What Does It Actually Take to Start a Security Product Company?

hi folks um so welcome to uh our fireside chat without a fire on um what it actually takes to start a security Product Company and the reason uh we titled that is that uh I think a lot of folks here do services and we found that products are a little different I'm Bob Straton I'm one of the partners at the uh Mach 37 accelerator which is a business accelerator for security startup companies this is my partner Rick Gordon um just by way of background uh we are guys who have done a variety of different startup companies product companies and service companies we've also done work on the investment side um with the Venture Capital Community and

um more recently what we do is uh invest in folks that may just have a good idea and help them build a company around that and take it out by way of background um I stood up security at one of the first uh commercial isps was that one of the first Network IDs startups had a pen testing company before pen testing was cool and sold that um used to do Venture deals for a thing called inq tell and ran Labbit Sam anch Rick can you guys hear me test one two much better this is going to be awkward uh yeah so uh just by way background I I started uh my career in the military uh

spent a little time on Wall Street and then caught bug and not by training but more by Happ stance got into the information security industry with my first startup moved back to Virginia from New York and uh got to a little business called toar that was building thisp encryption Gateway at the edge of the network uh and and my job was decided not technical uh um I think I was the least drunk person in the room and and they needed a CEO and I was the one that in school should not have said well I can do that and you know learned uh perhaps the hard way um how to raise Capital how to operationalize a concept uh and build uh

a team around that I've um you been in and out of that industry I'll talk a little bit about that perhaps in a minute uh but uh you know have uh run multiple um companies that are in information security Arena and was fortunate enough to with Bob join M 37 about 16 17 months ago so and we'll talk a little bit more about that in a second just there's at least one veteran I know that is raised capital and probably fars to show for that as well Mark nice to nice to see you and and I know Marcus is part of our Ator here so you're uh learning right now as you go anybody else here uh Ever Raised Capital

uh in the hunt for Capital have an idea they want to raise capital for and uh and create a business around okay so why is everybody here so I I think what uh what Bob is going to talk a little bit about is um or what we would to talk a little bit about is you how do you do that how do you uh if you have a really constructive idea uh for a security uh product um you know how do you actually take that idea uh and make a huge contribution uh to uh the status quo in uh information security by productizing it and getting it out there into the market and use by

for everybody I I think that's about right and um so the reason you hear us say the word product a lot and um there's a challenge that I I went through a couple of different times in the course of my career where I was working really hard on fixing things and in the course of doing that sometimes we build something that was really helpful or useful for us whether that was within a company or within a Consulting practice for One customer or something and I would think about this and I would say you know we can't possibly be the only people have this problem this thing could be useful to a lot of other people

but we sort of weren't thinking about and this has happened to me in a number of companies you know we weren't really thinking about what else we could do with it or we were thinking about you know does it hurt me competitively if I somehow help other people have this capability and the good news is I think that uh the development of Open Source projects the way it's played out has made that a little better I think a lot of us are more willing sort of and think more automatically about how to share uh useful things that we've come up with with people um to help them do their job too but one of the things that always

sort of vexed me when I was Consulting was that I just didn't scale you know my whole life was about doing things for customers and uh I only had so many hours in the day and what I find is there's this tradeoff that you run into and um is really what the kind of the root of some of what we want to talk about is that you can be a consultant and you can be the best consultant in the world at a particular thing and you can solve really hard problems but you're probably doing it for one customer at a time and at the end of the day if you're if you are the best at

what you're doing for example and you do have these ideas wouldn't you really like to be able to fix more stuff than one at a time and so the question becomes how do you do that and I think that I will argue that most security products that have been most popular that have done the best that have been the most useful generally involve embodying expertise into an object incompletely imperfectly admittedly but when you can embody some aspect of your personal expertise into a thing two things happen one is you can make copies of that thing and put it in more places and help more people and the other is you can earn money when you're

asleep and this we don't always think this way right but there is a way to work that involves uh doing a thing reproducing it multiple times and doing well because of that just because it's out there and continuing to go out there and you this involves of course building a company to do this but the point being that you can reproduce the object many many times there will still be a need for expertise there will still be a need for Professional Services and things like that but if you have a vision or a thing that really bugs you in the industry that you're that you're trying to fix I invite you to think about that

like how can I be in more places than one and one of the one of the ways you do that is by by embodying your expertise into a thing and um the challenge for this is that in the services world if you're good and I'm going to assume that most people coming here if they have the interest to come here are probably good at what they do um it's pretty I don't want to say it's easy to make money but you can find people who need your skills who are who are willing to engage you to come in and do something and that can be a pretty good gig and a lot of fun and you might

even get to the point where you're a lifestyle consultant you know you've got a company that does what you need you're doing your thing you get to be the smart person who gets called occasionally to to solve a hard problem and that is comfortable and I I mean it was it may be hard work and you may not always be having fun but for the most part it's it's comfortable the the challenge with embodying your expertise into a product is that it's expensive there it cost money to do this it takes time and it requires some patience that you don't necessarily have to have and correct me if if you think I'm off base here that you don't

necessarily have to have when you got people calling you up say come be smart for me so you say patience I I would say for risk tolerance um uh just real quickly without uh putting forward an advertisement for 37 you know one of the the fundamental reason that we were created was that there was a hypothesis uh that this region in particular was um was full of this intellectual Capital full of talent of people that were you know principally in the services industry they're serving the intelligence Community they're serving commercial Enterprises um in this region or Serv other other Federal uh customers uh many of you probably more so than anywhere else you know on

the planet you understand cyber security or information security go back with 5 years um you understand threat you understand how it gets into your network where the arits of the compromise may exist how you aggregate those and any good intelligence uh processes how you raise sign life ratio um to know uh when You' been uh and and then ultimately you know what do you do about that um so there's a lot of this intellectual Capital around this uh region but uh less so uh around how do you uh Implement good product management uh process into a commercial Enterprise one how do you validate that market exists for your product as opposed to demand from One customer you might be serving

at the time how do you uh build a business um any price any price your product that you have to support a direct Salesforce and all of whom uh you know want to be making 200 you know at plan or 250 at plan and then above so you know what is that kind of business look like there's less of that in this region uh perhaps that you would see in other places on the West CO now just give you one actually some some time just made an acquisition of a West Coast Sim business and and this company the acquire e Coast um acquired had its within the intelligence community so they had this expertise that we're talking about what

was just remarkable to me uh that this West Coast uh very well funded uh Sim company uh where they actually do that that databases it was a you know a wig scalable column database um so think about the benefits of that and looking atog data but nobody on that particular team understood what questions to ask the S what are the weest WR because because they didn't know where the artifacts compromise uh frankly might exist so we believe that uh this area we we actually believe it's easier to take uh those softer skill sets uh how do you do uh let me say more fundamentally we can take individuals that have domain expertise that they built in this region and have terrific

product Vision because they're solving world problems with what uh they envisioned and then uh wrap around them with softer skill sets that may be less abundant in this region uh and such as uh such as product management such as uh sales marketing to large commercial Enterprises such as you how to build strategic relationships to build channels um those are things that we believe uh individuals like you want uh can learn really quickly uh whereas technical skill sets keep developed uh take a decade or more um to build which is you fundament premise of uh our investment strategy and the kinds of of entrepreneurs that we're looking for I will Al often say this um we're

probably looking for entrepreneurs that may not know their entrepreneurs yet these are individuals that are technologists that have uh enough to main expertise to have uh uh created uh some disruptive innovation they can solve a vexing problem uh they just uh they just aren't aware of the fact that there's a big opportunity for them from business perspective and so hopefully that so you know one of the things we want to do is that if folks have questions about how this works or what you know what do there are some things that we know that that um uh the people in the valley talk about all the time over like in the grocery store line but

around here there there may be not as common topics around investment and term sheets and and series a rounds and things like this but uh you know one of the things we want to do is that if folks have questions about how this works um that that we we want to be available to to answer those but you know Rick uh makes really I think the fundamental point that I've even in the course of doing what we've been doing for the last 15 months or so talked to some people who have said I never would have used the term entrepreneur to apply to myself but I find myself running a business now and sometimes it's conference businesses

sometimes it's uh you know Consulting businesses and and so you may find that some of the skills that you're already using all the time are directly translatable to to this other stuff and I guess where I really uh think that this becomes fun is when you look at the security problem RIT large and you look at areas that you feel aren't being served this is the mechanism that allows you to change that so one of the things just to give you a little sense of how we look at the world right now that um we were thinking about in light of some of the recent breach or not so recent breach news when you look at we've been doing

the security Enterprise product thing for a while I was at an IDs company that bought some years ago and I've sold into those markets um and I've put products into created products for those markets everybody's selling to the same 2,000 customers like you go look at the fortune 1000 or the global 2000 every Enterprise security product in the world says we're going to go sell to those and they almost always start by saying we're going to sell to the banks and there's nothing wrong with that except that there are 14 million other companies that are not those and they may you know small may be hard to get into but medium is a ridiculously broad range of people who do not for the

most part have Solutions being built for them or targeted for them uh by most of the vendors there are a handful of vendors and you know who they are because if you turn the radio on uh what is it wtm in the morning you hear Comm radio commercials for one in particular but if you you if you think about who's actually directly making productss to solve really hard security problems the way we do in the Enterprise world for the midmarket there are like five I mean maybe there are more but you know what I'm I I think if you know the space u there are people that do Hardware firewalls you know and there are people that that do some uh anti-

spam appliances and things but for the most part there's this huge Market that people have not crafted products for and yet we hear that big retailers get hacked because someone went into their heating and air conditioning contractor I'm betting their heating and air conditioning contractor may not be a a a fortune 1000 company I don't know it's a hypothesis right so one question is if you actually want to fix the security problem is there an opportunity maybe to make a company with a thing that addresses the problems of those customers and if you were to do that would that be a crowded space you know what it might not be you might have a lot of opportunities so that that's just

one that's how we sort of couple solving the hard problems to this business stuff in a way that I think is tangible and uh helps us think about companies that might might have some real opportunity another space more recently that that we've been um you know spending more time in and in the current our current crop we have some folks are trying to do things for developers um that's a hard Market you know you can look at folks that were doing source code scanning and stuff and they've had some it's taken a while to kind of get Traction in some of those spaces but you can't deny that there are things that we could do better security

wise for developers maybe it's how I use encryption maybe it's how I scan my code the point being that if you want to solve those problems because they annoy you or because you see a a a huge set of people with those you can start a company and you can address that and you might be the person with the expertise to actually do that and it may not be it's going to be a challenge the challenge is different so in versus the Enterprise Market the challenge in in the midmarket is there are whole bunch of people that you have to find for customers they're just more of them and they're spread out and they're not as

Consolidated so there are other ways to do that like Channel strategies and resellers well so I think uh inting probably our biggest investment thes is you know uh finding those solutions that they can solve the problem Market says

that um the B market is are relatively untouched and a lot of it is because the delivery mechanism the channels to get the market to start mature enough go try well if we are uh go try to sell a work security product through an ISP is hard they're not equ sales oration to do it very well um but when you do it once or you do it a couple of times um and you can uh demonstrate the effectiveness of that channel I think you've done a lot of uh you know solve most Ving problems u in in getting security products to Market let just one step back I uh so I mentioned I got into the security

industry around 1999 uh and then I can I recall honestly getting out of it in 2002 you guys many of you were probably in the industry around that time it was hard uh we you know uh we just had an economic downturn there was no discretionary sping at the large Enterprise level and really difficult to make money and and I a lot of us were flocking into Federal andar did the same thing and U you know got into Homeland Security for a while been tell back probably around 2004 2005 it's just um you know more um you know I I would uh I would say the market is uh it's just different now if uh I try

to sort of identify what those things are that that make it different uh but it's just quite honestly one of the most exciting spaces to be in from an investor uh perspective and I think one of the key reasons that it's different considered just a Main Street issue now I mean it's not just in dark reading that you're reading about you know PX it's the Wall Street Journal it's New York Times it's the Washington Post Main Street uh Main Street is aware of a problem they car about what that's doing from our estimation is opening up uh opportunities uh for Innovation that addresses the problem of everybody from the 14e 2000 and below and so we

spending a lot trying to figure out who to invest in uh to solve uh those problems because we believe you know if you're committed with the metap white space we believe that's where the white space is that's where the competition is not and our companies can be successful and by the way there two of our uh entrepreneurs are here Marcus carry from bar and Josh Marette from hopefully we get some Q&A question so so one question for the folks here um I'm I'm trying to divide some bins here uh how many folks work for themselves or for a small uh shop like okay good um how many folks work for a really big like big company you

know okay so it's a good mix um yeah he beat me to it um so you know I I spent the the entire 1980s for me were largely Consulting and um the great aspect of that and the reason I actually encourage people to do it is I got to be inside commercial military Federal civilian federal and academic customer environments and I learned a tremendous amount in each of those which became useful later um so there's there is a lot of good stuff you can get even to understand how they decide what to go by or how they solve problems um but I came to the realization that small is more fun and um so how many of you have ever

thought about how many of you have a thing that you've been thinking would be really useful it for a whole bunch of people and maybe have built or thinking about releasing an open source project wow that's awesome that's excellent so you're already helping things get better um can I ask you a question okay just um bra for brave what's raise your hand uh one of the things that often holds up myself and probably other people who do Services work is you have a great idea that solve more than just the immedate problem but you have to pay the bills and so something like an accelerator that could give you to take time off from your day

job and do a little work for a couple of months to see your little ining of an idea turn into something maybe a or maybe can I can I address can I respond to that and here's what I think about that um we started out the accelerator about I said a little over a year ago when we sized our initial investment is $25,000 investment and by the way that the amount of money that that we give uh uh we we take an equity percentage in in the business uh that we're investing in it it really is not it's really uh the percentage that we take is really based on the value we create has less to do

with the amount of money that we're giving um the $225,000 we actually ended up doubling and here's why um in order to get an entrepreneur to make that decision to cover some of this opportunity cost for a 3-month period of the accelerator $25,000 and there were um and the demographic that we were trying to attract into entrepreneurship um was uh these were U West Coast you know fresh ad of undergrad entrepreneurs these were individuals they had families they have our PS they had mortgages some have kids in college are you know real honest to God you know people that have financial responsibilities that we dealt with um and uh just a very small increase in in the

amount of equity that we wereing based on the additional money uh but we we think that that was U the the right thing to do because of that reason yes you know you're successful you're running successful businesses and and what you have an idea that we like we need to make it we needed to make it compelling enough um for you uh to actually take that or for some of the other people who raise their hands to the large company you have an established career and you know a stable path and hopefully you know well compensated so taking the leap to say I'm going to quit my guaranteed day job for life to yeah you know put my my

house at RIS all I can do is encourage you guys just personally you have a guaranteed day job I did not raise my hand for theise question but people who you know feel like they're comfortable stable work for these days you have a guaranteed day job I bet a 100 people love work these days guarantee doesn't exist yeah Josh is the quietest guy we have hard get out of his define opportunity cost uh one you can make doing something else you know we we um we're asking our entrepreneurs to to give us 3 months of their time and while there's you know some flexibility in for them to do other things it's hard work right it's a it's

a 247 job starting a business and and that's and something we take 8% of the companies uh and so that that's not nothing and that you know if you ask us what keeps us up in It's thinking about how do we earn that back and make sure that unpr feel like they got hell a lot more 8% value uh the businesses uh when they leave and so we we uh they can't do much else we'll just put it that way we uh typically look for two entrepreneurs some exceptional people can do it with one uh but it's just a lot of work right marus yeah and so uh you got to cover so I mean there are I think you

covered a lot of the reasons that kind of hold people back and I'm not going to say that it's trivial in fact what I'll say is it's hard and it may be the hardest thing you've ever done but it's going to be hard in different ways than you're used to it's even harder so the analogy this is an imperfect analogy and I've I've I'm still working this one through but I've been trying to use this deer hunting analogy and I was trying to compare my life in the federal world and my life in in the the product startup world and it's like kind of when you're doing some of the Federal Business the deer sends you a letter and

says on this day at this time I'm going to be in front of this tree but you only get one arrow and if you miss you might be able to complain and get another arrow but you know so is you can say is that easy no it's not because you might miss the commercial world is different there are a whole bunch of deer but a bunch of them are like rabbits and deer costumes and you have to sort out which ones are real and which ones aren't um yeah it's a terrible analogy but but the point being that it's it's hard in different ways you know and one of the things so one of the things that we find

is like uh if you're doing Services you can pick a whole bunch of different kinds of um structures for the company you could be a soulle proprietor right you could just be you you could be an LLC which I think is probably what a lot of majority of them are you can be this thing called sub chapter S which is a corporation except that it's kind of really you and some of the tax stuff goes straight to you and it's simpler but the sub chapter S has all these limits on if you ever were to have investors how many you can have and things like that then the one that most you know big Co would be are sub uh sub

chapter c um those things actually turn out to matter way more I would say when you're trying to do a product company and the reason is not so much about product it's that to get into the market with a product company is expensive and it requires usually that's why and and I will say and I think Rick will Echo me on this we are not saying by the way that everybody in the world should always be getting outside investment from institutional investors for their companies I love bootstrapping and paying building my company out of my own revenue and by God if I have people willing to pay me why wouldn't I do that but you know what it's expensive enough

to get a product into the uh into the commercial Market that you may have to get some investment from somewhere else and so it turns out that when you have outside people who are in the business of investing investing you things like what form of company you you use really matters so it turns out out that the ones that are simpler for one person to use are actually harder for investors to invest in so you have to be conscious of that um and that winds up being I think for purposes like when we bring somebody in sometimes they don't have a thing yet sometimes they do sometimes they have a big company and they're spinning it out

into a a little company that that they're these mechanics that matter and it's not that they're intrinsically better it's that the rules that are set up around them require you to be cognizant of the fact that like the IRS says you know if you're a sub chapter S you can't have more than so many investors so you're never going to have if you start one of those you're never going to have a venture investor invest in you without making you change what your company is anyway which cost money which cost money the um actually so there were some other questions reason hold up so I I think other reasons at least for me it's also um being able to

judge if there a market for yourct and also uh knowing people that so for instance I I have

a experti give them that idea you know help you know get them to run with it I think those are two other things that sort of prevent people from that and I don't know if that's something before you get to the investment part that you need to so so is something you need to resolve it's something you need to resolve before you get to an Institutional DC uh if you're going to build a security Product Company of course are exceptions but almost all of you will require um your institutional because it's so expensive um the um the issue around uh not sure not being certain that there's a market there I believe that you can probably get Angel

investment demonstrating that there are hand customers that that want what you have uh I believe you can't get Venture money unless you can demonstrate that there is an actual pipe or there's a there's a market validated that there's a market for what you have and that's in one understanding who the buyers are understanding why they want what you have uh real anecdotes with a statistically relevant sample of of interactions with perspective buyers there may be reasons they haven't B it yet um maybe they're waiting to see the maturity of the the product waiting to see maturity of the company you'll get that a lot um but all of that u in validating that the market exists so

know how big it is how much it's growing who they are how many there are and how you're going to get to them um are all things that uh we focus hard and and just to give you a sense there's a sort of a Continuum in terms of validation that you can get from outside parties that it becomes helpful when you're talking to investors so kind of at the at the most basic level is um somebody out there in the real world doing a real job who's willing to say this is a useful thing and would probably solve a problem I have and if they let you quote them on a slide so much the better even if they're not

trying it yet and even if they're not paying you the next is somebody who says I'm willing to try your thing in my real world environment and I'll give you some feedback but I'm not going to pay you yet I'll do a pilot and kind of see um and then there's and this is the big dividing line there's somebody who says I'm willing to try this out in my real world environment and I'll pay you something so the interesting thing here is that that something doesn't have to be a lot it just has to be provable so your first install for an a useful thing could be a 90% discount for your first pilot customer but it's still a paid

pilot and when you talk to the angel investors that is that is sort of the minimum place where you really start to be able to get some things done if they're willing to pay you something less than a 90% discount obviously it's it's always it's better but all of those are helpful and um there are other things you can do to um we can talk about about this to accrete Value around your

company I mean so you said that was holding you up one of things holding talk to you got you know uh one of the things that we've done is uh aggregated a network mentors that are in some of whom are buyers some of whom are industry analysts but that uh that do know or at least should know that there's a market there and can facilitate uh those interactions with prospective customers for you uh so that you can ask that question and that maybe the answer is yeah i' like that or no the dogun or I'd like it if and maybe pivot a little bit that's I mean this is thetive nature pivoting is uh change

direction my product I might do something different I discovered a new value for what I built that I didn't anate ahead of time just to give a personal note when I came in the door M 37 I had a list of people I was going to be selling to that has not only turned 180° and changed and got 14 different directions but they were like it's cool and they help me hunt down the people that could validate which directions I needed to go in it's totally changed when I started it's okay I make this a commercial but but Josh you know makes a good point when you get real world feedback one of the things you'll discover is

that and and you're asking exactly the right question like what is the market the problem you think you're solving May in fact not be the problem that the market really wants solved but you might be the closest person to it and so uh the so one of the other hard things because I don't ever want to make make this look easy one of the other hard things is you have to balance your Resolute Focus that you've got something that's really good and and going to make a difference and going to change the world and be useful to people with a willingness to receive input from outside that tells you that one of your underlying assumptions isn't right and

it's really hard to balance that because you have to be confident that you're doing something that's important and that people need it but you also have to be willing to listen to your universe and change and adapt so I I have no idea what the best analogy is there's probably some Naval one with steering a boat but but you you know you're trying really hard to get to this you know you're you're on a heading and you're trying to get to this place but you may have to like go around some sandb bars and stuff and it's that is a thing you have you that it the good news is it comes and it mostly comes from

what Rick talked about which is talking to people so right now today if you have a good idea I will tell you most people hurt themselves more by being too especially in this industry by being too Cy and conservative and parent oid about talking about what they think is important and what they want to solve than just talking to people who might be able to say yeah I have that problem and I would love I would love it if you did that let me when can I try it we're so paranoid that somebody's going to rip us off you know that that we don't want to talk and I think a lot of us depending

on what communities we came out of our nature might be not to talk you you you do you have to talk to people and you know talk to your trusted colleagues talk to your personal mentors um and and just kind of Bounce It Off people because in the early stage you know a 15minute conversation can change the entire trajectory of your of your company in a good way does does that help I question to how people expertise to sort of help you execute your idea is you know you I guess you just have to talk to people and see you know how they may be able to help you with that you know so too yeah building a network or

leveraging a network is is really important U and that's something that we recognize our compies and so we open ours up our MERS open theirs up and you know that that's really that exist stand but it kind of is uh we're trying to BU that here so that you know there's an area expertise that you need separation away from that I will say what we try to facilitate with our entrepreneurs is a vision of what that businesss like soing there an exercise that important for think you to run through this is where I am now probably guys or GS um I'm going to get a SE funding by the way in and what we do at least we're

building uh the product companies intervention funded there are multiple rounds of funding that you'll have to get each round is associated with ACH and those are reasonably well known and understood by so there's if you will that you're going to be aligning your business to and in each stage of this formula you're going to say okay well I need to hire and a team of developers I'm going to be the chief salesperson uh and marketing and that uh and all the back office by the way the see start the job World um and then perhaps a product and then as we get that se we start then I can uh achieve enough progress that I can get a series

investment which is you know multiple millions of dollars and that allows that infrastructure for software business which would include QA some uh sales engineering support uh in probably two or three sales professionals that that have come from your industry that have if they want you sort of you demonstrate that yeah we're able to not only there's a market there not not only that we're able to sell to it but also that we're able to support those customers uh successfully so that they renew and all the essentials of this business plan Mak sense so the only thing I need to do at the end of that is to raise more capital in high more sales people and so it's

really kind of a simple uh uh framework uh for Building Company and it's it's not it is a rocket sence but it may not be something you've been exposed to so we make sure I would make sure you get exposed to that sense of okay well you know I'm going to have this vision for my business over 5 years and have an exit exit is sell a or go public at a valuation that my Venture investors are going to want uh these this is what the compan is going to look from now over the

next do

open so you know they're not mut they're not always mutually exclusive by by the way and you know I think I think Marty rash with snort and sourcefire is probably one example of somebody who walked that that balance um and tried to do good things on both both sides if that makes sense if I don't think that they're necessarily sides but you know what I'm saying that so I think there are at the end of the day it winds up being pretty similar to this gentleman's question which is what's the market if if it's really and I don't want to use a buzzword but if it's really Innovative if you're really approaching the problem in a different way or you're really

getting better results than the things that you get now you know that you can get today are giving you um there may be an argument for a business there uh for two reasons one is that uh that's an OP definition of an opportunity but two it may be that to get the resources to really take it to where it should be that's actually the easiest way to do it there's absolutely nothing wrong with open sourcing a product and in fact um you know we're all using this stuff every day and everything but and to your right is is doing it right now but there is if you looked at there was one study I had seen

and I don't claim to be the authority on this that said that the vast majority of Open Source projects were not maintained past one year you don't want to be one of those because it means people aren't using it or if they're using they may be using it but it's not getting better and having Yeah well yeah or somebody else might take your thing and go do it right that happens so that's another argument so at the end of the day it really it really does come down to validation of of the the user but from the users and you know if you talk to your community your peers your colleagues your customers and you get a lot of feedback

that says you know that would be a really good thing I would say think about whether or not a business could support taking it to where you really want that that solution to go because you know by definition the business is sort of the container into which you put resources do we have a question here

like the overwheling task of researching my comption and yeah I validated my market and I validated but when I don't know what I don't know that's a problem and how do I figure out great there's other person who does a very similar thing for price and known and how do I fig that out so you don't mind so uh so I I think it's important to not understand your competition uh for an early stage if it's a early Market segment so the market segment is mature uh don't fret too much over the fact that someone else might be first mover in fact uh for many of us uh that might be better if uh if CO3 is is basically spending all

its money on Garder to create the space for you to actually and second better you know for example uh could be a reasonably good strategy right yes like that one um so uh but it is important for you to understand uh two two things one um how the customer thinks about you or what bucket what bin and his budget you're going to fit in into because if you can't describe that and he doesn't have budget for that your sales cycle just went from maybe maybe 3 to 6 months to 12 to 18 months because you're going to have to go through a budgeting cycle which fights if you're a new strange thing if you're a new strange thing he's

going to have to you know or he's going to have to make the case to management that I need money for this thing um so that that part is important and the second part is uh every one of your initial uh about your customers when you're making your first pitch are going to say who's your competition and how are you different if you can't answer that question then they're going to make you don't understand and your investors definitely will so if you ever ever ever find yourself in a situation with an Institutional Investor like a venture capitalist and they ask you who's your competition and you say we have no competition go home because your meeting is is over

there are there are great resources that are out there um you know we uh for our entrepreneurs we we do leverage Gartner um because and Gartner Gartner is an industry analyst organization that um it's is probably the most most highly used at least by uh large Enterprises to to bet new new security spaces or new actually so if if I may they they do two things so they said they they kind of play to two audiences so companies big companies pay them to hear about what is new and useful and cool it might solve my problem and vendor companies product security product companies pay them to uh understand who else is in this space where's the space going and how the

customers buy so they have this interesting role that they kind of get to sit on both sides of the fence um but they produce all of this content some of which you you Pro may have seen um they do a thing called Magic quadrants where they'll take like a particular sector like you know IDs or fir walls or endpoint protection or whatever and they'll try to plot both on kind of price and capability where everybody all these companies fall to help customers understand that um it's expensive to to work with them but they also when you're startup company are the folks you talk to to start seeding the customers with the idea that this thing may be coming so that is part

of the other function did we have a

question so I'll tell you what I do um two things around competitive analysis one is usually when you're starting you don't have thousands of dollars to to spend on it uh so there's this thing called the internet and you can find old so so all these analysts is fascinating they write these reports and they cost like $5,000 the day they come out and the price goes down and down and down until it becomes free so the ones that are three years old are actually out there and you can read them but when you start searching you'll find other companies presentation decks slide Decks that quote all these other reports that they did pay thousands of dollars for and um so if

they're cited you know it's a data point you might want to try and double check it but I'm a firm believer in not paying too much if you don't have to early on because I can see well two years ago these people said this was going to be the next thing and they were right and this applies to me this way um the other thing when you're doing competitive analysis your competition is not just other companies that do exactly what you do your competition is anything your customer might spend money on that's not you and so do we have a question in the back here I you can usually get those G reports for free like like if one comes out

let's say you know the current month just by going to one of the companies that's going to be on that chart and saying that you're interested in the product they'll give you the full report just for giving your email so you don't have to spend thousands of dollars when you can just you know say okay I'm interested here's my email and you'll get a repord in your inbox and you'll have every company's radium right there very good point thank you yeah the the other thing I would also add is that there are other uh industry analysts uh that are that are out there as well you know many of them we have relationship with osis uh or one group uh there are uh and

it's their job to understand what's uh what's on The Cutting Edge that's coming down the heght in the clock that's a great OPP you get to solicit feedback about okay well how how am I you know I've told you what I do how do I position against what uh you're aware of that's in the market and they'll have that conversation with you you know part of get to take of their business that's question anym yes so I guess how do you determine uh if you got so if you've got I guess a new idea um I don't know something something brand new how do you determine where you fit and what what your mark is so um one is

to look at to look at the stuff at the analyst stuff out there to see how they divide the Universe um that's actually a there are a lot of answers to that question but the uh the bottom line is see if there is a a bin or a category that's already defined understand that if you want to create a new one that is a sometimes it can absolutely be the right thing and sometimes that's the only choice but that is a long slog because you have to win over the analysts to understanding that a they haven't been representing the universe of things effectively and B they need to basically double their workload to write about a new space

sometimes that's the right thing I would say look really hard at what's been published and what's out there and and the positioning of other companies that are doing something around it and see where they've been placed by the analysts and customers in terms of categories and then think really hard whether it really is a new category and there's there's not a right answer to that it could be it could be that there's a category you want to fit into because you're just so much different and so much more awesome but don't look don't look too unusual that you could do that that saves you some time and trouble and money at the same time sometimes you know what it's

radically different it's a big bet um I'll give you a good example um Gardner has a new catery category called endpoint detection and response which is all of the stuff that's not antivirus because we didn't have another name for it like fire eye right so all these people started putting things on the wire that were trying to care about the endpoint but it's not the Endo so they had to create a whole new like category for that uh so sometimes it happens after you've put yourself out there with your solution and people have seen it and have said you know this is silly they shouldn't be calling this IPS right this is something else well yeah there

is we one more question and better uh I just wanted to say something which is I moved from Rox New York to be part of this program and uh I I struggled a lot with you know they a little bit of your Equity they they um there's conditions and turn sheets and all those things but at the end of the day like the value they provided me and I'm only seven weeks in is just it's mind line um the network of people that that Partners have is awesome the people that they're putting in front of us have like legit credibility in the industry and uh it's like a whole another master's degree in like 7 weeks so you

know you talk about um you know hacking your business like they're providing the tools to like you know figure out what we need to do to be successful so I if you guys you know aren't sure these are the people to talk to you to really um to figure out if it makes sense to you know chase this dream that that thanks thank you JP I appreciate that so one thing I did want to say because the last thing in the world um I we enjoy talking to people who are really early and thinking about it and trying to figure out if there's a thing there so one thing I would say is like whether you're

interested in the program or not I'm happy to talk to anybody about how this works because I personally found it really fun but the one thing I'll say is if you have not looked at the body of of information out there saying that cisos and security people are not being taken seriously within their large organizations because they're not navigating the like being able to articulate the issues and things like this there's a professional development aspect here and whether you do it by starting your own company or whether you do it by just trying to learn about business I think that the most effective security people are those who can communicate to their customer in a way

their customer can understand and sometimes it's going to be a little different than the way that maybe we communicate to each other and I know that sounds really obvious but apparently this is an issue even for cisos and so part of yeah you know professionalism matters so you know part of why yeah so part of why we're doing this is that we think that it's a professional development issue for the infoset community to understand how business works I personally think the best way to do that is by starting your own but uh that's just my preference and my risk tolerance and I know not everybody shares that so I would encourage you regardless to think a a

little bit about the business that you're supporting because you know security is an enabler

thanks