BSidesNYC 0x05 - The Good Business: How to Bootstrap a Business to $10M and Beyond (Christian Hyatt)

Excellent. Cool. You on? Excellent. Well, thank you guys so much uh for being here. It's five o'clock on a Saturday, so uh you guys are the real deal. Thank you. [laughter] Thank you for doing that. Um >> yeah. Uh so I've really thank you for giving me the opportunity to give this presentation. Uh it's been fun putting together material because I've been reflecting on like the last nine years of building a company and trying to put it in a structured format to kind of deliver some value to you guys. Uh so that's been uh just kind of therapeutic in a way. So I'm excited to share some of that with you guys. Um and I think

it's fitting uh the first time I ever give this presentation is in New York City. So there's something about that that feels really right. Uh, I'm out of Atlanta, so and I love New York. Uh, cool. So, just a little bit about me. Uh, my name is Christian Hyatt. I'm the CEO and co-founder of a company called Risk 360. You guys are going to learn a lot about that here in a bit, but that's who I am. Um, I'm married. Me and my wife are actually high school sweethearts. We've been together forever. Been married for 15 years, and I have three kids, uh, eight or 11, eight, and a two-year-old. So, a big gap there for anyone who's ever dealt with

that. um you know some stuff about Risk 360 um in terms of awards we've won uh credibility credibility I guess why should you listen to me some of that stuff but really proud of the company that we've built um I'll I'm going to go a little bit deeper than I typically would in a presentation about like who we are our business model because I think that's applicable for some of the stuff we'll talk about um but that's that's me a little bit about me um a little bit about risk 360 again this is the business model side of it that I think will be um impactful later is one thing you'll notice about risk 360 is

that we offer professional services so consulting services but we also have a SAS platform and even the services that we deliver are tech enabled so that's probably going to be important later main things that we do is one we help companies comply with any framework so whether you're trying to do ISO 2701 sock 2 whatever that is sometimes we're the auditor but more often than not we actually help uh do program implementations uh we do attack surface management so that's our offensive side of of the business typical ical pin testing, red teaming, that's a platform that we've also built. So we have an attack surface management platform and then we have an optimized part of the

program where we help companies uh implement Agentic AI and then we have a GRC platform that we've built um that companies run their whole compliance program out of. So kind of trend there is uh you'll see that we're bootstrapped. So one of the things we're doing is using services to invest in platforms. So that'll be a little bit important. All right. um a little bit about what to expect here today just to kind of level set because I'm going to speak from experience a lot and kind of reflect on the journey and hopefully have some things to offer all of you. Um number one is this is not a hypers skill story. Um I think we've heard a lot of those.

Um this isn't going to be uh like how to make history, you're going to be a legend after this. Uh like the hype story of building a company is I'm not going to tell you how to do it fast. I've been on this journey for nine years. Um, I'm not going to tell you how to take funding. Uh, we're bootstrapped. This definitely is not for everyone. Um, and this isn't the story about how to get so rich that you buy an island. What this is is a bootstrap journey. So, if you're interested in bootstrapping a company, uh, even if you plan on taking venture capital money later, um, this is for you. It's going to be practical. So,

I'm going to kind of talk about some of my business philosophy, but then also hop into some of the tactics if you're trying to build a company. Um, and I'm really going to do my best to speak from experience. Um, so as some housekeeping, if we get to a section in here and you guys want to pause and ask questions, I I would welcome that. Um, we can have a conversation if it's applicable to you. Um, the type of business that uh I' I've put a name on this type of business and I call it the good business and that's what I want to encourage you all to try to build. So, you know, this room is

probably full of people who are either current entrepreneurs, you're thinking about being an entrepreneur, or maybe you just want to work for a company like this. And, uh, this is how I define it. Um, it is a good business. So, the things I'm most proud of about Risk 360 aren't like our track record of growth, our company logos. It's really like what we've been able to do for our employees in the community. So, for example, I had some I ran some numbers before this. Um, past nine years we've, uh, paid almost $50 million in salaries. Uh, which was a lot more than I thought. That's that's pretty cool. Pay 100% of our employees healthc care benefits. Um, we're only 50

employees. Uh, a little over 50. And, uh, over the last uh, two years, we've had 30 babies, and uh, men get six weeks off, women get three months off. So, imagine a 50 person team. That's a lot of paternity and maternity leave that we're dealing with. Um, so those are some of the things that we're most proud of and just like the culture that we've been able to build that we'll talk a lot about about. So if y'all interested in building a business that looks like that or if you're interested in working for a business that looks like this, hopefully some of this would kind of encourage you guys to consider that as an alternate

path of maybe these hyperrowth scaleups. I tried to add some structure um to this conversation today. So, I'm about nine years into the journey. Um, and I'm going to break this up into kind of three parts and maybe some of it will be more applicable to you than others. We'll talk about uh foundations. So, you know, what does it take to get to that first million? That's a pretty big milestone. Only I think 4% of businesses get to that million-doll mark. So, I'll share a couple of the things that um were most meaningful to me as we did that. Then, we'll talk about how to build it, kind of the build phase. Um, I consider that getting up to 10 million

and beyond. So, how do you go from that one to 10? And then we'll talk about scaling a business. So, after you're up and running, you have a good business model, you're past 10, what are some things that you should be thinking about as an entrepreneur? If you're working for a company, how can you support your company? Um, okay. Foundations. So, uh there's a couple uh a caveat here. What I'm not going to talk about in foundations is uh like how to choose a product. I'm going to I'm not going to tell you about product market fit. I'm not going to give you the MBA talk of assessing market size and and competitive landscape before you start a business.

I'm going to assume that you guys have done that homework. So, as entrepreneurs, you have an idea and you want to try to scale that idea. So, absent that, there's kind of three things that I upon reflection, I think were most important. uh as I was establishing a foundation [clears throat] um I started my career in consulting uh at a big consulting firm like 50,000 people I had a mentor there um who was about to retire and he invested a lot in me so I was very fortunate in from that aspect [clears throat] and uh one of the things that he said that I should do

Yeah, one of the things that he uh offered that I do was get an MBA. And I hadn't uh committed to getting an NBA. That wasn't something I was thinking about, but he encouraged me to do that. So, uh I'm from Atlanta, so the school I landed on was Georgia Tech. And the reason I chose Georgia Tech was is because they had this entrepreneurship kind of capstone at the end of the NBA program. So, I said, "Okay, I'm going to not take the partnership at this big consulting firm. I'm going to try to uh use this couple years to figure out what's going on." And so, uh, with his kind of investment in me, I did that. And on the

first day of class, um, my name is Christian. We had name tags just actually a lot like this. Uh, we had name tags sitting on each person's uh, in front of each person. And there was a a guy sitting up very straight, a West Point graduate army officer, uh, who had a name tag. His name was also Christian. So that was an easy icebreaker for me. So I walked up to this guy and we sat next to each other and struck a conversation. And come to find out he was there to start a business and I was there to hopefully start a business. And between the two of us, we thought everybody in the room must be there to

start a business. As we graduated, we're the only two that launched a business out of that. So a little bit of providence perhaps there. But uh what that afforded us the opportunity to do was really for two years get to know each other. Um we we did a study abroad trip uh to China. Uh we uh did the whole capstone project together. So we got you know a lot of opportunity to get to know each other and uh so as I'm I've seen many many businesses fail because of broken partnerships. Um but genuinely I wouldn't want to do it alone. So if you're considering starting a business in those early days, I think getting the

partnership right is one of the most important things that you can do. So tactically a couple of the things that I think make sense is number one like look for complimentary skill sets. So early on I was kind of the SME more on the sell side. I was also delivering work. CW was more operational. Um so that was a natural fit for us. Um CW actually had me meet his wife and uh he has a lot of trust in his wife and if she would have given the thumbs down he wouldn't have went business with me but she gave the thumbs up. Uh so that was important and then uh we we do a lot even today to

keep the relationship healthy. We do an annual founders retreat where him and I go talk about business. We do weekly one-on- ons. So I think this is probably the most important foundational item that you can do is choose a good partner. Um, diving in on one thing that I see breakup partnerships most often is aligning on money. I think uh I remember when CW and I went to open a bank account and we hadn't directly talked about specifics in terms of money, but uh when we sat down they they went down the list. How much money is in your bank account? How much money is in your bank account? And we kind of looked at each

other and we're like okay like we should have had this conversation before right now. But um some of the things that I think are most important is uh things like lifestyle choices. So I'm talking about bootstrapping a business. So there's a bit of a vow of poverty for a time. So if I was going to get into business with someone who, you know, had a huge uh baseline of expenses or maybe their dream was to buy a mansion and and a Ferrari, that might not align to what I want to do when I'm driving an old pickup truck and have a humble house or vice versa. So you need to have real conversations with your business partner

about those types of things. Um, equity split is often a conversation uh that has I don't recommend 50/50. So if any of you are considering that I think that's like the good dudesmanship move like you feel like that's fair. You start at the same time do 50/50. I think that sets you up for failure. There needs to be a boss. Uh even if it's 51%. So uh consider that. And also think about base salary and distributions. So if you're lucky enough you might have some profit. what do you guys plan to do with that profit? Does one does one founder want to put it all in their pocket and have and increase their base salary or do they want to invest it back

in the business and try to grow the business? So, those are some of the things that you need to talk about with your business partner um as you're making that partnership. And I think that gets skipped a lot. And then I think one of the things that CW and I had uh in common uh that we were very lucky about is that we had a common why. like there was neither one of us were in the business or we didn't want to start a business for money. Uh that wasn't he was an army guy. He wanted to build teams, you know, he had visions for his family. And so like that drove him and uh that became his why.

And I was kind of reflecting on my why as I was preparing this this talk. And one of the most vivid stories I have is I had this had this weird childhood where uh we had like a lot of poverty uh me growing up but my parents were also did some things great like for example I wrestled in high school and college and I don't think my mom and dad ever missed a match. So there was always this encouragement that they gave me but there was also this poverty that I had to deal with. And one story I remember is uh my dad found this box of cassette tapes, just random box of cassette tapes, and we needed help uh paying the

bills. So he dropped me off at a grocery store parking lot when I was like eight or nine. And he said, "Hey, see if you can get donations for these cassette tapes." And I remember walking up to people, and it didn't seem weird at the time, and saying, "I have this box of hip-hop cassette tapes that are totally inappropriate for eight or nine-year-old. You know, you want to give a donation for them?" And I distinctly remember like being so proud because I was coming up with these bundles like hey you get two for five bucks and that's just representative of like my childhood. So one of the things that became my why was just betting on

myself. I think I learned through that process that like like I can make it if I really try and also I don't want my family to have to go through that same stuff and I don't want my team's family to have to go through that same stuff. So I say often I would do this for free. I would build a business for free um if I had to. I don't want to, but that that's my why. So between me and him, I think we just have this internal selfm motivation. And I can promise you that if you try to build a business for the money, you'll quit. Like you will quit because you'll run out of money. There's

not enough motivation in it. Most of you can probably make a lot better money in the short run by going to get an executive position at a company. So my biggest piece of advice is do not do it for the money. You'll make money later. We'll get to that. Um I do think that there's some special uh there's a special thing that happens when you commit to something. So just on the practical level like what did I do when I was starting you know not to quit to keep myself from hopping out of the business and having to go get a full-time job. Uh number one was uh family buyin. So my wife uh was as

committed as I was uh to the business. She kind of knew that there was a lot of risk associated with that. And by the time I told them I was going to start a business, like she was like, "Please, please start a business. I'm so tired of hearing about it." So, I had that kind of support. I look at like old journals I have and I was just like putting business plans together incessantly. I was quite obsessed about it. So, like not just her, but also my in-laws and my parents, like everybody was like, "Oh, Christian's finally going to start a business. It's about time." So, that gave me a lot of internal selfm motivation. The other thing I did is uh

you know, I'm pretty riskaverse. Maybe I'm not, but I considered myself riskaverse at the time. So I calculated like what is the cheapest I can live? And I started the business when I was 27 going up 28. 27 28. And luckily I wasn't so far in life. I have so many kids that my expenses were too high. But I was like this is as cheap as I can live. And then I built a year savings in advance of starting the business. So I knew I could at least live for a year if I had to um without quitting. And then also the other thing I did that I'd recommend that you all do is uh I just told

everybody like they operated as my accountability partners. It's not something that I kept secret. Pretty much day one I was like I'm starting a business and I was very clear about my commitments and goals. Uh and I think some of that like fear of failure in public uh was a pretty strong driver for me. All right. So if you have a good business partner, you know, I think I I talked a lot about the self internal motivation, but as you build a team, um your team needs a different type of motivation. You can't ask them to be motivated the way you are. So one of the things that uh I did very early on, pretty much that first year when we had

our first couple of employees join is we started um doing this off-site. We start we still do this today. We do off-sites. They're not at cabins anymore, but we used to do them in cabins in in North Georgia up in the Blue Ridge Mountains. And I remember uh driving up to the cabin our first year and uh we went down a long road and I wrecked my car and we got stuck. And uh at the time I was like, "This is this is not going to scale. This isn't something we can continue to do." But we eventually did make it to the cabin. And then we locked ourselves in there for for three days and came up with the plan. And the

reason that was important is because um that was the first time that I made a commitment, what I call a big hairy audacious goal, the be hag. So where are you trying to go? And we put it down on paper and uh and there's something scary about telling your team where you're headed. Like that's a commitment. Um and then what I found was that they were uh once I did that, they were ready to align to that pretty quickly and that became motivating for them. So here's how we did it. Um y'all can steal this. So this is like kind of what the slides look like just for reference but we have uh still today this is still intact. So

we set a big hairy audacious goal that's kind of where we want to be in say five years. So right now we said by 2027 we want to be at 35 million annual current revenue. So set that stake out there and I have team members all the time ask how are we on track to our behag and if we miss a number they're like do we need to change the BhagA? So it's a little bit scary as a founder to put that number out there transparently. Um then what we do, we have the B hag, there's a financial piece of it. There's also a cultural commitment uh for that that you'll see in the bottom section. Like

we're committed to being this thing I call the good business. And we take that and then we uh make it into an annual plan. So we have an annual kickoff meeting in Janu January every year. We talk about how we're going to progress towards that plan and then we break that down into quarter uh quarters and we fly the whole team in every quarter and uh give an update and and uh and have a lot of questions about how we're progressing. And then our individuals, you know, set individual goals based on that uh that. So that's become very powerful for us. It's not something I expected to last, you know, a full nine years, but still something going strong

for us. So I think I think if you do just those three things and you have any kind of decent product, you'll be able to crawl yourself to a million dollars. Um I think those are the foundations, but I think a lot of stuff changes as you get to that million dollar mark and you're trying to scale up to about $10 million. And uh I think one of the most important things, this is probably the highest value thing. You don't have to wait until million to do this, but one of the things that we revisit all the time is just how to niche down. Um you know, I think one of the things that um is very

scary as an entrepreneur is like you're afraid to turn away revenue. So one of the things that you do is you become all things to all people. Uh you have all these different services that you offer just because you're looking for the revenue. Maybe you're not confident about product market fit, but that really muddles your message pretty bad. And that's that is the number one mistake I think we've made over time and then I see other entrepreneur entrepreneurs make um as well. So three uh actually let me tell you. So, I remember one of the ways that we got to a million is we were doing contracting work uh for for a huge insurance conglomerate that were was out of

Pittsburgh and they were paying us hourly rate and wasn't a great hourly rate but it was a lot of hours and so a lot of our revenue was made up by that and it required me to personally go on site with a team and do some of the assessment work and uh I remember we were in the winter there. I really like Pittsburgh, but we're walking to the client site and I'm from Georgia, so I've never seen this before, but there's like these icebergs floating down the river and it's like sleeping in my face and we're making this bad hourly rate and I'm saying no to other projects, frustrated we've been kind of at this

ceiling for a minute. And at that moment, I was like, man, we can't build this. This is not the kind of business we can build. Like, we're going to have to turn this down and do something else. So, we started basically did an inventory of what our best services were and this wasn't it and really leaned into that. And one of the first exercises that we did is defining our ideal client profile. So, if you're considering starting a business or if you already have a business, this is pretty much the most valuable exercise that you can do that cost you no money. Um, like get very specific about your client avatar. Who is the company that

you serve? So, for us, it's kind of enterprise, subenterprise. if they have a lot of complexity in terms of compliance and technology needs, they're a great fit for us. That's great. That's the company. And then who's the individual at the company that you want to serve? And uh you can kind of you can YouTube this, but you can look up how to build avatars and like what's their family setup, how old are they, you know, what cities do they live in, like the most detailed that you can make this avatar, the better. And that will inform everything you do. So if you're building a website, you're going to talk to that avatar. If you're building products,

you're going to talk to that avatar. And what that really helps you do is uh cut through the noise. So when we did this, that basically unlocked a ton of growth for us. So we do it all the time. We revisit this to make sure it's still accurate. Another tactic that you can do is um I call it digging small holes. Um so there's kind of this innovation flywheel that you have to do when you want to offer a new product or service. How how do you think about what to offer? And remember, you're bootstraps. You have to do this profitably. they have to deploy capital very efficiently to earn profit. So here is a way to think about how to

experiment. Uh first thing you do is like think about your investment criteria. So for us um some of those investment criteria when we're thinking about a new product or service is does it uh does it is it relevant to our current ideal client profile because we want to stay within that niche. Um is there at least a million dollars in annual reoccurring revenue on the table within the next 18 months? Uh can we deliver it efficiently? Do I already have the people on the team that can deliver it? So we have this set of investment criteria questions that we ask before we launch a new product. If that is a yes, what we do is uh

basically I approve a paid pilot project. Uh we do not we don't do free proof of concepts. My experience is those aren't very effective because the client doesn't have any skin on the game. I mean almost anyone will say yes to something free, but they might not be serious about it. So even if it's 99 cents, like it requires you to go through procurement and get an invoice, sometimes that is enough. But we'll do we'll start with one paid proof of concept. If that goes well, then we move to the next step. If it doesn't go well and we realize it's not a great business model, we kill it. The next thing that we do is we do one to three pilots um

basically at cost. And sometimes we don't even know what at cost is. So this is a stage where we're kind of figuring out pricing. We're trying to figure out like what's the ceiling? What's the willingness to pay? What is a good price for us? How much does it cost to get profitable? Maybe it takes a lot more effort to deliver than we think, but we try to limit that to one to three. Um, and we're we I usually price those all over the place just to experiment and see what the willingness to buy is. If that goes well, then we move to the next stage. And that's when I'm trying to get three real projects

um or three to five real projects. And then what I'm doing with that is I think I know the price or our company thinks we know the price. We think we have a delivery model nailed down, a platform that makes sense. we've really found a a product market fit. And sometimes that turns out to be true, sometimes it turns out to be not true. And one of the things I tell my team, I'm like, "Guys, if we can't find five customers, like, we should just stop wasting our time." So, it should be a pretty fast process to find five customers. And at that point, I'm either making a killer scale decision. So, y'all can follow a similar

methodology. You can do this very profitably. It doesn't require you to invest millions of dollars in capital in advance to build this thing. It's important that you're iterating and experimenting. Like that's kind of the the bootstrapping way. All right. Last thing that I'll give you on on this uh topic is um building a flywheel. Um so this is a thinking model that became very valuable to me as we were scaling the business and building the business. Um Jim Collins who wrote good to great he wrote a book called Turning the Flywheel. It's like 40 pages. So, I highly recommend that you read it. But basically, the idea is if you kind of if you identify these blades

on a fan blade and you make sure that you're conscious of hitting them, you know, it starts slow, but then you gain momentum over time. So, when we think of investment, it's like, all right, everything that we do needs to be in this flywheel. That's how we're investing. So, our flywheel is hiring strange renegades. So, it all starts with people. We have uh we hire top graduates out of Georgia Tech, uh big consulting firms, big security firms. So, we're very focused on hiring. Then what we do is we hire those people and we turn them into craftsman. We have these training programs to to get them up to speed on the subject matter expert, but also the risk 360 way. And

if you train strange renegades and turn them into craftsmen, then what they do is they can build artisan products. They can build our ASM platform. They can build full circle GRC platform. They can deliver great services. And if you do that, you earn raving fans, very happy customers. We have very low churn. Most of the time, we're expanding into our existing customers. And if you can do that, you earn an ineimitable brand. So, a brand that can't be imitated easily. And what that helps you do is return back to the top of the flywheel and hire strange renegades. So, uh me and my co-founder CW, we were in a uh we did a whiteboarding session one day and wrote

that down and kind of sat back and we're like, "This is it." And the reason that became so valuable to us is because it helps us communicate to our team while we're making certain investments. And it's also a helpful thinking model for us to think about how we're investing. So all of you will have a flywheel. And I think this is a worthwhile exercise to kind of kind of think through. All right. Yes.

>> I'm going to talk about hiring in a minute. Is it okay if I table that? Because we'll get to hiring. We have a specific hiring methodology. Um, all right. So, if you do those two things, uh, you're going to have some money. I can promise you. So, there's some finance 101 stuff. If you're deep into entrepreneurship, this is going to be old news to you, but if you're not, this might be surprising. So, I want to talk about how a million dollars flows through a business and some of the principles that I've heard along the way that was really helpful to me. So, if you get a hundred or a million dollars in revenue, that means you sent out a

million dollars in invoices. Great. That feels great. But you're only going to get if you're world class, you might get paid 90% of that because there's this whole cash conversion cycle. So, you send an invoice, they don't pay you immediately. They might wait 60 90 days to pay you. So, in a year, a million might turn into 900k, probably more like 800k if you're lucky. All right. So, what happens with that $900,000 of cash that you get? Well, uh, about 20% of that's profit because most of your money is going to go paying contractors and employees and, you know, everybody you got to pay. So, if you make a million, that's going to leave you with about

$180,000 of profit. So, what happens to your profit? So, number one, you're going to pay taxes on it. So, about 40% of your profit roughly is going to go towards taxes. I remember my first million-doll tax bill and my CPA was like, "Good job." And I was like, "That's terrible." Um, so about 40% of it's going to go to taxes. And then we follow this thing called the 403030 principle. It's something that was taught to me, but I found it to be very effective. 40% goes to taxes, 30% goes back into working capital. So you're just going to put it back into the business in an account for whatever you need to do with it. And then another 30%

of it is free cash flow. So what do you do with free cash flow? Well, you can do a profit share and give it back to your employees. You can pay yourself a dividend and take some of it off the table. Or if you have some special initiative that you think is going to pay off where you can plow it back into the business, but people are often surprised that a million dollars is only about $50,000 of free cash flow. So think about that as you're trying to bootstrap a business. You have to deploy capital extremely efficiently because you don't have a VC fund out there where you can run uh run in deficits. All right. Um I'll pull point out just a

couple more things I think are very helpful. uh build your capital reserves. So uh first order of work is building about uh three months of savings. So figure out what it takes every month for you to run your business and save up about two or three months of working capital. That's just risk management. It means that you never go into crisis mode. You can operate calmly. You're good. Um second thing that I recommend is at this stage you need to pay yourself a market rate. Founders get paid in two ways. You get paid as a CEO which is your base salary. So find out what the market rate for a CEO of your caliber is and pay yourself that just

like an employee and then you get paid as an investor which is your dividends if you choose to take any of those profits off the table which maybe you will maybe you will not but pay yourself a market rate you need to do that don't take a vow of poverty forever once you get to scale or this building phase pay yourself a market rate I talked about the uh 40 3030 principle uh and the other thing is get paid fast there's lots of techniques to get paid fast for the first couple years. I was sending out all the invoices because I was tracking that down. It was pretty uh pretty miserable. But you can also do

funny things with the payment terms. So, you can ask for a little bit more upfront. You can go monthly flat billing rates so the customer feels better better about that. But whatever you can do in your business model to get paid fast is absolutely essential when you're bootstrapping. All right. Um so let's talk about All right. That's finance 101. Um talk about culture and this will get to some of the hiring questions. So, um, we I remember when there was six of us, we were working at a shared workspace and, uh, we were trying to figure out things like forge bonds, and I off-handedly made the comment, I was like, let's run a 100 mile relay race. Like, no one does that.

It would be really cool. And I expected my team just to be like, you know, brush it off pretty easily. But my, uh, co-founder, being a West Point graduate, was like, I bet there's one in our backyard. And, uh, so sure enough, there was. There's one that went through North Georgia called the General 100 and uh but it required 12 people to participate. So, we invited like some of our best clients to attend with us. But I had this bright idea. I was like, "Look, man, I want this to be nice. So, we're going to rent like a really nice RV. We love take showers between legs, you know, AC the whole time. It'll be

great." That's not how it turned out at all. Uh the RV, it turns out you need to know how to work one. uh number one. So it was also in Georgia October comes in all different shapes and sizes. It happened to be 95 degrees that October, so it was extremely hot. Um we couldn't the AC broke on the RV. We couldn't figure out how to work the showers. I literally had three of our biggest customers there. Like I thought they were going to fire us. I was like, you know, I was panic mode at that point. And uh it was miserable. Uh pretty miserable. I remember it being about 5:00 a.m. And in my head I was

calculating. I was like, we got like 12 hours of this left. Like we like I seriously thought about hitting the eject button, but then the sun came up and like we're having coffee and like you kind of realized that, you know, our spirits a little higher and then we uh I remember crossing the finish line and our biggest customer walked up and he was like, "Dude, let's do this again. Like the signup tables over here and I was like in the twilight zone about it." But the bottom line is we ended up making that an annual tradition. We don't always do 100 mile relay races. We're we're too big for that now. There's too much liability. You can put

that into the column of things you can only do when you're six people. But uh but we do an annual grid event. We just did one two weeks ago that was a four mile hike. Whole team did it. Uh and it's really become this um this hallmark of one of our core values which is grit. It's like that physical symbol of what we do. And I think it's really important to put values in action because over the last nine years, one of the things that I have found is that one of the most uh really the only lasting competitive advantage you have is the culture and the team that you build. And You hear business leaders say that all the time

and it's like yeah they're supposed to say that but after having built a business for the last decade you realize how much change happens every year like the products we deliver the how we go to market all that changes and the bigger that we get the one thing I can point back to is like this solid culture our recruiting engine the people that we have the people I have supporting me uh and that's been uh really really important um how we put that into action like we have these core values they're on the wall um one of the things is hiring so we hire by our core core values. We do this thing called GWC core

values. Um some of you may have heard of that. It stands for get it, want it, capacity to do it, and then our five core values. So there's eight criteria. We train the team to interview based on those criteria. So they're asking questions. We send a survey afterwards and they rank the candidate from zero to three across those eight criteria. And then uh you have to get at least a 16 to be considered for the job. So that's one of the ways that we kind of bake in core values from the start. um firing uh when we need to do that, which we usually wait too long to fire people. That's one of our weaknesses,

but it's often core values based. It's usually not because they're not technically uh sound. We bake it into performance reviews. So, we have like we do performance reviews twice a year, but one of the things that we uh have in the performance review is assessing oursel against core values. And then the manager also does it. And that's just a great opportunity for people to have a conversation about uh their alignment. Uh last thing I'll mention is just decision-m. So we do this training program as someone's becoming a manager called the journeyman program. It's a six-month uh training program where they do some self-reflection. They start to think about what kind of leader they want to be. We have two West Point grads

that I've mentioned. They kind of designed this program around some of their officer experience. Um and one of the things that we train them on is a decision-making model which includes like assessing things against core values. There's a whole like one pager that we have. So that's how we try to bake some of those values in. All right, if you do all that and you get to 10 million, we'll go to this last part, which is about how to scale a business. All right, so uh so this is kind of the stage I'm at. So still figuring this out, full transparency. Um couple things that I think that you need to think about uh when you're scaling the business. And

what I found so far is the number one thing, um that matters as you're scaling a business is trying to scale the people around you. I think one of the challenges as an entrepreneur especially if you started from zero is this constant requirement to reinvent yourself. So I told you earlier that uh I was delivering work at one point there was four of us. Um so I needed to be excellent at delivering cyber security assessments and interfacing with customers. There was a point that I was sending invoices, sending hundreds of them. Uh and that's just what I needed to do. And over time I started I leveled myself up over and over again and took

on more important roles. But I remember when we hired um Tim who is the this is one of our grid events. We did a Spartan race. Uh that's our COO and our our VP of people Jess. But Tim we hired as a consultant actually. He was uh transitioning out of the army had an MBA was working at a really big company for some reason decided to come work with us. And uh one of the first things he did was like take an inventory of all the business processes. And uh he wanted to create a racy which at the time I was like dude that is the most army administrative thing I've ever heard. You want to create a racy I want you to

go do billable work. Uh but he he did this and then he like basically said man these are all the seats that you fill like put my name in there. And uh the implicit task of an entrepreneur is when you stop doing something you need to go do something more important. So that's a little bit scary, but I remember uh when he took over invoices and I was like, man, cash flow is so important. If we start missing on invoices, that's going to impact the business. And then he automated it and did it about 10 times better than me. Um so that gave me a lot of confidence to delegate uh more. Um one interesting thing about our

particular leadership team is if you go across the operational functions inside of our business, almost all of them did a tour of duty in delivery. So, our customer success person was in delivery for about five years. Tim and Jess did delivery for a year. Um, our CTO did delivery for a year. Um, I was in delivery for a while. So, just across the business, our product, our head of product, uh, was in delivery for six years. He was a service line leader in delivery before he became our head of product. So, just there's something about that like this internal training, the context they have. uh we have hired outside talent before successfully but my experience uh I don't know if it's

everyone's experience but my experience is there's something good about doing that internally if you can so definitely scale your leadership team very important at the scale phase uh the other thing uh that is uh important is systems and processes um so at risk 360 every five years we take a sbatical um after five years you get a month after 10 years you get two months 15 years three months so on and so forth. So, I'm actually taking a two-month sbatical uh this coming year, which will be exciting, but I've already taken my uh my month-long sobatical, and I remember heading into that wondering if it was going to be possible, if I was going to

get no phone calls. So, we spent a lot of time uh doing like first man up drills, building continuity plans, building out processes. It was like this forcing function for me to be able to do that. And I didn't get a phone call. It was it was wonderful. Uh we went to Yellowstone with my kids uh for a couple weeks, then we uh drove across the country. It was pretty amazing. Um I don't think we would have been able to do it without a leadership team in place and without those systems and processes. Um so I wanted a way to talk about those. So I'll expose you to this term. We call it a management operating

system. I wrote a book for security leaders about it afterwards, but we as purpose values roles rhythms goals. So when we onboard people, we tell them about this operating system. So purpose is how we define the vision of our company. Values is our core values. How we fire, how we do performance reviews. Roles is the racy I hated but now makes a lot of sense. We tell people about the org chart. Rhythms is we do a weekly tactical at 10:36 a.m. We do quarterly on sites. We do an annual on-site all the rhythms that we have. And then goals is how we nest, you know, that mission all the way down to individual goals. So

it's really cool to see our whole team kind of understand and use that common language about how we run the business. Um um I think there is also this phenomena that um I think founders it's hard for your team to rise above the level that you are and the way that often manifests itself is uh at least for me is that I'll find myself white whitefisting like not letting go of functions that I think I can only do when I have people around me that want to get into those functions there's opportunities that they want. Um, I think there's also this this idea of limiting beliefs. So, when we first wrote our B hag year one, I think I said

we wanted to get to 10 million in 10 years. And like a lot of my team members laughed about that and we ended up doing it like six years. So, like there's this however you think your team is going to reflect that thinking model. So, if you think big, they will think big. If you give them opportunities and you believe in them, they will do the same thing. So that's probably less important early in the journey, but as you start to scale your business, you really have to think about how you're going to level up yourself. And some of the things that have worked for me so far is I joined a CEO group um been part of that for a

couple years and I've I've actually fired CEO groups and joined new ones because I felt like I wasn't getting what I needed out of them. But like kind of auditing your inner circle and being around people who are a step or two ahead of you and will challenge some of your beliefs. Maybe you're thinking too small. maybe they have more experience than you. I have found to be uh really really valuable. Another thing that uh I do is I do um a very formal goal setting for myself. So I use this five Fs model. I have no idea where I didn't invent this but I don't know where I stole it. It's uh faith, family, fitness, finance,

fun. And I organize all of my goals into that every year. So for example, how do I want to spend time with my family? What are my financial goals? How do I want to have some fun? It helps me keep in balance. and I I audit those regularly. But there's something powerful about actively writing that down and holding yourself accountable to it. A lot of people just kind of go goalless, but I found that that's uh very effective. Uh another thing that I was exposed to, um there's a financial adviser, he wrote a book called Simple Numbers 2.0. His name is Greg Crabtree. So we've started calling it the Crabtree Protocol, and it's a way to derisk

yourself as a founder. So what he says is pay off your primary residence and then put two $2.5 million in the bank. And he said and he acknowledges that that is a very um some people consider that that's probably a big number to a lot of people but to other people they'd be like that feels very conservative. Why would I ever pay off my house? I'd just invest it back in the business. But what he says is that basically derrisks you as a founder once you have that like you can go take all the risks you want and you're good to go. So in the back of my head I've always been like should I

pay off my house? maybe I should because it would unlock me to like go do crazy things for the business without risk. So, if you're a founder and you're lucky enough to be able to do that, I thought that was good advice. The other uh thing that someone told me once was calculate your hourly rate and then if you're trying to do tasks that are below that hourly rate, you should delegate them. So, for example, I could probably get like a personal assistant to send invoices for, you know, 20 bucks an hour. Should I be doing 20 dollar an hour work? Probably not. Um, more recently I delegated the product management function. So I felt for a

long time that like as a CEO like I needed my have my ear to the ground. I was the best equipped to think about product uh product market fit, who we're serving. So I've kept I kept a hold of that for a really long time. But we have this other emerging leader who's three times better than that at me. So now I'm trying to get him in that seat and the question is what do I do? If I'm not thinking about product, what does the CEO do? And that's part of that reinventing yourself uh process as you scale that you need to think through. Uh I'm acknowledging those are high class problems like once you're at that level

like those are good problems to have and in the spectrum of bad and good problems. Um last thing u how should a CEO spend their time at this level? Uh that's a tricky question. Um, it's hard to know how you should spend your time because there's many many way it's it's almost more important to say no to things than to say yes to things as as you get higher and higher in the CEO level. And I read this article uh by Y Combinator that I thought was really good and it gave me a I wanted to share with you because I had never seen this model before and they call it the phase two CEO. So after

you've kind of scaled the business, you have critical mass, what should you be doing then? And they chalk it up to kind of four things. Um, number one is setting a clear vision. And to set a good, achievable, ambitious vision, uh, the bigger you get is really hard. Um, I don't know if if any of you are employees, what is your company's vision? You know, what what profit what revenue do they want to get to in five years? Like you might not know. If you go to Risk 360 and you ask any of our employees, they are intimately familiar with our B hag and our vision. So that takes an incredible amount of communication uh, especially as you get

bigger and bigger. So I spend a lot of time making sure that they understand the vision and that our whole company is aligned to that vision. Um the second thing is leadership team like that vision being executed starts with the leadership team. So there's this thing called uh first team thinking. So if you think about who's your first team a lot of times as an executive you might think about your direct reports. So if you're in a security team you maybe you're thinking about your director of security and all the people that report to them. As an executive, your first team are your peers, the CFO, the CEO. If you're the CEO, it's your executive team, your

ELT. So, building that ELT is basically the number one thing that I can do as a CEO is finding people who are going to help get the organization to the next level. And that takes an incredible amount of time and thinking because you have to do things like planning compensation models, putting incentive plans together, finding those people and convincing them to come work with you. Uh so that takes a lot of time. uh getting mission and metrics right. So you have this big picture vision and you want that to trickle all the way down to the bottom of the organization. So what that looks like for us is okay, I have this behag. Well, what's the KPI for the

product team? What's the KPI for the delivery team? What's the KPI for um for CFO in the finance team? And so thinking through that that whole symphony that you're trying to create and holding them accountable takes a takes a lot of time. And of course reinforcing culture. So like I think leaders set the tone. I'm in the office as much as I can be. I try to live by all these values. Um, and that takes a lot of time. Just giving people your time is sometimes the best way that you can spend it. Um, so that's a little bit about the good business. I'm going to leave you guys uh with a story. We have a book coming out in

July. Uh, one of the best ways to reflect is in my mind just writing. I'm I write all the time. So, I decided to kind of put a book out about this. But, I'll tell you guys a story. Um, there's this preacher in North Georgia, my neck of the woods, and he tells the story. He swears it's true. Obviously not, but I love the story. And he tells a story about this greyhound who just quits running. And he's like, he's talking to the greyhound. He's like, "Man, I bet you were abused, weren't you?" And the greyhound's like, "No, my owner treated me great." And he's like, "Oh man, I bet he was working you. Working you like a

dog, right? You're a dog." He's like, "No, I I ran races, did some training, felt pretty good." He's like, "Oh man, you're skinny. I bet he was underfeeding you. Food must have been terrible." He's like, "No, food was great." He said, ' Then why'd you quit? And the greyhound says, 'I found out the rabbit wasn't real. And like for me, when you're starting a business, when you're doing something important, just be very careful not to chase those fake rabbits. Like, so that's my encouragement to you guys to build the good business. And I appreciate you. [applause] >> I'll take questions if you guys have them. >> Yes. >> Yes, cameraman.

You're kind of the first person to talk about scaling, you know, you do that together. Are you worried that

>> Yeah. >> Yeah. I mean, we have uh about half our team is in Atlanta. the other half's all over the place, you know, coast to coast. So that's one of the reasons that we fly everybody in every quarter is just to like, you know, try to drum up that company culture. We do a lot of other stuff outside of that. Um, so every quarter, I think, for example, I'm like, man, this pretty expensive. Are we going to keep flying everybody in every quarter and we'll kind of think maybe we skip a quarter and then we do it and everybody's so fired up and energized and happy to see each other and we're like, okay, I guess

we're doing another quarter. Um, I also think about like like why do I even want to grow this business sometimes and like we've had like VC after VC like we profile so well for a company that could go on the funded route and I have I don't have anything against funding but the one thing about funding is that the implied task of taking funding is that I've accepted a new business partner and I need to take that business partner's needs into consideration. And I need to take that very seriously. And their needs is to scale and exit. That's what the commitment is. So I always ask myself, do I am I ready to scale and

exit? And you have to become pretty shrewd to do that. And and like maybe you have to fire people, maybe you have to work people harder, maybe I can't do some of the benefits. I've fired big clients before. So what do I have to say no to to scale the company like that? Um, so I think about that kind of stuff all the time in terms of what company we're trying to build, how do we spend money, how fast do we grow versus choosing not to grow. And for the last nine years, we've just chose to try to build this kind of business. Right, wrong, or indifferent. >> Yeah.

>> Uh, is delegating the most difficult part? I think it is a difficult problem. Um, so my leadership style is uh for right or wrong, I I value being in the trenches. I value like not that I want to be doing the work, but like I'm not too good to do any job. I will I will mop the floors, whatever. And I think that kind of leadership is good to a point. Like people appreciate that. But there's also a point where I've literally gotten feedback from some of my members of team. They're like, I don't want the CEO doing that. like I want to keep you at this special place so you can represent the company. Um so

like that's been a struggle for me like when do I delegate and and and why do I delegate and then once I trust somebody I can do that pretty effectively. Um the other thing is as an entrepreneur whenever you delegate um if you're delegating a function you're typically trading profits for time. So you need to do that in a in a very intellectual way. So what's the return on investment of creating that function? A good example for us was we created a product function. That's not a delivery function. It's a it's a management labor function. Takes profit to fund it, but we really needed to do the intense research to figure out the needs of our

customers as we were building this product. We could do that effectively. So I had to take profit off the table to create that function. So that was a little scary when you do that and you have to do that all the time.

I don't know. Uh we're going to get to 35 million by 2027. That's our B hag. So like I'm extremely focused on that and we set a profit floor of about 20%. Uh to get there. So like I'm extremely focused on helping our company accomplish that. So beyond that, I don't know. We'll probably we'll reset the B hag and and do something that feels right. But uh that's where we're focused right now. Laser focus. >> Yes.

learn.

I have a buddy traditional way, you know. invest. >> Yeah.

>> York

friends Yeah. So, I guess the question is like you're trying I'm repeating it back for the for the cameras. You're you're just struggling with like VC not VC. What are my options? You've heard it be called vulture capital. There's like this bad connotation of it. What should how should you be thinking about some of that stuff? I need

to get a good sales. >> That is a conundrum that people find themselves in often. And what I will say is venture capital is not inherently evil or anything like that, but there are requirements like to build and scale. And if you come to that pre-revenue or in dire straits, you just need to be they have all the cards. So, you're going to give up a whole lot of equity in control to be able to get that venture capital money. And when you have zero dollars and you just need a paycheck, maybe that doesn't seem like a big risk. But then when your business is 10 million and worth a hundred million and you realize that they're calling all

the shots, feels a lot different. So, it's kind of like pick your poison. And the poison that I recommend is taking a vow of poverty early. Um, and then proving out your product market fit, get some revenue. That way you approach venture capital from a position of strength if you need to. Um, I think that I think bootstrapping requires a certain level of discipline. And that discipline is prove to me that you do have product market fit. Go get some paying customers. And if you can't get paying customers, you don't have product market fit. You have a good idea. And if you can prove it so good that you can pay yourself, well, now you're in a position of power.

Now you can negotiate and if you can't sell it, why would a VC fund you? So there's a certain amount of like just sanity built into trying to pay yourself if that makes sense. And there's very little downside into trying to get that revenue. I know you kind of maybe have to invest to build the product and things like that. There's some business models that don't accommodate for that. I think I'm at time. I am at time. If y'all want if y'all have more questions, I'd welcome to answer them. I'll stand over to the side, but got to get out of this room. Thank you. All >> [applause] >> right.