Menu
Varun Badhwar, founder and CEO of Redlock, a cybersecurity startup that recently had a successful exit. Varun has had a long history in cybersecurity in building companies from the ground up. He’s currently the SVP GM at Palo Alto Networks. If there was a 40 under 40 list in cybersecurity, Varun would be on it.
(This is summarized sections of the conversation with Varun on our pod. You can hear the podcast here)
1:28 Find something you have a passion for: Varun accidentally came across cybersecurity but once he knew that he liked the space, he deliberately pursued getting into it.
03:06 Follow your passion: Varun had an option to join one of the big 4 consulting firms but chose KPMG because they had cybersecurity consulting practice which got him closer to the field he was passionate about.
6:27 Take risks: Varun left the cushy job of KPMG and joined Salesforce because he got an option to get deeper the cybersecurity domain that he had always wished for.`the funny thing is starting from my KPMG days, the safe route was just never for me`
6:58 Be restless: Keep looking for ways to reinvent yourself till you don’t have the answers. Varun could have stayed at Salesforce and moved up the ladder but he knew he needed to learn more and way faster.
11:08 Founder Market fit: Varun used his practitioner experience to zero into the problem that needed to be solved in the evolving cloud security space. It’s critical to have domain expertise while thinking about starting a company as you know the pain points of your future buyers intimately.
12:59, 18:12 Importance of culture to a company’s success: People make the company’s culture so having the right DNA of initials hires in the company is key. It makes a whole lot of difference so hire the right people for your company and don’t make any sacrifices there. invest in your team financially and culturally. `when people are putting this skin in the game, honestly, that, that extra mile that you go to continuously make sure that if the company is successful, they’re made whole, uh, was also an important thing.`
Hire for key competencies with an eye on people leading skills because first key hires need to go deep and wide as the company grows.
Varun suggests following a rule of two for roles where a mistake can cost you runway speed. `I have a rule that I call a rule of two in sales because the place where you can go wrong and it’s most costly is selling. If you get a wrong hire and sales, I believe you lose at least nine months. If you’re lucky more like 15 to 18 months, if you’re unlucky.`
14:40 Solving the right problem at the right time is key: He talks of the vitamin and painkiller analogy we always hear about. It’s important to solve a problem that exists today. Today’s vitamin can be tomorrow’s painkiller but companies have a real budget for current pain killers – not future painkillers.
16:37 Channel as starting sales motion: Channel is your best friend as a founder when you’re starting as a young company. Its the fastest and cheapest way to scale in enterprise selling motion. Varun also dives into bottoms up vs top down approaches of going to market and pros and cons of each.
25:52: On founders being hands-on: The founding team has to be intimately involved in the first 8-10 customer sales to know that the product is working and the messaging is working.
29:10: Special sauce in customer reach: Founder need to think about is how would you get an unjustifiably favourable position in promoting and building interest for your product in a space where it’s extremely hard to differentiate
34:24: On Exits: While there is no clear answer, there are two paths. a technology multiplier exit esp in a whitespace situation or a revenue multiplier exit. Former is infinitely valuable because as startup scales, risk factors on execution side go up exponentially. And last but not the least, it is critical to have an understanding of the future of the product growth path in the parent company post-acquisition.
39:50 Persistence is key to a successful startup journey: There is usually more low and flat points than the high points in the startup journey. Everything that looks very glamorous from outside is not always so. Understand the highs and the lows because the persistence is going to keep you going during the low points
44:07 On Women founders: According to Varun, women are natural entrepreneurs because persistence and resilience come naturally to women. His advice is to get out there and take the risk. `The industry needs you, the industry wants you `
Listen to the episode on Apple Podcasts, Spotify, Google Podcasts, or on your favourite podcast platform.
Detailed transcript :
Ankur: Hello everyone. Welcome to the prodcast where you learn everything there is to learn about building great tech products and companies. This is Ankur and Neelima.
In today’s show, we have with us Varun Badhwar, Founder and CEO of RedLock, a cybersecurity startup that recently had a successful exit. Varun has had a long history in cybersecurity and building great companies and products from ground up. He’s currently the SVP and GM at Palo Alto Networks. (Music)
If there was a 40 under 40 list in cybersecurity, Varun would be on it. If you’re an entrepreneur interested in learning about building great companies, have a successful exit and eventually see a big payday, you don’t want to miss this episode.
Ankur: Hey Varun, it’s good to have you.
Varun: Thanks for having me Ankur and Neelima.
Ankur: Before we get started, I have to ask you is it easier to run a startup or being locked down with two newborns for the last six months?
Varun: (Laughs) They both have their pros and cons and I think I have seen the best of both worlds now. So, just blessed to have been through the journey and now looking forward to a lot more fun with both building companies and seeing babies grow up.
Ankur: Awesome, I can totally appreciate that. As someone who has had a few years on you in that department, I can tell you that it does get worse before it gets worse (Laughs).
Just to kick things off Varun, you’ve had an interesting background and for the future entrepreneurs out there, people have a perception that entrepreneurs and CEOs are these two-headed monsters like college dropouts or those who have done some amazing things in the past and had aha moment, a Eureka moment rather.
You had a consulting background then got into security and then obviously started your own company. So for somebody who wants to start a new venture can you take them through your journey. How did the whole idea come about? How did the events leading up to that idea come about?
Just take the listeners to that journey.
Journey into cloud security and being an entrepreneur
Varun: Yeah. Unlike many entrepreneurs, I actually didn’t have a light bulb for entrepreneurship go up in my second, third or fourth year. So I actually finished my undergrad in computer science down at USC in LA but I was having a panic moment in the last year because while I enjoyed and appreciated taking computer science programming classes, it just wasn’t for me. Sitting inside and coding away just wasn’t for me. I loved being on the outside, the outward-facing side of businesses and technology. So I had to pick up on that panic -What am I going to do when I graduate?
I interviewed at Cisco’s and others but my heart just wasn’t there. Then I stumbled upon an elective course that USC had just started for the first semester ever in Ethical Hacking and I did that and I just loved it. The fact that you could break into people’s environment and not go to jail was pretty amazing. But the next challenge I had was nobody back then hired undergrads out of their programs to become cybersecurity specialists or analysts or consultants. Typically, the journey to cybersecurity was from IT or systems engineering. I had to hustle my way through a little bit. I went for interviews with the Big Four really in their typical IT advisory services. But then when I had an offer from KPMG and Deloitte, I played them against each other to say- Hey, but I need to be in cybersecurity. So who’s going to let me in. One thing led to another, I joined KPMG and was doing consulting there with the kind of fortune 500 around cyber security, statuary work. And other things. Salesforce happened to be one of my clients. So a long story short, hopped onto Salesforce. There were still only about 1500 people in the company, so the security team was four people compared to many hundreds today and therein began my journey into the cloud.
I’m sure we’re going to talk more about that but that’s how I stumbled into cloud security.
Ankur: Yeah. Pretty interesting journey. As I was listening to you and the listeners out there- people are always curious about even starting with childhood, did it ever occur to you – childhood, college that I was born to be an entrepreneur, run my own company. Are entrepreneurs and CEOs born that way or eventually you learn along the way- what’s your take on it? Did you always have the bug that I’m not going to work for anybody? I gotta have my own company.
Varun: It’s a good question. I don’t think they’re born a certain way or cut from the same cloth. It’s funny, my mom is visiting from India and just last week she was telling my wife this story that she knew I’d be a businessman as she calls it from the onset because when I was 10 years old and their friends would come over for dinners, I would help my mom serve them. At the end of the night, I would give a bill and say, here’s my service charge for helping you and then as I grew into being a teenager I used to buy and sell bicycles and kept doing something or the other always like very business-minded. So, I guess one could say I had that knack where the business side and deal-making were things that I enjoyed doing but look you have people like me, you have others that learnt how to code at six years of age and did that and became successful entrepreneurs.
So I think entrepreneurship is a fair game for anybody who has a knack for it and really it’s just, the passion is important but the persistence is critical. You’re going to see so many failures before you see success as an entrepreneur, as a founder, as a startup guy/ gal that if you just are persistent and you have the thick skin to go through that without giving up, I think anybody can be successful.
Ankur: And speaking of failures, so here you are at Salesforce, at the top of your game, early stages of career and you could have chosen a path where the bulk of the folks who are in technology choose, right? Salesforce was a safe bet. You had a couple of choices- take the safe bet or go and work for an early-stage startup.
If it worked out great but if it didn’t then you would have had the peak of your career just completely gone waste. When you were thinking about jumping into an early-stage startup or finding your own, did it ever cross your mind that what if this game completely goes south and I’ve lost the prime of my career. And how did you overcome that sort of a mindset?
Varun: Yeah. So the funny thing is starting from my KPMG days, the safe route was just never for me. In my first ratings, in the performance cycle, I was given an ☺exceptional rating. I was told I’d be a partner in 10 years. They were trying to really entice me to say, 10 years you’d be a partner. They said, look, you’ll be one of the youngest partners in the company. And I said, 10 years, are you crazy? Do you want me to wait that long just in this structured path? Why can’t I do it in five or seven and they didn’t have a good answer and fast forward into Salesforce, four years into it, great company, we’d gone from 1,500 people to 6,000.
I got that itch again. Look there’s structure here. You can make your way up the ranks and you’ll be very successful financially and through career but I didn’t have clear answers on what I wanted to do. So I took the kind of optionality route. I took my GMATs and I applied to the top five business schools.
I got into Kellogg and therein began the crossroads and what I had to weigh was my options to go down that path for two years or the opportunity cost where I stumbled upon this opportunity to be part of the founding team of what ended up as being a fantastic journey, full of a lot of learnings.
I was chosen to be part of the founding team of CipherCloud and I chose that route. Hands down, I think that was probably the best decision I made. It gave me the real-world business school plus without having 150 grand in debt. I’ve just never been the one to take a safe route and the risks really early in my career were completely acceptable to me. But, look, I don’t think age is a function. Again it is the grit. It’s passion. And if you have the thick skin to go through it and the downside, you understand very well, it’s worth the chance.
Ankur: Yeah. Speaking of taking safe bets and going to a business school as somebody who has been there done that. Had I not chosen that path, I’d be the one giving interviews and not podcasting So you, my friend have made the right call in doing what u did.
So, you start your journey with an early stage company before you actually start your own company. What drew you into the security industry? You talked a little bit about it, in college you took a few courses but what makes the security industry so unique and so compelling for a lot of entrepreneurs? Why? Were you passionate about solving hard security problems or did you see that as an opportunity, as an entrepreneur, a businessman would see?
Varun: I think back then it was just a geeky cool thing coming out of college. I can tell my friends I break into people’s applications and I do it, or I’m licensed to do it, I’m paid to do it. So I wouldn’t say that there was a grand plan getting out of college, graduating and deciding to go into cybersecurity. But I will say the plan started formulating once I was in KPMG and I started seeing just how many people were interested in getting in security but the opportunities were limited back then.
And from there as I went into SalesForce.com and you really just see this transformation happening in the software industry or no software as Marc Benioff would say, it’s fascinating. It was fascinating that on the defence side as a security practitioner, you’ve got to defend against EVERY single kind of potential adversary out there and for the adversaries, it just takes one. It takes one loophole, one entryway for them to get into your application and it felt a little bit like a video game. It’s literally like virtual reality, but true reality here. It is just getting that adrenaline, the frame of getting the challenge and the high of doing something like that.
I would say today though from there as you look at pivoting my career by design into cloud security. I think it was very evident that in 2006 when I was in SalesForce, people still didn’t take cloud seriously. Most people really thought of cloud as being something that was there for non-critical assets, non-critical applications and more of a consumeresque kind of way of life. And I think the bet I made was that this was absolutely going to become front and center for every enterprise, startup, company- big or small. And if you look today, it has changed the way of life. It has changed the industries, it has transformed industries. We have seen companies get antiquated when they haven’t gone on the cloud bandwagon. And so I think it was that intersection of cloud and security, which quite frankly, I had the early insight into just because I was at Salesforce.
I’m very grateful for that opportunity because it gave me the early leap into making the bigger bets I made in cybersecurity, specifically in the cloud.
Neelima: Varun, talking about the practitioner side of things. You’re one of those rare founders who’ve been on both sides. How has that changed your founder journey – first being on the practitioner side and then building for the protection side of things?
Founder Market Fit
Varun: Yeah. That’s an important point and this is where I might say something controversial but I’m a strong believer in founder market fit.
People talk about product market fit a lot and I have seen so many people that perhaps have nothing to do in cybersecurity, have never been in cyber security but because they’re hearing so much about it, they think it’s such a cool place. They think there’s a lot of money to be made. They want to jump in and attempt to build companies or attempt to do something in cybersecurity. A lot of times the conversation with me is- “Hey, I think cybersecurity is cool” , “what company can I start in this space?”. And, I look and I fuss and frown a little bit because I truly believe that in order to understand the practitioner’s pain, the kinds of conversation they’re having with their management, their board, you really need to have been through that journey and I think that’s why founder kinda market insights are an experience and background is probably way more important than anything else in building a successful company in security. I think having been through that journey, understanding firsthand the pain points, not the second or third hand,having relationships in many ways with potential/ future buyers, design partners and other things,really helps fast track you to success. So I’m a big believer in having that type of background and DNA.
Ankur Yeah and it makes perfect sense. You are able to really have empathy for the people you’re going to sell into and one of the best ways to do that is just by being there. It certainly gives you a lot of perspective.
Varun, You started your journey then you were a co-founder at another fairly successful startup and then started your own company as a founder and CEO. Obviously, there had to have been some lessons learned as you started the company. Were there some core principles or philosophy on people/ product that you carried over from the previous startup.?
Learnings applied to RedLock
Varun: Yeah absolutely. There are many things that went well in the prior company. There were some things that were, you learn from failures and I think the best experiences and learnings come from failures, that’s it.
Coming to RedLock, there are a few things I really focused on
I think one was just the culture from the onset of the types of people you want to hire.
The level of transparency you want to have.
As a startup there’s so much uncertainty, people are leaving great, comfortable paychecks/ roles in companies and believing in YOU. You the founders of the company. You owe it back to these people, these employees to really have radical transparency in the company.
So at RedLock, for example, everything from our entire board materials and packages to our financial monthly burns or cap table, equity structure, things like that were completely visible to employees. So I think that was something that’s been very important and near and dear to my heart. The other thing is really about investing in the team.
I think what I did find is and I used to have conversations with investors that would feel and maybe not every employee feels that way, but I felt like the equity upside that we were offering to early employees and team members was actually fairly generous in the company, compared to other startups. And I think that was another area where I felt like when people are putting their skin in the game, honestly, that extra mile that you go to continuously make sure that if the company is successful, they’re made whole was also an important thing in making sure that you are able to attract, retain the best type of talent in the company.
From a Product Standpoint, the one thing I learned in enterprise, especially in cybersecurity, companies have dozens of companies/ startups lining up to sell into them. So what sets you apart?
One of the things you often hear from CSO selling security products is – come back in six months and we’ll set you up for doing a POC, a couple of quarters out. And my question was, how do you actually fast track that? So the important things we’re really gonna again the vitamin and painkiller analogy we always hear about, but in Security are you really solving a problem that exists today, that’s meaningful.
And for me, I think being in a white space was more important because trying to display security products is always harder in a market where customers may feel like -you know what I don’t have a perfect solution for that thing, the problem you’re trying to pitch me on but maybe I have something that’s good enough and if it’s good enough that’s not my priority was solved.
I’m really trying to solve or catch up on things that I have complete blind spots on and cloud security was one of those things, specifically, as people were starting to adopt AWS, Azure, GCP like platforms. CSo teams had no idea what applications were running there so that kind of was an important point of view.
The second piece was how can I go in and out of a meeting and within the 60 minutes be able to actually demonstrate value to the customer- the ease of use of the product, can it deploy within minutes, can I do it with no software, no agents, no proxies just really as easily as possible through API’s.
I was fairly confident with the product that once we gave you visibility, it would be very hard for you to say, no, I’m not interested in this, or no, this is not important for me. So the question was how do I just get that report in your hands where then it’s very hard for you to turn around and say, look, this is not important.
Again, I think those two things were supercritical from a product standpoint.
And I’d say the last thing is really on the sales side, building distribution is usually the hardest part.
If you look at many security companies, they may even get to a million dollars in sales, but getting from a million to 2 million to 5 to 10 to 20 is extremely hard and costly, which is why you see it’s very rare to see cybersecurity companies go past 5 or 10 million in revenue, right? You need to raise a 100 million dollars, 200 million dollars.
From the onset, I wanted to build a distribution model that’s scaled. It’s easy to say but we from day one said we were a hundred percent channel company which allowed us to say for even every one or two or three reps I incrementally added in my plan, the idea was that they could go find 5, 10, 20, 50 partners that could sell with us on our behalf alongside us and really get us access to customers.
And that’s a story for another time on how to make that successful and what expectations you walk in with but I think, it was well worth the extra percentage points you gave to your channel partners to have that scale and distribution and that scale becomes more and more important as you have bigger numbers to meet.
Importance of culture to a company’s success
Ankur: A lot to unpack there and taking us through the culture, the team aspects, the product aspects and sales and we’re going to double click on some of these areas because you brought up some really critical points and I want to make sure that we can expound on that.
On the culture piece itself, it’s top of mind, Reed Hastings just came out with this book No Rules and Horowitz wrote just another book on culture.
Now, if somebody is trying to start a company which is 10, 20, 50 people, how important is the culture? Is the culture really just to get shit done, have a little bit of transparency. Or this glorious notion of a very predefined culture is more of a big company thing- once you get to a thousand employees and you got to start having more and more things.? Anything beyond transparency that stood out for you? Not just at the onset of the company but throughout the journey that really worked and paid dividends in the long term.
Varun: Yeah, the thing is like we talked about entrepreneurship has a lot of ups and downs and having certain founding principles, guiding principles for the company, for the employees, for your customers is important because you’re going to have a lot of tough decisions to make. Those decisions could be things like let’s say you have five customers today and you have 20 more you want to get. Who do you focus on if your five customers want a feature and it’s important to them and their success? Do you prioritize that or you prioritize what’s going to get you the next year five customers, where you know that your existing customers might be unhappy. That’s an aspect of culture, you have to decide. What’s your founding principles? Are you customer obsessed? Do your existing customers matter enough that you will prioritize them because they will provide you with the foundation and reference that you will need to get 500 more customers.
Similarly, diversity of your talent- because let’s say, I came in from CipherCloud. If every single employee of mine was from CipherCloud- the first 10, then we’re all going to think like CipherCloud. So for us making sure we have the right mix of highly experienced folks to folks that were new graduates out of college to folks that came from security companies all the way to folks that came from consumer companies- having the right mix of skill sets is important because you’ve heard this before but the kind of people you have, the first few employees will then be the ones that are going to be interviewing the next set of employees and the next set of employees. And if everybody looks the same and feels the same and has the same background your whole company is gonna look like that soon.
So I think those are just examples of why even early on, it’s important to have -forget what you call culture, vision, values or what I just call it, what are your guiding principles as a company and what’s important to you? How are you going to make decisions as a company? Transparency is one of those, customer obsession was another one, employee productivity, employee experience was an important one.
So you have to decide with the limited funds that you have, the limited time you have, the limited development/ horsepower you have, what do you focus on? And I think those guiding principles become really critical, even if you’re a five person startup.
Ankur: Yep, one of the things that a lot of the founders, a lot of listeners struggle with is that in the first battle Royale in the journey is to get to that critical adoption, call it, millionaire or whatever that may be, like what does the first 20-30 employee mix look like?
So I’d imagine that the first, 10- 20 people are product engineering hires, you get the product down. Do you then start hiring marketing and sales at the same time? How many sales reps do you hire? Do you hire it in one region or multiple regions? Any lights you can share in that area specifically would help a lot of people through that journey.
Varun Yeah. I think we could probably spend 45 minutes just on that topic itself. The few tidbits I’ll share is it really starts with you, the founder. Can you do an objective assessment of your skills and your relevance to the company? Like where do you ultimately think you have relevant experience and you’re confident of that and where do you think that you need help?
A lot of founders tend to be very technical and so for those types of founders, I’ll say, look, make sure that yes, of course, you’ve got to go build product first but soon enough you’ve got to figure out who’s going to bring some of the business acumen into the company, the customer centricity into the company.
If you’re a salesperson starting a company and you have no idea of technology, I’d say, yeah your first key hires, your first key leaders have to be just highly talented- not just engineers but probably an engineering leader very quickly as well. So I think there’s no real recipe, it’s a rinse and repeat on the first key hires. But generally, if you look at most companies, of course, you need a product first before you decide who you can sell it to or how you message it, so you’ve got to have the product.
As it relates to marketing, my strong opinion is you don’t need demand gen initially, you need a product marketeer especially because for technical founders it’s very easy to get into the weeds but trying to understand and having customer empathy of how you take a message that resonates to a large set of customers that quite frankly don’t know you, don’t trust you and couldn’t care less about you. How do you get 30 seconds of their time is super critical. So in the marketing segment, I’d say product marketing usually trumps demand gen first because you need a message to then have and create demand around
And I think as it relates to sales too, it really depends on the founders. If the founders are highly technical, a lot of times, it’s probably a good idea to hire a sales leader first.
In my case, I felt fairly confident that I could lead a sales team up to $10 million of business. Like I think that was my introspection. And so for me, the initial importance was to get real carrying the bag type of sellers. But frankly, in any startup, you have no idea what DNA you need, what background you need. Do I need somebody from a Symantec or do I need somebody from a Cisco or Dan or do I need somebody from a Dropbox?. It just varies and it’s hard to tell till you’ve experienced it.
And so I have a rule that I call a rule of two in sales because the place where you can go wrong and it’s most costly is selling. If you get a wrong hire in sales I believe you lose at least nine months if you’re lucky and more like 15 to 18 months, if you’re unlucky.
And so the problem in trying to hire one seller is the seller could convince you that if they’re not able to get customers, it’s a product issue or it’s a messaging issue or marketing issue. Sellers by nature are very good at selling and part of that is selling themselves and representing themselves so to try to separate weed from the chaff is hard.
So my rule of two is to hire two sellers at a time initially as well. And that’s a big investment but two sellers with typically little bit different backgrounds for both, put them in slightly different regions and let them loose. And then you’ll have a sense because frankly for me as well, I had two, one was phenomenal out of the Gates, the other one struggled and both had the best DNA, the best referrals and recommendations you can imagine. But it just wasn’t for the person who wasn’t able to be successful and I wonder every time I look back and it gives me goosebumps to think if that was the only salesperson I had hired, they would have convinced me that I had a product-market fit problem. And so that is a costly mistake to avoid.
Founders being hands-on
Neelima: Varun, going back to you mentioned solving problems today but finding it invites space so that you’re not displacing existing products. So, I have two related questions.
One is, what is your advice for founders who are coming from non practitioner backgrounds? How do they find those white spaces?
And the second question is related to what you mentioned hiring salespeople who have never sold before in that white space. How do you enable sales guys to go and sell in that white space?
Varun: So before we get into this, I do want to caveat the thing I mentioned and said, look, white space is probably the easiest place to go create a company. Displacement and replacement generally means you have a larger upside opportunity but a higher bar to cross and typically a longer journey of the company to go through and as we talk about exits and things like that, I think you generally can generate richer multiples addressing a white space problem than a potential quick exit, like RedLock if you’re in a replacement-displacement type business because trying to prove that you really can do it at scale is much harder and more time consuming but we’ll come back to that.
I think, as it relates to your specific questions, I do believe that the founding team, if not the founders needs to have founder market fit. So, if you are a great entrepreneur and you know how to build companies, you know how to raise the money, you want to go solve the problem in encryption or key management but you have no idea about that background, I think it would be wise for you to go either get a founder like person or a founding engineer that has deep domain expertise. Not only will that give you credibility when you go fundraise but it truly will just give you enough conviction in the kind of domain that you’re operating in. So it’s okay if you’re a great founder, but then you’ve got to augment your skills and it goes back to the introspection and objectively analyzing your skills as a founder-CEO to say, what do I need around me? What kinds of people do I need around me to be successful? So that’s how you address the first one.
The second one is really good sellers. You will find it if you look at their career trajectory. They will be successful in different domains. They would have typically gone from one domain to the other and they would have had a track record of success.
I believe sales is as much an art as it is science. And usually for the early sellers the way I put it is the CEO typically or the CTO is the SE. As a founding team, you have to be the kind of person there. You can hire the best salespeople but to get your first 10 customers, you as the CEO / CTO have to be involved and have to be very intimately involved.
My role in initial 10 deals even when I had the sellers, I was the SE. I had to be there. I was their head of product, I was their SE, I was, of course a janitor, I was a lawyer like whatever you needed me to be in that conversation but that was my role to play.
And so I think in a white space, that’s usually how you tackle it. You’ve obviously got enough conviction. You understand what you’re building. You understand the competitive landscape, you understand the value proposition to the customer and the seller is really there helping you run the process, initial deals. They’re also learning from you, the founders. So that’s how you achieve it until the time that they’ve developed enough competency in the space.
But I really don’t believe that your sellers have to be from the same company, just to give you an example one of my best sellers at RedLock came from Box and before that came from another industry, never in cybersecurity. And to this date, he remains very successful. I had another one who had deep cybersecurity experience and he was just not successful.. So, it’s just the person more than the background.
How to Scale
Ankur: Really insightful stuff all around. And like you said, I think each of these topics can take hours and hours but as we are trying to distill all your learning over the years in one hour, so we’re going to try to pack as much as we possibly can.
Let’s just say fast forward you found the market fit, you’ve got the critical mass. You see the light at the end of the tunnel now. Now, it’s all about scaling and the question that sometimes people try and fail at is that they (28:35)go too crazy and are not able to grow out of that, the new hires.
What do you think about scaling? Is it like just hiring 10 X of everything, like 10 X more engineers, sales guys marketing or there are some areas you focus? How can you be cautious in a market where there’s just too much liquidity. VCs are just pouring money at you? What do you think about scale?
Varun: Yeah, so of course, as we talked about even with the distribution and channel model for me, it’s always about leverage. You need to find an unfair advantage in every which way you go. So development aside, look, engineering is a pretty simple game. What do you want to build? How fast you want to build it.
And based on that, you have to decide how many engineers you get. There’s really no leverage shortcuts there. Yes. open source components and libraries and all of that is there but it’s fairly simple. I think what really entrepreneurs need to think about is how do you get an unfair advantage in marketing and building demand? And how do you do that in reaching your customers and closing more transactions and deals?
So, let’s talk about the first one, the unfair advantage in marketing. Most startups are not known to customers and generally what we found is there are really two paths that people have taken to be successful – one is a Top Down and another is Bottom’s Up.
In the bottoms up cycle, if you really have the conviction that you can go organically, word of mouth, reaching developers or security practitioners through forums and get help and get projects and things like that, that’s one way into these organizations that scale which is you get the mind share. You provide customer and user delight. They love you so much that they’re out on Reddit forums talking you guys up and then there’s 50 other people around that, you build a community for these early kind of fans of yours and that community just grows and grows. This kind of a model has some componentry of open source or community edition or free offering around that. So, that’s one way to get unfair advantage and leverage in marketing and demand creation.
The other kind of ways and approach that we took was slightly different. We didn’t go the freemium or an open source route at RedLock but we went an unfair advantage route top-down.
We said, look, the biggest problem we have is customers don’t even understand the risks as they go to the cloud, so how do we go in front of them. We invested very early into security research and we said we would make our name through creating research reports for which we had a really very strong PR team getting in front of the companies. And you’d be amazed if you look and search Redlock, it was on BBC and CNN and CNBC talking about various different types of attack vectors. We were on a lot of Bay area local news channels. Almost every week, they would be at the RedLock office. Anytime there was a security incident, they’d be there newscasting us to give a commentary.
The name got out. The word got out. So, we were punching above our weight class by doing that. And that unfair advantage for us was research. But you have to figure out as an entrepreneur, what is your unfair advantage where you can get a 10 X leverage.
On the sales side again it’s the same problem. Again, like today, there are many avenues to do that. The traditional model used to be much more channel driven, distribution driven but people, oftentimes think that if they have got channel partners, they’ll sell for you. That’s not really true. The channel partners may provide you access but you still need to control your destiny and run your sales process, negotiate with customers, close deals.
Channel partners provide two interesting benefits.
access to the customer because they’re generally walking the hallways of these companies and they have a relationship with C level execs.
b) they can fast track your procurement process but everything in the middle, you have to run. That’s one kind of model.
There are now models which are much more pay as you go. If you go down the bottoms up model, you go through leverage of marketplaces and things like that are successful.
In cybersecurity, unfortunately, very few companies have been successful in building a low cost sales model which is much more inside sales, BDR, SDR type model. And I think if you can do it’s an amazing model but the chances of success are low because if you are selling top-down, the CSOs and others aren’t taking calls and taking cold emails, so that’s where the channel and distribution partner helps.
So I think, again align with your marketing strategy- how are you going to reach people. Align with your distribution model, be thoughtful if it should be Tops down or Bottoms up. And then you’ve got to build the right investment plan and model around it.
Ankur: Got it. Just to sum it up. On the engineering side, not a lot of shortcuts, not a lot of unfair advantages. Like you said, you have to just invest if you want scale and hire more people depending on your roadmap.
Insightful stuff on the marketing side which has a whole bunch of marketers doing a whole bunch of demand gen. Going to every possible show and spending a hundred thousand dollar a show , burn through all that money and may have nothing to show for but being smart about it.
And on the sales side, I think it’s a great example. I think there are companies like Rubrik that ran an inside game and were really successful but in a lot of other cases you are right.
I think there’s a lot of draw for channels but sometimes the best way is to pay top dollar and to get the top reps, basically to get that scale. So, you get to the product market fit, you get to the scale, you’re an up and up, the classic hockey stick growth. Now, as a founder and CEO, a few things happen. Obviously if you’re not doing very well, the exit path is straightforward. When you get an offer take it. But you’re on a hockey stick growth, somebody makes a shit offer, obviously say no but if somebody makes an amazing offer like hundred X revenue. It’s a no brainer. But most of the offers are right in the middle of the pack.
How do you decide when to exit or just keep chugging along and go IPO? Go for the jugular?
When to Exit
Varun: So, it’s a great question and no easy answer. I think it’s a very personal decision for the founders, the investors alongside them and frankly you’ve got to think about what’s right for your employees as well.
If you think about the model in cybersecurity at least, there’s really two segments that you can fall into. I actually don’t believe if you’re a shitty company, I don’t think you’re getting an offer unfortunately. So I think that’s where I disagree. I think you are going to go down the history book with that experience and then you’ll be looking for a job.
I think great companies as well have two paths. I think one is early on what I call the technology multiplier. Really at this point, you have your let’s call it your sub five million ARR business but you’re phenomenal, you’ve cracked the code on marketing and you’ve got your name out there. Customer delight is there, early deals are landing and expanding. So good early evidence but you haven’t proven how you have a path to a hundred million dollars. I think especially in a white space situation, I think you’re a great asset to traditional well-established public companies and you’ve got a fantastic technology multiple, you don’t really talk revenue multiple at that point.
The other segment, which is much harder is when you cross $10 million plus in my opinion, give or take there’s nothing hidden, no hard and fast rule, but $10 to $20 million plus now you’re working on a revenue multiple and it’s funny, the revenue multiples go down, the technology multiples are much higher. And as we just discussed distribution, sales and marketing are extremely expensive. So I’ll assume that to get to the $10 million to $20 million minimum bar to really get us the revenue multiple you’ve had to raise at least 60, $70 million or more and so founders are pretty diluted at this point. Majority of the companies are owned by VCs at that point.
You look at two companies, one raised a lot less, exited for half the price of another one that lived on for another five years and exited for 2 X the exit value but the early employees and the founders made out with less money than the first one.
And oh by the way, the other thing we haven’t talked about is that the risks exponentially increase as you’re trying to go from 1 to 5 million to the 10 plus million mark. Way more speed bumps along the way. Way more issues to resolve. So it’s not just dilution, it’s also a risk factor. So quite frankly, it’s a personal choice of that trade off. And I think quite frankly, it also matters who is extending the offer and what you believe the future is.
Personally. I think what was important is not just that I had a great offer in front of me without having to raise a lot of capital. I think the important thing was what will the future investment look like? What was going to be the structure post-acquisition? Were we going to have autonomy to be successful or will our company be torn apart into small chunks that are completely dissolved into a larger organization.
So, I think there’s a lot of things that matter. At the end of the day my investors left it up to me. They did not one way or the other try to influence me. They got 20, 30 X multiple, depending on what they invested. So it was great. They never once said take it or no. They said look, you, the employees and founders have worked the hardest. It’s going to be life changing for you and you determine what’s best. And I agree. I think that’s the way you have to look at it. What is your risk tolerance? What is your appetite? And quite frankly, can you achieve the outcomes you were hoping to achieve as an independent company, combined with a larger company where you’ve de-risked yourself. You’ve got more distribution, you’ve got more marketing, name, presence and such. So yeah, I wish I had a scientific answer for you, but I think it’s a combination of things.
Neelima: So, we talked about scale, we talked about hockey stick but the path there always has bumps as you mentioned. Can you talk about a scenario where things looked bleak, you started and then one week was amazing and then one quarter nothing moved maybe in RedLock or previous. And how did you turn it around? Because obviously in both scenarios it’s been very successful.
Varun: Every week is up and down in a Startup. If every week isn’t up and down then either you’re not pushing hard enough or setting high bars or you’re just really lucky.
I’ll give you my personal experience at Redlock. We had signed up three fortune 100 enterprise companies as our design partners. And, we worked with them. We solidified the product roadmap. We build against them. Every month we were meeting, validating requirements, you build it and you’re really excited because you think you have these three fortune companies in the bag and at the tail-end of that process one purchased and two didn’t. And, we kept getting the run around and kept getting the run around. They said that we don’t have the budget now or we think you are too expensive at this point. And quite frankly was heartbreaking because it’s just in a mental model, they’re in the bag, you’re already telling investors, the customers- look these are my logos, I’ve got them and you start questioning like, Hey, am I on the right track? Like where they just being nice to me this whole time? Did I really screw up somewhere? So, it’s a hard pill to swallow but at the same time your engineers were excited about it and the morale kind of is a little wishy washy of what’s happening. Why have they not given us the PO yet. Again, as an entrepreneur, like I said, you need thick skin and you need persistence, that’s the way you win.
So, you just move on. you’ve just got to move on. Like, what are your choices? Are you going to give up? You can’t, you’re just getting started. So, we just started calling everybody that my founder and I knew, many different companies. Reaching out to our Linkedin contacts, really becoming the sellers ourselves because there were eight engineers and us too. And we were the pseudo sellers and we built a pipeline and we put it in a free CRM tool and we had 25 other conversations and it was just pure persistence.
We really started getting good traction and the next week was back to being a high because people were reacting positively just when you thought that two thirds of your initial design partners were no longer willing to buy from you. So, persistence ultimately is the key in all of this.
Ankur: Fantastic. What would you do differently if you had to do it all over again
Varun: (laughs) That’s a tough question. The honest answer is nothing. I would do it the same way all over again. I call it good fortune, call it learnings from the past. I think us, as a whole organization, as a startup made few mistakes. The team was incredible. Everybody played their part to perfection and executed flawlessly. And, with every part of hard work, you need some good luck and timing. Those things hit for us as well. And so I hope and pray the next time I do it again. It just happens the same way magically.
Ankur: Yeah. I’ve always heard that founders are insatiable but seems like it could be the age, could be the kids, Varun, you may be in a reflective mood and are thankful for how things have been. Things have certainly turned out really well for you and RedLock and all the employees.
Varun: or I just have amnesia.
Ankur: (Laughs) Last question, before we get into the fun round, which is our rapid fire round. And that question is- if there’s an entrepreneur out there looking at the security or B2B space in general, what are some of the mega trends over the next 5 / 10 years do you recommend that people pursue?
Varun: I wish I could tell you what’s happening 5/ 10 years down the road. I could tell you what’s happening now and in the near term for sure where I think there’s still a lot of disruption to be had.
Ankur: Go for it.
Varun: I think there’s still a lot more in the cloud. I think there’s a lot more in the cloud in depth, different angles. There are a few things that are still changing. I think the first set of cloud technologies were really built around lift and shift for the cloud. Nowadays people are realizing that if you are going cloud, you have to go cloud native. And so more technologies that are related to this whole movement of DevOps, DevSecOps, automation, end to end, the whole rethinking of a SOC, right? The way you did incident management investigations. In a traditional SOC, you have hours, days, weeks to sometimes investigate and respond. These days you have seconds or minutes before things come and go again. And so I think this just needs a different level of thinking, specifically there.
The second thing is really around micro services, APIs, right? Everything is becoming a micro service. I think that the way we tackled application security in the past, I don’t see that being successful in the future because in application, there’s no mega application sitting out there that you could put a web application firewall in front of. So, you’ve got to think about ways to do this differently.
Identity, right? I think users’ identity previously, was always thought of as users. I think now, every machine, every device on your network has an identity, your light bulbs have an identity, printers have an identity. How do you authenticate them? How do you authorize them in this new world order? They’re probably some of the trends. And look, I’ve got to keep some mega trends in my back pocket too for the next time.
Ankur: (Laughs) Sounds like a plan. Neelima, do you have something for Varun before we get into the rapid fire?
Neelima: Yes. Final question. It’s my favorite question. I ask a lot of founders – any advice for female founders who might be wanting to start something in security? I know a lot of nuggets apply to all kinds of founders – risk taking, ability to take stress but anything on top of your mind which you think might be different and something to keep in their back pocket.
On women founders
Varun: All I can say is the industry needs you, the industry wants you and we’re all here to support you in all seriousness. What I will also say is I’ve talked about thick skin, I’ve talked about persistence, perseverance. I think as you started off this conversation with two- four month old kids at home and looking at my wife and just the amount of resilience she has just going through this whole journey. Salute to the women and just the amount of persistence. I think they are natural entrepreneurs. I think the founder traits you need to be successful, you have it. And you’ve just gotta get out there now and take the risk and take a shot at it. And, you will be surprised to see that I strongly believe the success rates for female entrepreneurs will be higher because of the DNA that I just described and that they’re born with.
Neelima: Awesome
Ankur: First question- in favor of /or against the Tik-Tok ban
Varun: Against it
Ankur: And why?
Varun: Hey, that’s not part of rapid fire. (Laughs). It’s a free economy. Let the users decide what they want to do with their data and who they care about. I don’t think you need the government and honestly, if you’re going down that path, you’ve got to look at a lot of other things besides Tik Tok.
Ankur: Great answer. Privacy issues get worse before they get better or it’ll be on a downward spiral for the foreseeable future.
Varun: I think at the current rate we’re on a downward spiral.
Ankur: Got it. Do you expect more fragmentation or consolidation in the security industry over the next 5/ 10 years.
Varun: more fragmentation
Ankur: COVID vaccine in 2020 or 2021.
Varun:Even if there’s one, at least I won’t be taking it in 2020. Let some Guinea pigs go. So I think it’s more likely to be sometime early to mid 2021.
Ankur: Got it. And the last question, I guess a question before the question, did you watch the debate today?
Varun: Don’t ask me questions about that. That’s just incredibly disappointing.
Ankur: Allright. I ll ask you nonetheless. We don’t talk politics on this podcast, just your prediction on who’s going to win Biden or Biden.
Varun: (Laughs) I think the Supreme court will ultimately decide who is going to sit on the chair the next time around in the White House in the Oval Office. This is going to be a nasty election in one way or the other and I think there’s going to be no easy winner out of this. It’s my prediction. But hey, I’ll pull this podcast up in six months and see how wrong I was. Maybe.
Ankur: It’s a safe bet given the way things are going right now. Anyways, Varun you’ve been really generous with your time. We really appreciate that and hopefully we’ll have you once again maybe a few months a year from now.
Varun: All right. This was fun. Thanks for having me.
