
2:36
SPEAKER_01: IT Harvest is the first and only research platform dedicated to cybersecurity.
2:42
SPEAKER_01: And it's run by Richard Steenan, who has done it all in cybersecurity.
2:47
SPEAKER_01: From the VP of researcher Gartner, a CMO at a cybersecurity vendor, a lecturer on cybersecurity, advisor to startups, advisory board member at startups, and a main board member as well.
2:59
SPEAKER_01: The whole lot.
3:00
SPEAKER_01: Find out more by going to salesbluebird.com slash research.
3:05
SPEAKER_01: That's salesbluebird.com slash research.
3:09
SPEAKER_01: Now back to the episode.
3:13
SPEAKER_01: Well, let's talk about uh your background, Vern.
3:16
SPEAKER_01: So uh I looked on your LinkedIn resume here, and uh you started back in security.
3:24
SPEAKER_01: Looks like when you co-founded CypherCloud in 2010.
3:28
SPEAKER_01: Although you might no, you've I uh KPMG were involved in cybersecurity as well.
3:33
SPEAKER_01: Um you co-founded CypherCloud in 2010, and then also Redlock in 2015.
3:40
SPEAKER_01: Redlock was acquired by Palo.
3:43
SPEAKER_01: Was CypherCloud acquired by someone?
3:45
SPEAKER_00: Uh it was acquired by Lookout.
3:47
SPEAKER_00: Okay.
3:53
SPEAKER_01: I was talking to someone from Lookout the other day.
3:55
SPEAKER_01: And that makes sense.
3:56
SPEAKER_01: Um, so both of those, and then fast forward to September 2021, according to your profile here, you founded Andor Labs.
4:05
SPEAKER_01: Why don't you take us back to that moment in time when you're sitting there somewhere with someone else or on your own, thinking, you know, I might just do this as a company.
4:15
SPEAKER_01: There's something to be solved here that's really important.
4:17
SPEAKER_00: Yeah, Andrew, I consider myself a student of the business, and honestly, um, kind of taking you back to the story, there was nothing wrong with Palo Alto Networks.
4:24
SPEAKER_00: We were having a great run with Prisma Cloud, but uh you might recall a couple of years ago when the solar winds incident happened, you know, it was kind of a wake-up call for the industry.
4:33
SPEAKER_00: Certainly, a lot of boards, including the Palo Alto Networks board, was asking a lot of questions of the different business leaders and security leaders, you know, to just give them assurance that we're all kind of prepared for the next solar winds attack in our own businesses and running one of the fastest growing parts of the Palo Alto portfolio of Prisma Cloud.
4:52
SPEAKER_00: You know, we were top of mind for everybody.
4:54
SPEAKER_00: And in just starting to educate myself and understand more around software supply chain challenges, I uncovered that there were more questions than answers.
5:04
SPEAKER_00: I think we had all underinvested and underestimated what could happen when kind of people have access into your source code.
5:12
SPEAKER_00: I think for the most part, organizations think about source code and they used to think about, oh, a contractor or an employee walks out of our door with a USB stick and takes our IP and sells it outside.
5:21
SPEAKER_00: You know, SolarWinds was the first time we actually recognized weaponization of code.
5:26
SPEAKER_00: We, our code, our software products could be weaponized and used against our users and employees.
5:32
SPEAKER_00: And in that journey, I think the biggest learning for me was we were now in a point where most organizations were writing minority of the code and borrowing majority of modern application code from open source.
5:46
SPEAKER_00: So over 80% of modern application code, Andrew, is open source.
5:51
SPEAKER_00: And the way our developers introduce this code is pretty ad hoc, right?
5:56
SPEAKER_00: A developer receives instructions from a product team to go build something.
6:00
SPEAKER_00: They start the first thing they want to look at is it's like an assembly line.
6:03
SPEAKER_00: What components can I use from the internet?
6:05
SPEAKER_00: And there's not a lot of diligence or consistent process in which you determine what you're using.
6:12
SPEAKER_00: And you know, these so-called suppliers aren't really suppliers.
6:15
SPEAKER_00: These are strangers on the internet that owe you nothing.
6:18
SPEAKER_00: There's no contracts, there's no agreements, and you're basically relying and at the mercy of their technology and their software to run your critical business applications.
6:27
SPEAKER_00: And to me, that was a wake-up call.
6:29
SPEAKER_00: And the kind of next question becomes, well, how are we securing and governing all this?
6:33
SPEAKER_00: And there weren't a lot of good answers.
6:34
SPEAKER_00: And so I said, Am I crazy or is the industry dealing with this challenge?
6:38
SPEAKER_00: And it looked like the industry was dealing with this challenge.
6:41
SPEAKER_00: At which point, like I said, student of the business, you know, the mindset was if everybody's struggling here, let's go figure out the best way to solve this problem.
6:49
SPEAKER_00: Because open source is here to stay.
6:51
SPEAKER_00: And more and more companies and products are now going to consume open source software.
6:55
SPEAKER_01: So you were at uh Palo then thinking about running the Prisma Cloud business, thinking about all these different components that may or may not have been in the code, um, and wondering there must be a different way.
7:07
SPEAKER_01: There must be, someone must have corrected this already, surely.
7:10
SPEAKER_01: And you kind of look out there and go, well, actually, not so much.
7:14
SPEAKER_00: Yeah, so uh, Andrew, there there had been certain approaches, but those were predominantly focused on license compliance.
7:21
SPEAKER_00: Uh, and the second piece was really around vulnerability compliance from a security standpoint.
7:27
SPEAKER_00: But I I use this term compliance very explicitly here because I'm sure we can debate this all day, but compliance doesn't necessarily equal security.
7:35
SPEAKER_00: Also, vulnerabilities are not the only way things can go wrong in open source software usage.
7:41
SPEAKER_00: In fact, there's a lot of um challenges engineers have with managing it, with maintaining it, with securing it, with addressing issues.
7:49
SPEAKER_00: And then if you might remember Log4A about a year ago, right?
7:53
SPEAKER_00: Lots of security practitioners ruined their Christmas and New Year plans, and so did engineering teams trying to scour where in the enterprise they were using LogForge and how to go remedy that situation.
8:05
SPEAKER_00: And I think all of those learnings just kind of came at the right time to say we need a better life cycle approach to manage our usage and reliance of open source software.
8:16
SPEAKER_00: And along the same time, we have seen the US government get ahead of this with regulation, with the executive order, you know, talks about software bills and materials.
8:26
SPEAKER_00: We can get into what that is and why that matters.
8:29
SPEAKER_00: But most importantly, the US government calls open source software a national security issue today.
8:34
SPEAKER_00: And so I think we're in a very timely place addressing a pretty critical challenge.
8:38
SPEAKER_01: So you said it goes beyond just scanning for vulnerabilities and compliance.
8:43
SPEAKER_01: What is that next level?
8:44
SPEAKER_01: What's the secret sauce of Endrower that says we're doing it different to everyone else?
8:49
SPEAKER_00: Yeah, there's there's three main things, Andrew.
8:51
SPEAKER_00: First and foremost, when your developers are deciding to use open source software, how do you actually give them a way to measure both security but also operational risk around what they're intending to use?
9:04
SPEAKER_00: This is right at the point of onset where they're considering something.
9:08
SPEAKER_00: How do we know who the humans are?
9:10
SPEAKER_00: How do we know who the uh supporters behind this project are?
9:14
SPEAKER_00: How well supported is it, how well funded is it, is it got good quality practices?
9:19
SPEAKER_00: Do they have good documentation?
9:20
SPEAKER_00: Do they follow good security practices?
9:22
SPEAKER_00: Somebody needs to quantify this.
9:24
SPEAKER_00: Uh, the analogy I draw here is Andrew's imagine when you were buying uh used cars without a car fax report.
9:31
SPEAKER_00: That's kind of how we use open source software.
9:33
SPEAKER_00: And I want to know before I use open source software, is there a salvage title?
9:37
SPEAKER_00: Is there mileage fraud?
9:38
SPEAKER_00: Is there an accident?
9:39
SPEAKER_00: Is it well maintained?
9:41
SPEAKER_00: You know, and we don't have that mechanism.
9:43
SPEAKER_00: So the first thing that Endor is solving is really around the selection process of how your developers and engineers even decide what they should use.
9:51
SPEAKER_00: And how do you as an organization govern that process through policy and automation?
9:56
SPEAKER_01: So I would imagine, let me just cut in.
9:58
SPEAKER_01: So there must be a bit of friction there.
10:00
SPEAKER_01: Because if I'm a developer and I'm moving fast, I'm writing my code and I know this library over here or this code base over there, I just know it.
10:08
SPEAKER_01: I know it's be so good.
10:09
SPEAKER_01: I just want to start using it.
10:10
SPEAKER_01: And then you've got someone above saying, well, let's just tap the brakes just a second and make sure we're not taking on something we shouldn't be taking on.
10:17
SPEAKER_01: Am I am I reading that dynamic right?
10:19
SPEAKER_00: In a traditional sense, maybe, but if you really think about this holistically, does an engineer want to be paged on a weekend because the application has gone down because of a bug in an open source project?
10:29
SPEAKER_00: Probably not.
10:29
SPEAKER_00: Let's forget even security aside, right?
10:31
SPEAKER_00: Poor quality of the code, or there's an API-breaking change in a new update.
10:36
SPEAKER_00: Nobody wants to deal with that.
10:38
SPEAKER_00: And I always say this developers aren't ill-intentioned.
10:40
SPEAKER_00: If you give them the data, if you inform them of the risks, both security and operational, everybody tries to do the right thing.
10:48
SPEAKER_00: The problem today is we're just blindsided.
10:50
SPEAKER_00: We're not helping them understand all of those risks, basis of which they can make those decisions.
10:55
SPEAKER_00: So knowledge is power.
10:56
SPEAKER_00: Let's start with putting that information in front of them.
10:59
SPEAKER_00: Now, if they choose to ignore it, as an organization, you could enforce that down the road in your pipelines, but certainly let's start with bringing the information together.
11:07
SPEAKER_00: Now, it's uh it's the same as you may still choose to buy a car with a salvage title, but at least you know walking into it what you're getting for yourself.
11:16
SPEAKER_01: You got your eyes wide open at that point, right?
11:18
SPEAKER_01: Um, so I I jumped in, you were on one out of three that you're gonna cover.
11:22
SPEAKER_01: What are two and three?
11:23
SPEAKER_00: Yeah, look, uh the the first part is selection.
11:25
SPEAKER_00: Okay, now you've selected it, the software is there, now it's kind of yours.
11:29
SPEAKER_00: It's like a baby, right?
11:30
SPEAKER_00: You've got to nurture it, you've got to maintain it, you've got to keep it here, you've got to keep it well fed.
11:34
SPEAKER_00: Um, there's two main areas there we actually help our customers.
11:38
SPEAKER_00: One is on the security side.
11:40
SPEAKER_00: The current tools and tooling alternatives are what's called software composition analysis or SCA tools.
11:47
SPEAKER_00: The way they have foundationally architected to scan for vulnerabilities is extremely, extremely noisy.
11:53
SPEAKER_00: It's not uncommon for a large enterprise to have half a million SCA alerts.
11:58
SPEAKER_00: Nobody has the capacity to deal with it.
12:00
SPEAKER_00: I faced this problem firsthand at PrismaCloud.
12:03
SPEAKER_00: And so we have changed the way we do the analysis and scanning to a point where we can basically cut through 80, 85% of the noise and really have you focus on the 10 or 15% of vulnerabilities that actually truly affect your application.
12:19
SPEAKER_00: And by doing so, we're changing the model where developers today are being found guilty until proven innocent by existing SCA tools to actually the way it should work, which is the tool does the homework to figure out if you're truly guilty and not just by association.
12:37
SPEAKER_00: So that's number two.
12:38
SPEAKER_00: Number three, andrew's really like, and three kind of has part A and part B.
12:43
SPEAKER_00: It's really about don't just keep telling your developers what's wrong, actually help them nurture and maintain software.
12:49
SPEAKER_00: So beyond the security risks and vulnerability risks, there are risks that are not CVEs.
12:53
SPEAKER_00: These are things like the software becomes unmaintained, the maintainer has disappeared, you're no longer using the code.
13:01
SPEAKER_00: Uh lots of other things can happen, or you're falling behind by three years and 24 releases because the developer who brought in this code no longer works for you.
13:08
SPEAKER_00: We actually uncover those types of operational challenges for our customers.
13:13
SPEAKER_00: And where all of this ties together, Andrew, is the world is very fixated around this topic of software bill of materials or SBOM.
13:20
SPEAKER_00: And it's all being driven by regulation of the government.
13:23
SPEAKER_00: But if you think about what SBOM is, it's ultimately the far right-hand side of the process where people want transparency of what's in your software.
13:32
SPEAKER_00: And by producing an SBOM, you're now disclosing to your users downstream what are all the open source components you rely on.
13:39
SPEAKER_00: And if you don't have a grasp on the governance process from the time people are selecting it to how well maintained it is, you will basically be exposing your dirty laundry to your customers.
13:48
SPEAKER_00: And so we think the way we close this loop of dependency lifecycle management starts with good selection practices, great security maintenance, and operational efficiency around these, such that when you produce software-billed materials, whether through our product or a third party or open source, the fidelity of information, the accuracy, and the quality of what went into your application has a very high bar.
14:12
SPEAKER_01: You covered a lot there, right?
14:13
SPEAKER_01: Clearly you've thought through the three stages and the different uh ideas of where the value is for an organization.
14:20
SPEAKER_01: I'm wondering when you're talking to a prospect, what that first wow moment is for them.
14:26
SPEAKER_01: They when you know they're looking at your screen or you're you're you're explaining all this to them, what makes them stop and go, hold on, I haven't heard that before.
14:33
SPEAKER_00: Yeah, it it really starts with that vulnerability prioritization use case.
14:37
SPEAKER_00: I think anybody that is using any current generation of tools is tired of two things.
14:42
SPEAKER_00: One, just a sheer volume of alerts being generated, and two, being discredited by their engineering teams because seven or eight out of ten times, when the engineers investigate those alerts, it turns out they're actually inaccurate or false alarms.
14:56
SPEAKER_00: So the fact that they find a tool that can kind of cut through the noise, really find the things that matter and provide the evidence to the developers is no longer a debate.
15:06
SPEAKER_00: It's here on your screen, I'm showing you evidence of why this affects us and how it affects us, goes a long way in building credibility for the security teams with their engineering counterparts.
15:17
SPEAKER_00: The thing that follows along with that is that this is not just a security tool that does not suck, but it's actually a security first tool that enables developers to use open source more effectively, because of how I talked about how we help them maintain and keep it up to date and optimize the application performance.
15:33
SPEAKER_00: So now as a security team, I feel great going to my engineers and saying, hey, here's a tool you might want to consider that gets our security kind of needs met, but it actually affects you and to be moving faster and building software.
15:45
SPEAKER_01: It really feels like you're enabling rather than disabling or saying no.
15:49
SPEAKER_01: Right.
15:50
SPEAKER_01: Uh you're enabling the security team to say yes all the time.
15:53
SPEAKER_00: Yes, that's our hope.
15:54
SPEAKER_00: I mean, I think the the department of no with open source software will will no longer exist.
15:59
SPEAKER_00: Uh, you know, uh using open source enables innovation, enables you to be competitive in an industry where your competitors and other startups are moving faster than you are, and uh we have to enable the secure adoption of open source.
16:13
SPEAKER_01: Now, you talked about the developer side and security side.
16:16
SPEAKER_01: What is your route into a company usually?
16:19
SPEAKER_00: Yeah.
16:19
SPEAKER_00: Look, we thought hard and long about this because we had two choices, right?
16:24
SPEAKER_00: We could either go in through the development organizations, through the engineering organizations, or we could go through the security teams.
16:30
SPEAKER_00: Um, I think for a variety of reasons, uh we chose to go with a security first message.
16:37
SPEAKER_00: And I think it came down to two things.
16:38
SPEAKER_00: One for this us this being a third time around, we do understand and empathize with how the security sales motion works.
16:45
SPEAKER_00: So one was just our comfort.
16:46
SPEAKER_00: Two, when you look at economic um downturns that we are either in or are going to see more of uh if it were to get worse.
16:54
SPEAKER_00: Uh and in my conversation with a lot of CISOs, you know, most CISO budgets are staying flat or marginally increasing, not declining, whereas a number of other functions, the big the budgets are declining.
17:05
SPEAKER_00: So, you know, those are the two reasons we chose to go from a security first perspective.
17:11
SPEAKER_00: Now, in most um evaluations, we will end up with security bringing in their engineering counterparts anyway, but this is something we typically like to get funded predominantly from the security budgets because existing capabilities for application security is where we can find uh replacement dollars.
17:28
SPEAKER_01: That makes a ton of sense.
17:30
SPEAKER_01: Um, the positive is that there's dollars attached and they're they're desperate to solve this type of problem.
17:36
SPEAKER_01: I guess the downside is from a company strategy standpoint, is there's 3,000 vendors trying to reach these CISOs and it's an incredibly noisy market.
17:45
SPEAKER_01: And I'm wondering, as a company, what you're doing to try and stand out and rise above the noise out there.
17:52
SPEAKER_00: Yeah, great question.
17:53
SPEAKER_00: Look, um I'd I'd be lying if I didn't first admit that having been a three-time founder does help with access.
18:00
SPEAKER_00: You know, if you email a CISO, chances of getting a response that are not are a bit higher than if you were a brand or a person that wasn't recognized.
18:09
SPEAKER_00: I think that's certainly there.
18:10
SPEAKER_00: So I'll put that on the table.
18:11
SPEAKER_00: The second piece is we do put a lot of focus on building a brand for the company, which is very content first.
18:20
SPEAKER_00: You know, our opinion in 2023, building company, building a demand engine starts with content.
18:25
SPEAKER_00: And it's not content that's gated behind kind of web forms for each piece of content.
18:29
SPEAKER_00: It's educating the market, right?
18:31
SPEAKER_00: And then these are long lead times.
18:33
SPEAKER_00: I think the thing that changes then is attribution isn't as clear on the marketing side.
18:37
SPEAKER_00: You can't say, hey, fill this form, and so I did this.
18:40
SPEAKER_00: We're trying to reach our audiences wherever they are.
18:42
SPEAKER_00: We do a lot of this on LinkedIn, we do a lot of content and education, we do a lot of technical blogs, which are not written by marketeers, but are written by our engineers ourselves.
18:51
SPEAKER_00: And we get a lot of kudos actually back from uh, you know, people that say, well, I've heard of Indor Labs.
18:57
SPEAKER_00: And you know, we've been out of stealth for four months.
18:59
SPEAKER_00: So it makes me really happy to say a lot of people are aware of the brand already.
19:04
SPEAKER_00: The other piece is we really try to kind of leverage more peer-to-peer relationships.
19:10
SPEAKER_00: So, for example, every few months we're launching more research content to educate the market around top software supply chain risks and open source risks.
19:18
SPEAKER_00: But we're not doing this in a silo, in a vacuum.
19:21
SPEAKER_00: We're doing this um with dozens of CISOs peer reviewing our content and actually stamping, you know, with you'll see them attached as reviewers to our content.
19:30
SPEAKER_00: Uh, we're talking to CTOs, and so a lot of them are backing us where people start to recognize that this is not just a company spreading FUD, but they're actually working really, really hard to educate us on understanding these emerging risks because a lot of this is new and we're all trying to grasp this where there's 50 other problems you have to fight.
19:47
SPEAKER_00: You know, my job as CEO of Endor Labs is to make sure this is in the top three pain point uh and something that a CISO wants to go solve this year.
19:57
SPEAKER_01: I love your comment around being a content first uh organization and getting the right information out there.
20:03
SPEAKER_01: I bet uh you know your marketing team is happy to work for a CEO that gets that versus one that doesn't, and they're really worried about attribution and time leads down to was it this white paper or that uh that data sheet almost, right?
20:18
SPEAKER_01: It requires a slightly different mentality to be okay with we might be a little bit fuzzy in attribution, but we know it's working in general by doing the things that we're doing.
20:27
SPEAKER_00: Yeah, absolutely.
20:28
SPEAKER_00: Right.
20:28
SPEAKER_00: And and I think uh again, this is where experience does help, right?
20:31
SPEAKER_00: If you're in a very, hey, I want to pinpoint every part of my funnel and how it's going, you realize over time that that, anyways, is fuzzy.
20:38
SPEAKER_00: Uh you just spend a lot more time than you should have on trying to get the data right.
20:43
SPEAKER_00: You might as well focus that time and effort for your marketing team to actually produce high quality output and content and engagement with the audiences.
20:50
SPEAKER_00: So that's what we focus on and measure ourselves to.
21:02
SPEAKER_01: I've got uh a list of 35 questions here, and I'm gonna ask you to pick three numbers from one and thirty-five.
21:09
SPEAKER_00: Twenty-three.
21:11
SPEAKER_01: Twenty-three.
21:12
SPEAKER_01: Where in the world do you like to live?
21:15
SPEAKER_00: Ah, it's a great question.
21:17
SPEAKER_00: Uh I love warm weather.
21:19
SPEAKER_00: I love being by the ocean.
21:21
SPEAKER_00: If it's gonna be in the U.S., it's probably Miami or South Florida anyway.
21:26
SPEAKER_00: And if it's gonna be outside, somewhere in Europe, then probably somewhere off the uh Amalfi coast.
21:32
SPEAKER_01: Oh, Amalfi Coast.
21:34
SPEAKER_01: You'd narrow it down nicely there.
21:35
SPEAKER_01: I've never been there.
21:36
SPEAKER_01: What's that like?
21:37
SPEAKER_00: It's uh it's definitely not sandy beaches like we're used to in the US, but uh rocky beaches, but just absolutely gorgeous.
21:44
SPEAKER_00: Food is amazing, wine is fantastic.
21:47
SPEAKER_00: Uh, I think it could be a great place to retire.
21:49
SPEAKER_01: Oh, sounds good.
21:50
SPEAKER_01: I'm kind of getting ready for that myself.
21:52
SPEAKER_01: Uh next number between one in 35.
21:54
SPEAKER_01: 28.
21:55
SPEAKER_01: 28.
21:56
SPEAKER_01: Scariest animal.
21:58
SPEAKER_00: Oh um, don't like reptiles.
22:02
SPEAKER_00: Um I would say just the reptile family in general probably would be the spooky ones.
22:09
SPEAKER_00: Yeah.
22:09
SPEAKER_00: Not very cuddly, are they?
22:11
SPEAKER_00: No, definitely not.
22:13
SPEAKER_01: And last number, team one and thirty-five.
22:16
SPEAKER_00: Five.
22:17
SPEAKER_01: Five.
22:17
SPEAKER_01: Dive bar or cocktail bar?
22:20
SPEAKER_00: Cocktail bar.
22:21
SPEAKER_00: I love a love a nice classy martini with uh three olives.
22:26
SPEAKER_01: So we have RSA coming up.
22:28
SPEAKER_01: What's your favorite cocktail bar around the Muscone Center?
22:31
SPEAKER_00: Well, if you're gonna be.
22:32
SPEAKER_00: RSA uh join us.
22:33
SPEAKER_00: We're gonna be hosting an event on the Wednesday at Wingtip, which is a private members-only club.
22:38
SPEAKER_00: We're gonna be doing some Scotch cigar tasting and sorry, scotch tasting cigars and poker.
22:43
SPEAKER_01: That sounds like a good night.
22:44
SPEAKER_01: Is it is it scotch or is it uh bourbon or whiskey or I think we're gonna be doing scotch?
22:49
SPEAKER_01: So as a as a man who was born and bred in Scotland, uh I love that idea.
22:54
SPEAKER_01: Great.
22:55
SPEAKER_01: Well, you're welcome to join us.
22:56
SPEAKER_01: Oh, I love it.
22:57
SPEAKER_01: Thank you.
23:01
SPEAKER_01: Brun, take me back to another important day in the development of Endoor Labs, which is the day that you won your first real live paying customer.
23:09
SPEAKER_01: Uh, what was that like as uh as a company when that happened?
23:12
SPEAKER_00: You know, Andrew, I tell people, no matter if this is your first company or third company, like the inflection point is when you really saw kind of sign your first true enterprise customer, like past the initial pilots and other things, which are nice, by the way, don't get me wrong.
23:25
SPEAKER_00: But you know, when you've done this, and by the way, when you've won it fair and square, not a hey friend, help me out, give me a 25k check, but it's a fair and square in an account where you didn't know anybody, where you were in a competitive situation, you know, it really gives you and your team the confidence that you have built a product that works and that people appreciate.
23:45
SPEAKER_00: And so for us, you know, uh this wasn't very long ago.
23:48
SPEAKER_00: It was a hard-fought battle at uh a large public company.
23:52
SPEAKER_00: Uh, we in fact came in when they already were almost at the end of the procurement process of an alternative incumbent uh software composition analysis tool.
24:04
SPEAKER_00: Paperwork had already been circulated on DocuSign pending CIO's signature.
24:09
SPEAKER_00: One of the security guys just happened to hear us, and we got a demo, and they basically stopped that purchase.
24:13
SPEAKER_00: So if you think about it, the odds were already stacked against us walking in there.
24:18
SPEAKER_00: Time was of the essence.
24:19
SPEAKER_00: This was, by the way, pre-us even launching the company out of stealth.
24:23
SPEAKER_00: The product was early.
24:24
SPEAKER_00: And, you know, our teams did a fabulous job on the engineering and product side to kind of get the evaluation completed in record time.
24:33
SPEAKER_00: Uh, show the customer just how responsive we were.
24:36
SPEAKER_00: We may not be perfect, but you know, we're there as partners to them.
24:39
SPEAKER_00: And when it ultimately came down, you know, we're happy to say we signed a large six-figure multi-year deal that, you know, gives us the confidence and gives them the confidence that we'll be here together, uh, you know, helping them solve these challenges.
24:53
SPEAKER_01: I love that story, the the drama of uh someone else was getting the PO and it was pulled at the last minute.
24:59
SPEAKER_01: Um, I'm wondering as you were going through what must be a pretty fast sales cycle with that company, at some point they must be thinking, you know, how early is early for this for our andor labs, right?
25:11
SPEAKER_01: And how you handled that conversation to make sure they were aware that you you didn't have 10,000 customers.
25:16
SPEAKER_01: Uh, you had to, you know, you've you've made some progress, but this is an early stage company you're buying from.
25:21
SPEAKER_00: Yeah, look, obviously they knew that up front, right?
25:23
SPEAKER_00: We hadn't, we hadn't uh even launched the company.
25:25
SPEAKER_00: They were aware of that.
25:26
SPEAKER_00: You know, when when it came down to even the pricing conversation, we did present it as a design partner pricing, saying, look, we're early, but you know, we'll incentivize you to engage with us early.
25:35
SPEAKER_00: We'll give you uh access into our customer advisory board that we're building, you'll have influence through our roadmap.
25:41
SPEAKER_00: And I think it was also really important for me as CEO to get executive alignment with their uh CIO on uh, you know, the CISO was unfortunately out uh for a medical situation, otherwise, typically it would be a CISO to myself alignment.
25:55
SPEAKER_00: But you know, just having that conversation, letting them know who we are.
25:58
SPEAKER_00: Um, you know, what we've done before, it certainly helps kind of establish credibility that it's not our first rodeo and we're gonna be here in the long term.
26:05
SPEAKER_00: But at the end of the day, like they are taking a leap of faith, right?
26:08
SPEAKER_00: Like as we know, coming out of 2023, there will be far fewer cybersecurity companies than there were going into this year.
26:14
SPEAKER_00: So um, you know, I think, I think uh certainly the product proving itself, having a good proven team behind us, um, and and a track record helped us uh get through this.
26:26
SPEAKER_01: Talking of team, uh tell us about your sales team right now.
26:29
SPEAKER_00: You know, we've been hard at work.
26:31
SPEAKER_00: Last last quarter's been a busy uh quarter on our sales team.
26:34
SPEAKER_00: We now have uh two BDRs, two reps uh splitting the country east and west, and a VP of sales.
26:41
SPEAKER_00: So it's all been coming together pretty rapidly.
26:43
SPEAKER_00: And I know you're gonna have questions on that, so I'll turn it back to them.
26:46
SPEAKER_01: Yeah.
26:47
SPEAKER_01: How did you know it was the right time to start hiring the sales team?
26:51
SPEAKER_01: What was the moment?
26:52
SPEAKER_00: You know, my philosophy in this is always when I get so busy and my product manager gets so busy to a point where we can't handle more sales conversations, is usually the time you scale.
27:03
SPEAKER_00: Uh, and so I think we had gotten to the point where our CRM was filling up with more and more opportunities, and we were trying to keep up, but honestly, we were just doing blocking and tackling, and there was a lot more progress we could have made with more help.
27:16
SPEAKER_00: Um, you know, that was the signal for me.
27:18
SPEAKER_00: Uh, I know different people have different signals.
27:20
SPEAKER_00: Some say close your first 10 deals yourself, others have other signals.
27:24
SPEAKER_00: My personal signal is when I'm at capacity as the pseudo-head of sales and pseudo-head of sales engineering that I need help.
27:31
SPEAKER_01: Now you had the advantage of doing this before.
27:33
SPEAKER_01: So you knew what you were getting into when you decided to start hiring some salespeople.
27:37
SPEAKER_01: But what when you started doing that, what were you most watching out for or most concerned about to make sure that you you got it right this time?
27:46
SPEAKER_00: You know, I always tell um fellow entrepreneurs this that hiring the wrong person on sales is a very costly mistake.
27:54
SPEAKER_00: You have at minimum lost six months, probably lost 12 months of your company journey.
27:59
SPEAKER_00: That's one thing.
28:00
SPEAKER_00: The other thing I always tell people is, you know, especially when you're interviewing sales folk professionals and marketers, like the one thing you would really expect them to be able to do well, if nothing else, if not be able to sell your product, is at least sell themselves and their backgrounds really well.
28:14
SPEAKER_00: So interviewing, you you know, they all sound good on the surface, but then you've got to really figure out uh, you know, who is right for you.
28:20
SPEAKER_00: Uh, luckily, having been done this before, you know, there those are things you get better and better at, but it's never perfect.
28:27
SPEAKER_00: So I think that's what it comes down to.
28:29
SPEAKER_00: The third piece I've learned in kind of building now sales teams three times over is you know, just because somebody has been wildly successful and is a quarter crusher or crowd striker or Palo Alto Networks doesn't mean they'll be successful here.
28:41
SPEAKER_00: And so just like there's product market fit, there's almost sales market fit.
28:45
SPEAKER_00: And I have this philosophy of hiring in twos for sellers.
28:50
SPEAKER_00: Um, and I'll tell you why that is.
28:52
SPEAKER_00: So basically it is, you know, a lot of sales uh kind of founders will say, I'm ready, let me hire my first salesperson.
28:58
SPEAKER_00: And I say, great, but you know, you might run into a situation where if the salesperson is not performing, what you don't know is is it your product problem, or is it the person itself who doesn't have the right, is not the right fit for the product you're selling.
29:12
SPEAKER_00: And that's why I think it's very important to get two people, sometimes two from slightly different backgrounds, ideally, maybe different companies, maybe one's in an app sec, maybe one's in cloud or infra before, um, different territories, different backgrounds, and then see you're successful.
29:27
SPEAKER_00: Now, if both are failing and reporting back that there's a product market fit issue, I would believe that much more than I would if there's just one person telling me that that's the problem, because maybe the problem is them.
29:37
SPEAKER_00: And I have seen this before, Andrew, where I've hired kind of people who've been at the club three years in a row coming here, and they just can't perform for a variety of reasons.
29:47
SPEAKER_00: Different market, you're early, you're in a category creation situation, not selling into a large existing market.
29:53
SPEAKER_00: They could be personal problems they run into in their lives, lots of different things.
29:56
SPEAKER_01: Yeah, there's lots of things at play, right?
29:58
SPEAKER_01: I always kind of view hiring as a risk.
30:01
SPEAKER_01: Um, and you do a bunch of things to reduce your risk.
30:04
SPEAKER_01: Obviously, you get better at interviewing, you have screenings, you get more people involved.
30:08
SPEAKER_01: I'm wondering uh if, you know, even though you got different backgrounds, maybe, are there some non-negotiables you look for when you're when you're hiring salespeople?
30:16
SPEAKER_00: I do.
30:17
SPEAKER_00: I think they have to be technical enough to be dangerous, right?
30:20
SPEAKER_00: There's there's a set of sales folks that are just incredible at building relationships, managing relationships, but the typical sales call with a customer will go like, hi, hello, and let me introduce you to my SC, and he'll run the slides and the pitch and the demo.
30:33
SPEAKER_00: Uh, those folks typically don't work out for me.
30:36
SPEAKER_00: Uh for me, um, I personally, within the two weeks of every seller joining the company here, be it by the way a BDR or a field rep, they have to go through and personally get certified on the pitch with me and the demo.
30:48
SPEAKER_00: I don't care that you're not doing a demo every day with prospects like a BDR, for example, but I need you to have an end-to-end appreciation for what you're selling and how you're positioning it.
30:58
SPEAKER_00: So uh that is my number one um non-negotiable is you've got to be technical enough to be dangerous, not to go and search stuff and deploy the product in DOCs, but you've got to give the pitch, you've got to be able to deal with the first set of objections, and you've got to be able to do a demo.
31:14
SPEAKER_01: To me, that's the that's the foundations we're running, right?
31:17
SPEAKER_01: You know, you someone coming in needs to be able to do those things.
31:20
SPEAKER_01: Remember years ago, I worked at a company, um, and the everyone in the company had to be able to do the five-minute demo.
31:26
SPEAKER_01: When I say everyone, I mean from the person on the front desk to developers, salespeople, CFO, everyone had to do the five-minute demo of the product.
31:35
SPEAKER_01: Just not because they were expected to go out and do the five-minute demo, but because it helped everyone understand what they were doing and the importance of what they're doing and the value props, things like that.
31:43
SPEAKER_01: So they felt like you know they're part of a big team like that.
31:46
SPEAKER_01: Yeah, absolutely.
31:48
SPEAKER_01: And I I and remember, you know, I I sold for 20 years in cybersecurity, and I was always that person who probably leaned a little bit into the technical side, enough to be a little bit dangerous.
31:58
SPEAKER_01: And you know, you get a bloody nose a couple of times and you realize where your boundaries are and where you need to kind of back off a little bit.
32:03
SPEAKER_01: But uh, in terms of um resource usage, it actually helped the team out when you've got someone who can maybe do a certain first meeting, maybe even a bit more, without having to call in an SE all the time.
32:15
SPEAKER_01: It makes a slightly different dynamic in terms of hiring.
32:17
SPEAKER_00: Yeah, you know, one other thing, since you asked what are what are and not what is the single most important trade.
32:22
SPEAKER_00: So the second one for me is I always tell reps that I hire or early days anyway, you know, you're the CEO of your patch.
32:29
SPEAKER_00: And what I mean by that is, you know, don't just think about it transactionally.
32:32
SPEAKER_00: Like you, I don't have a channel team that's gonna deal with your geo.
32:36
SPEAKER_00: I don't have a uh channel marketing team that's gonna figure out how to do events in your area.
32:40
SPEAKER_00: I say, as a salesperson, you have to figure out how to get um basically an unfair advantage on access to customers.
32:47
SPEAKER_00: So go find the channel in your territory that will be most effective.
32:51
SPEAKER_00: Uh find the kinds of events you want to do locally.
32:54
SPEAKER_00: We'll give each one of you know a couple thousand bucks in budget, go figure out how to go make it work.
32:59
SPEAKER_00: Uh and basically to say, manage this end-to-end, right?
33:02
SPEAKER_00: Like don't assume that there'll be a channel team and BD team that'll work out your partner, and then that there'll be a field marketing team that'll work out events.
33:10
SPEAKER_00: Yes, we have all of that at a national level supporting you, but you've got to figure out how to feed yourself and in turn uh make the company be successful.
33:17
SPEAKER_01: Yeah, and I bet it'd be good to hire people who have that sort of experience, right?
33:21
SPEAKER_01: This won't be the first time they're the CEO of their territory or the head of their franchise, right?
33:25
SPEAKER_01: They're just used to thinking like that already is probably a big plus for you.
33:28
SPEAKER_01: Yep.
33:29
SPEAKER_01: I know the team is early into the company, Varun, but uh, if you could wave a magic wand right now and fix one thing for your sales team overnight, what would that be?
33:40
SPEAKER_00: Andrew, I got to tell you this.
33:41
SPEAKER_00: I mean, I worked at Salesforce.com back in 2007, and you know, this was there for four years, seeing the growth from 1,500 people to 7,000 people.
33:50
SPEAKER_00: I feel like where we stand today, the sales tech stack has become just too heavy duty, too complex.
33:57
SPEAKER_00: Sellers hate Salesforce yet can't live without it.
34:00
SPEAKER_00: I feel like if we could just magically make the stack seamless, where I don't gonna have to go add this and then add gong and then add Clary and then add Rattle, and you know, there's just gotta be an integrated lightweight stack that you know is just ready, turnkey for startups.
34:17
SPEAKER_00: I think everybody struggles as a startup, is big kind of building that sales tech stack, and I think it's just a distraction, kind of time consuming and expensive.
34:28
SPEAKER_01: Yeah, time consuming for the reps, and then you start having to hire special admins to keep it all running, right?
34:34
SPEAKER_01: It's like, you know, make sure the plates are all spinning every day and no one's falling over.
34:39
SPEAKER_01: It's incredible the resources, it sucks up to trying to keep it all working together.
34:42
SPEAKER_00: It's just not core to my business, right?
34:44
SPEAKER_00: So just like kind of cloud came about and kind of made things easier.
34:48
SPEAKER_00: Yes, I know Salesforce and other things are cloudy, but they're they're just too heavy duty in terms of implementation and operationalization.
34:54
SPEAKER_01: I think especially at startups, right?
34:56
SPEAKER_01: I mean, if you think about these tools, you could implement all the tools you can imagine Clary, Salesforce, Gong, you know, outreach, sales law for it might be in a 10,000 salesperson organization.
35:07
SPEAKER_01: And yet you go to a startup with five people in the sales and we're using the same tools, it seems a little bit off, right?
35:13
SPEAKER_01: That it's it doesn't, it shouldn't really work like that.
35:15
SPEAKER_01: There should be like the light version that's a little sweet for the small companies can get going on.
35:20
SPEAKER_00: Yeah, absolutely.
35:21
SPEAKER_00: And and I think for the people listening, there's an opportunity here if there can be some managed service providers that just take the whole stack, run it for you.
35:28
SPEAKER_00: It's streamlined, I pay you a subscription and it's out of my way.
35:31
SPEAKER_00: That'd be fantastic.
35:32
SPEAKER_00: And maybe it exists.
35:33
SPEAKER_00: And if so, please let me know.
35:35
SPEAKER_00: Yeah, yeah.
35:35
SPEAKER_01: What is the hardest thing about when you bring on the sales team going from founder-led sales into handing off to a sales team?
35:43
SPEAKER_01: What's the hardest thing for you as a founder when you're doing that?
35:46
SPEAKER_00: Giving the autonomy but keeping the visibility, right?
35:50
SPEAKER_00: Which is, you know, there's a fine balance.
35:52
SPEAKER_00: Like I don't want to be sitting there on every deal uh inspecting every deal.
35:56
SPEAKER_00: I mean, there's a reason I have a VP of sales, but there's also we're still early, we're still learning a lot.
36:00
SPEAKER_00: So it's like, how can I be involved just enough where I'm not missing signals that I may, having been the founder let salesperson, really be the most tenured salesperson in the company, uh, can continue to catch some of those signals, but also not get in the way of kind of us scaling up as an organization.
36:16
SPEAKER_00: So I would say that's probably uh you know the biggest thing I'm cognizant about is kind of striking that balance.
36:24
SPEAKER_01: Yeah.
36:25
SPEAKER_01: Uh I think some with experience you've probably learned how to do it but more efficiently than others.
36:30
SPEAKER_01: Um and there's I definitely hear horror stories from people saying, yeah, the finders on my back every day.
36:36
SPEAKER_01: They can't give it up.
36:38
SPEAKER_01: They could hang on and then they start stealing deals from them.
36:40
SPEAKER_01: It's like, oh my God, how could I do my job if uh if uh if it's all like this, right?
36:45
SPEAKER_01: It could be tough.
36:46
SPEAKER_00: Absolutely.
36:46
SPEAKER_01: So, Varun, you uh have a little bit of sense about my business.
36:49
SPEAKER_01: I help early stage companies with a go-to-market and getting things going kind of like your team is right now.
36:54
SPEAKER_01: Is there a question that you have for me right now that I can try and answer off the cuff that might uh be useful?
37:01
SPEAKER_00: Is there a formula that you say rinse and repeat, B2B, cybersecurity, SaaS companies?
37:07
SPEAKER_00: You you follow these three things, and that's your path to nirvana, or do you find like, you know, it's just different in every scenario?
37:15
SPEAKER_00: That's kind of one.
37:16
SPEAKER_00: The second piece, and I know there's so much buzz around PLG, and I think the big fallacy is everybody wants to be a PLG company, even though your product and go-to-market may not be suitable for it.
37:26
SPEAKER_00: You know, do you think as we're getting in back into the reality of the economic situation, we are that revenue will be more important than user adoption?
37:38
SPEAKER_00: Whereas there was a time and place where you could go get user growth for three years without revenue, and you'd be you'd be handsomely rewarded for that.
37:47
SPEAKER_01: Let me tackle the the first one first.
37:49
SPEAKER_01: Um, I'm gonna take a slightly different approach on this one.
37:53
SPEAKER_01: Um, I think the the formula is um to stick to the foundations.
37:59
SPEAKER_01: And let me tell you what I what I mean by that.
38:01
SPEAKER_01: Is that I think that we we start marching very, very fast, right?
38:06
SPEAKER_01: We bring on the team and we're thinking, let's enable them to go and, you know, as you say, run your territory.
38:12
SPEAKER_01: Before you know it, what you have is is a little bit of confusion because one person goes out on the East Coast and hears about these use cases, and person on the West Coast has these use cases, and they talk at different levels of the company, right?
38:25
SPEAKER_01: So one person is more comfortable going in the middle, one likes to go in at the CISO level.
38:29
SPEAKER_01: All this kind of happens, right?
38:31
SPEAKER_01: And before we know it, what we lose is is the kind of guardrails, what we're actually trying to achieve.
38:37
SPEAKER_01: And I kind of liken it to saying to uh a team, you know, um our job is to go from San Francisco to New York, now go, right?
38:46
SPEAKER_01: And they'll choose to go by bike or fly or go private or whatever it might be, and or some might never get there, right?
38:52
SPEAKER_01: And you never learn by doing it that way.
38:54
SPEAKER_01: Whereas if the if the message is let's go from San Francisco to New York and we're going on IAT from here to here, and we're gonna learn all that, we've got the right guardrails, and that's that's kind of what I mean, right?
39:04
SPEAKER_01: So I think sticking to the foundations, the foundations of what problems do we solve, for who, how are we unique in how we do it, and refine around those things gives the uh gives enough of the foundation to build on.
39:19
SPEAKER_01: Um, if we start adding on things without you know really good foundations, then that's when things start falling apart and we don't learn and we can't progress, and we're sitting there nine months later wondering why you know we got deals that are not happening and falling apart because we haven't got the certainty.
39:33
SPEAKER_01: I don't know if that's quite how the answer you're expecting, but I think that's what I see in terms of what people do well, but also ones that don't do well, right?
39:41
SPEAKER_01: That you know, you ask them six months later, what's the problem you solve, and they kind of look look at you blankly, like you know, well, it could be lots of things.
39:48
SPEAKER_01: And I said, Well, that's not a great answer.
39:50
SPEAKER_01: You need to kind of get focused on that.
39:52
SPEAKER_01: Um so that that I don't know, that's how I think about that.
39:55
SPEAKER_01: Uh on the flip side to that, the other side to that's that question is the right-to-market side.
40:00
SPEAKER_01: Um, I get asked about this a little bit, so uh the risk of uh repeating myself.
40:06
SPEAKER_01: Um, I think there there are ways to get the access.
40:09
SPEAKER_01: And I think that's really what people are after, right?
40:11
SPEAKER_01: Give how do I get access to people who can decide and run in a sales cycle with me on the prospect side?
40:17
SPEAKER_01: Now you've got the advantage of you know, you got a network from doing this before.
40:21
SPEAKER_01: Uh I think these days, more than ever, uh VCs with a program about getting you access as opposed to VCs that make some intros, I think that's a big difference, right?
40:31
SPEAKER_01: There's those ones that actually have people who deliver meetings all day long for you.
40:36
SPEAKER_01: And I, you know, I work with companies that that have that, and I've worked with some that don't, and I see how much more of a struggle it is when they're not uh when they're they're reaching out to the VCs all the time saying, you said you would get me a meeting, you said you would do this, and you know, it's not coming through.
40:50
SPEAKER_01: So I don't know, a couple of things there to think about.
40:52
SPEAKER_01: On the the POG or the the revenue versus users, remind me, so the question is, will we get back to just trying to get users again and not not worry about revenue?
41:02
SPEAKER_00: You know, I think we've been in markets where you could go for three years just getting usage and adoption, but not revenue translation.
41:08
SPEAKER_00: And you know, I think given where the market is and the beta matters again, uh, do you think we're kind of going back to those equations where dollars matter uh and more potentially than even just getting usage without dollars?
41:23
SPEAKER_01: Yeah, I think we're there right now.
41:25
SPEAKER_01: I mean, I'm not sure what your uh board has been kind of passing down or giving advice on, but what I hear extensively, and it's no surprise, I don't think, is you know, don't expect uh you're gonna expect not to get any more money until mid-2024.
41:40
SPEAKER_01: So what can you do to get through that?
41:42
SPEAKER_01: Um, and obviously one of the big levers you have is to say, how do we deliver something in the short term that will actually get us uh value, give allow us to give value to prospects so that we can ask for decent chunks of money when we're doing it?
41:58
SPEAKER_01: You know, having design partners that don't pay or having design partners that pay 25k is nice and all, but wouldn't it be good if you could, as you did, get the 100 to 250 to 500k deals coming in?
42:09
SPEAKER_01: And that's where suddenly you know you get the runway.
42:12
SPEAKER_01: I I I do think there's a there's a value though, as you said before, to say, you know, you know, blue chip business coming in where we found someone and we won it fair and square, and you learn a lot more from that than you do when you know you just take on someone who didn't actually give you any money or or don't much money.
42:29
SPEAKER_01: So I think we're there right now.
42:30
SPEAKER_01: And I I I I don't know, my my view is uh we were way skewed over the other way beforehand.
42:37
SPEAKER_01: Um, and you know, there's companies you talk about the sales tech sales uh tech space, right?
42:42
SPEAKER_01: There's companies in that space that uh you kind of wonder how they're gonna survive because you know they they don't have many uh well-paying customers, that's for sure.
42:51
SPEAKER_00: Yeah, absolutely.
42:52
SPEAKER_00: Well, thanks for that.
42:53
SPEAKER_00: Thanks for sharing your thoughts.
42:54
SPEAKER_01: That's all.
42:55
SPEAKER_01: Well, listen, Brun, I I I've really enjoyed the conversation.
42:58
SPEAKER_01: If someone wants to continue it with you, what's the best way to do that?
43:02
SPEAKER_00: You know, uh LinkedIn, I'm pretty active on LinkedIn, so follow along, uh add in, reach out, would love to uh you know have further dialogue over uh over LinkedIn.
43:12
SPEAKER_00: And you know, if you're interested in checking out more about Endoor Labs, uh the website's pretty simple, EndorLabs.com.
43:17
SPEAKER_00: And if you know what Endor means, then there's a lot of Star Wars things going on on our website, so come check it out.
43:23
SPEAKER_01: And you're gonna be RSA, you said as well, right?
43:26
SPEAKER_01: We will be there, yes.
43:27
SPEAKER_00: And looking forward to meeting uh folks there.
43:30
SPEAKER_00: Now are you in the early stage expo or are you on the main floor or we're we're in the early stage expo, and then we'll be having events around and um and and meetings.
43:39
SPEAKER_00: So, you know, looking forward to meeting anybody that's interested, uh, just reach out on LinkedIn and we'll uh we'll coordinate.
43:45
SPEAKER_01: That's awesome.
43:46
SPEAKER_01: Well, listen, I enjoyed the chat, and I wish you and the team every success for RSA, for 23, and also for 2024.
43:53
SPEAKER_00: Thanks so much, Andrew.
43:54
SPEAKER_00: It's great chatting.
43:56
SPEAKER_01: Well, clearly Varun is keying into his experiences in the past when he's talking about what Endor is all about.
44:03
SPEAKER_01: Um, he's very good at making the case and the positioning statements that come out so strong when you go to founder who has done before and has that commercial and technical awareness as well.
44:14
SPEAKER_01: Um, bunch of takeaways, three for me to think about.
44:17
SPEAKER_01: One is I really liked what he said about when he brings on the sales team that he expects them in the first two weeks to be certified with him, not anyone else, certified with him on both the demo and also the pitch right so it's not just the pitch but it's a demo as well um and even though they're not expected necessarily to go out and give long demos themselves they need to be conversant in it so I love this thinking about that because it gives in the first two weeks it gives a um a center point for the sales rep coming in to know what's expected of them and know what they're focused on for their first two weeks.
44:57
SPEAKER_01: I think too often what happens is they're told to come in and learn the product and learn how to sell it and you know I don't know four, six, eight weeks later they're still trying to learn, right?
45:06
SPEAKER_01: But if you have a um a very focused thing to go after in a short period of time, it's gonna make them feel uncomfortable, I bet, but it's a great learning process to go through.
45:16
SPEAKER_01: So I really liked how he did that.
45:18
SPEAKER_01: The second takeaway might be a little more subtle and you might have to go back and listen to this.
45:24
SPEAKER_01: One of the things he did is he reframed the concept of the SBOM.
45:29
SPEAKER_01: I'm trying to remember the exact words he used I asked him about something and he said you know the industry is uh is focused on this idea of the SBOM or the software bill of materials but when you really think about what it is and what it's designed to do and then he went on to talk about Endor and their version or their value prop around what they think an S bomb is really all about right so that's a great reframe that he did right there a great structure to use right people think it's this but in reality when you really take the time to step back and think about it what people are really trying to do is this and therefore our way of doing it is actually very compelling right really powerful way to do it when you do well.
46:08
SPEAKER_01: And when you're listening to it, you probably didn't even seem like that's what he was doing.
46:13
SPEAKER_01: But it's a great uh uh phrasing to use if you can when you're thinking about what you're selling.
46:19
SPEAKER_01: And the third thing that I took away was you know he's marrying the idea of being a founder is really helpful.
46:26
SPEAKER_01: Our previous founder with successes under his belt he can go back to his customers and network from the first two and say look I've got a third thing here you know give me some time and they're taking the meetings right which is good.
46:38
SPEAKER_01: But secondly it really seems like he's keyed onto this idea of content and how powerful it can be.
46:44
SPEAKER_01: And uh as you're as I'm doing these CEO interviews right now, more often than not that's what I'm hearing.
46:50
SPEAKER_01: People are kind of latched onto this idea it definitely is a trend in the industry.
46:54
SPEAKER_01: You know Chris Walker from Refined Labs seems to be the one that is leading the charge but it's one that really makes a ton of sense.
47:01
SPEAKER_01: You know when you're thinking about how to get attention and get people to come to you already thinking about the way you do things as being meaningful for them.
47:09
SPEAKER_01: That's a great situation to be in as a seller, right?
47:11
SPEAKER_01: You got people coming to you and they're already thinking like you do.
47:15
SPEAKER_01: I'd much rather rather have that happening than where I'm reaching out all the time to people who don't think like I do and I have to convince them that we've got a better way all the time.
47:25
SPEAKER_01: So I really liked how he's marrying those two concepts you know going back to his network and then really putting the effort in as a company into content that's meaningful and useful, written by practitioners and engineers and things like that as a way to draw people into their world.
47:40
SPEAKER_01: So great conversation for me.
47:41
SPEAKER_01: I hope you've got some takeaways you might have some different ones for me but I'm looking forward to catching up with Larin and the team at RSA and wish them all the best for the rest of the year beyond