154: Ashley Leonard, CEO of Syxsense - How to go after the mid market

Mention endpoint security and I immediately think try to market with little differentiation. Sixth Sense is in that market are building a differentiated product and are building impressive traction. Find out what they are doing with their CEO, Ashley Leonard. Welcome to the Sales Bluebird podcast, which exists because of cybersecurity startups. It's hard to get repeatability and scale the business. Sales Bluebird gives you tips, tricks, experiences, examples, ideas, inspiration from people who know a thing or 10 about building great cybersecurity companies. I am your host, Andrew Monahan. Our guest today is Ashley Leonard, the CEO at Sixth Sense. Ashley, welcome to Sales Bluebird.

Hi Andrew, I'm excited to be here. Thank you for inviting me.

Yeah, I'm looking forward to our conversation today. I'm calling in from my home in Colorado. I'm back home after RSA. It's nice and warm outside, 90 degrees. But since you're based in Florida, Ashley, you probably think that's a cool winter's day, maybe.

Well, I'm in Miami, Florida, and it's I think it's about 90 degrees outside here, but uh a lot more humid.

Yeah, it probably is, I'm sure. As a person who grew up in Scotland, uh the heat and the humidity is not my thing, so I don't envy you the humidity sometimes in Florida.

Yeah, no kidding. Well, I grew up in England, so a little way south of where you are, but uh I'm used to the rain. We get quite a lot of rain down here in Miami.

Exactly, exactly. Well, we'll get to the business in a second, but let's get to know the real Ashley, first of all. Believe it or not, I've got 34 questions on my list. The good news is I'm not gonna ask you all 34 questions. I'm gonna ask you to pick a random number between one and 34, and I'm gonna read out the question that corresponds to. You good with that?

Yep, let's do it. I will start with number six.

Number six, favorite summer pastime.

Ooh, boating. Love getting out on the water.

Oh, cool. Have you got your own boat or do you have to take someone else's?

I do not at the moment, but I have in the past and certainly want to get one. I I moved to Miami fairly recently and uh like a year ago. So it's definitely on my list of things to do.

Yeah, that'd be great, right? Be able to at the end of the day go out there and decompress a little bit like that.

Absolutely. Although I have to say I've got friends with boats, and that's people say that's better than moaning a boat.

I was gonna say, right? That's the best kind of boat, someone else's.

Yeah, absolutely. They say the best day of your life, right? When you buy a boat, the day you get rid of the boat.

Yeah. I hope that's not true. I want to be able to, in a few years' time, get a position where I'm somewhere except for Colorado, where a boat is actually something you want to have. But I'll cross that bridge when I get to it. All right, so next number between one and thirty-four, please.

Oh, let's go for 12.

12. They say home is where the heart is. Where is home for you?

Ooh. Well, physically, home is in Miami, Florida. As I mentioned, I moved here about a year ago. But I'm originally from the UK, from England, and I love getting back there when I can. We have an office in the UK, so I still have my parents who live there, so I'd have to say the UK.

Which part of England are you from?

Originally, I was born uh just north of London, but I actually grew up in the southwest in a small town called Dartmouth in Devon. It's like the Annapolis of the UK. They have the Royal Naval Officer Training College there.

Yeah, that's where the SBS is.

It's a very, very small town, about 6,000 people.

It's a beautiful part of the world down there, isn't it?

It is, yeah. Definitely a slower life compared to Miami.

Yeah. Oh, it's completely different. Last number between 1 and 34.

Uh let's go for 18.

18. One thing that you own that you should really throw out?

Ooh, that's a good question. You know what? I I have a collection of old computers. So I started collecting um all the computers I've ever worked with right from when I was a child through to a more recent one. So I have this kind of a museum of Ashley's computing history. And it just sits there and I never touch it, never do anything with it. I don't know what I'll ever do with it. Um it just takes up space.

Oh, that's great. Did you let me guess? Is ZX81 in there?

It is, it's number one. How did you guess that?

ZX81.

The more challenging one is can you get number two?

Oh, well, the Spectrum came after ZX81, didn't it?

It did. It did, but it's not my number two. I actually got a dragon, which I think for most of us on this side of the Atlantic wouldn't know that computer, but uh that was my second one. I think it was called a TRS-80, maybe over here. It had a different name.

Okay. Wow, but you get the old uh ZX81. That must be a great collection. I think I'm with you though. Like hold on to that. At some point you'll have the time to do something with it, right?

I don't know what I'll ever do with it. It's just cool.

So let's go on to the business side, Ashley. So you're the CEO at SixSense. Can you give us a feel for where you are on the journey of growing SixthSense, wherever you can share?

Yeah, we're at about 100 employees in the company, rapidly growing business. We've been growing 100% annually and accelerating. So very exciting time in the company's growth. As I mentioned, we've got three offices around the world, and is that it's a good time for growing a business in cybersecurity at the moment.

Yeah, and growing 100%. That's pretty rapid. Like any any measure.

Yeah, COVID obviously was an incredibly challenging time for a lot of us, and especially running a business. I at the beginning of COVID, I remember thinking, oh my gosh, how am I going to be able to uh keep the company going and uh be able to build the company? And it actually turned out for us to actually be positive. I hate to say that because it was so horrible for so many people, but when people started working from home, it really suited cloud-based technologies like Sixth Sense. So we were able to actually accelerate our growth during COVID, which uh has been great for the business.

Well, why don't you tell us what SixSense does? As you know, I'm a simple person from Scotland, a sales guy. Explain it in words that I would understand.

Yeah, we are a unified security and endpoint management solution. So we've unified the ability to manage all your endpoints, that's computers, PCs, desktops, servers, along with security tools as well, and deliver this all from the cloud.

So I heard management and security. So when you say management, I think about controlling systems, patching systems, things like that. Am I on the right track?

That's it. That's exactly it. Yeah, so we have a whole IT management capability where we can discover all your IT assets, we can collect asset data about them, push out software updates, patch them, remote control them, it can all be done remotely. But we've also combined this now with security as well, so that we're actually able to be able to scan devices for security vulnerabilities and actually remediate them.

Okay, so security is the next big topic, right? So you talked about the you know, looking for vulnerabilities. What else in the security stack have you tackled from the endpoint?

Yeah, so we collect a lot of data from the endpoints that can be indicators of potential compromise. And then we leverage our management technology because it's this combined suite of a unified security and endpoint management technology to actually be able to react when you see potential security issues at the endpoint. You might see, for example, logins from a device from a strange location. You might see a hard drive that was not encrypted and then suddenly became encrypted. For example, one of our clients had a payroll records breach and they weren't sure how this happened, and we were able to identify an endpoint there where the drive had been encrypted unexpectedly and investigated that further and found it was an inside job that it happened.

Wow, okay. When I when I hear about a vendor bringing technologies together, I tend to think that might be better suited for mid-market. Is that a fair assumption or have I got that completely wrong?

Yeah, so we certainly started. I started the company 10 years ago, and we were focused typically on smaller customers early on in the company's lifecycle, primarily because the early adopters were smaller customers, especially around cloud technology, if you go back 10 years ago. As the company and the technology's matured, we've definitely moved very solidly into the mid-market space. So I mean our primary customer today is more mid-market focus, which we define as organizations with somewhere between about 200 employees or endpoints. You can define it either way, up to around three or four thousand. That's our sweet spot. But we also got some large enterprise customers as well.

And what is it about your value prop that they latch onto that really resonates with them?

Well, typically patching is still today one of the major challenges that organizations struggle with. We've really been able to simplify the ability to actually identify all of your assets because it only really takes one that's unpatched to give a hacker or malware an entry point into your organization. So that ability to discover everything you've got and then be able to figure out what its current patch level is, not just the operating systems, but everything on that endpoint, so the third-party applications, and then be able to remediate those endpoints and bring them up to a secure compliance status is really why people get excited about our technology. Because we've been able to simplify that process and just make it available to the average IT department without having to have a huge number of cybersecurity specialists on the team.

Yeah, I would imagine in this day and age, I actually one of the themes for me looking at RSA last week were was the real desire from buyers from enterprise security leaders to have things that don't require more people, right? Actually means they can use existing teams more effectively in other areas. It sounds like that's what you're hitting for the mid-market organizations.

Yeah, it really is. I mean, at the enterprise space, they have the large security teams, right, with the latest skill sets and talent. In the mid-market and lower mid-market, it's a lot more challenging for those IT departments, which generally are more generalists than specialists in the mid-market, to be able to look after and get best value from some of the tools that I saw at RSA. I was there as well out last week. And there's some great tools there, but for many companies in the mid-market, they're just too complex for most IT departments to get the full value out of them. So we've tried to simplify it and automate as much as possible. And that's really been our focus as an organization. Make it really simple to do and automate.

And does that mean that you've got a play for MSSPs as well to use your technology as part of their business?

Yeah, absolutely. Yeah, we've done very well with MSSPs because our technology is multi-tenant, so it's very easy for them to host multiple customers in a single instance in our product and then be able to switch between them as well as be able to get a complete picture across their entire customer base as well. And that again, that ability to automate is very important for MSSPs because you can do more with less people.

And is the innovation, actually, for Sixth Sense, the fact that you've had enough time to bring in all these different technologies in one place, or do you have something else under the covers that's your secret sauce?

Well, we talked at the beginning a little bit about security as well. And what we've done that's really unique is we've been able to leverage the management technology to remediate security vulnerabilities. So there are plenty of security tools that are out there that tell you you have a problem, but don't actually help you fix the problem. Because we've brought together management and security into a single solution. Not only do we tell you or identify there's a problem, but we can actually remediate that problem.

So that's the idea that you can go and patch that system that's you know vulnerable in some way.

Yeah, absolutely. Not just patch it, also a good example. Last week, Microsoft announced, kind of announced anyway, a vulnerability in all their currently shipping operating systems with their diagnostic tool. It's actually a very serious vulnerability. Felina is what they call the vulnerability, and there is no patch for that vulnerability today. And so a patching tool wouldn't be able to help you because there is no patch. But our security vulnerability remediation capabilities actually are able to resolve this problem because we're able to make all the configuration changes on the endpoints needed to secure your endpoints. So that's really that power of bringing together security and endpoint management into a single solution.

Yeah, it's such a natural bedfellows, but it doesn't often happen though, right? Not many tools have both together.

Yeah, we were the first. A few others are trying to follow us, but yeah, we were definitely the first to do this, and it's definitely given us an advantage in the market. We really focus on innovation internally in the business. So yeah, it's a priority for us.

Let's talk about the fact that it's always in the market. You know, one of the things that is blindly obvious when you go to something RSA is that differentiation is tough, right? There's so much out there. You know, I heard that Momentum Cyber track 6,500 security vendors. Unfairly, I'll probably say that you know everyone's using the same buzzwords in a slightly different order to try and explain what they do. I'm wondering how you're thinking about how you really rise above that noise and get people to remember who you are and what you do.

Yeah, that's certainly challenging, especially at a big show like RSA. So for us, we're there because we want to get our name out there. It helps our customers to see us as well. But I again, I think for us it's innovation. That's how we stand out because we're bringing new ideas and new concepts to the market and simplifying managing IT and security.

So if I'm, I don't know, head of IT at a mid-market company out there, what will I hear about Six Sense? What will I see? Is it adverts? Is it, I don't know, an experience with you guys? Is it SDRs calling me? What's the general experience?

Yeah, so we have a pretty strong marketing team, actually a really strong marketing team, but that uses a number of lead generation sources. We use ABM technology, account-based marketing technology, where we can take inputs from a lot of different data sources. For example, if you're on G2 Crowd and you're looking at us or looking at other vendors in our target market, we can get analytics data that gives us information around the company that's likely looking at the space. And then we're able to go and identify through LinkedIn and other data sources who the likely buyers are within those companies, and we can hand that over to our SDR team to then go outbound and try and make contact with those potential buyers. One of the challenges I often hear about in marketing is that the customer is typically about 70% of the way through the buying cycle before they reveal themselves to the vendors. So whatever we can do to influence a potential customer earlier in the buying cycle hopefully impacts them when they come to make a decision.

Do you think that's a valid statement that people are so far down the buying cycle these days?

I do actually. A lot of customers look for independent reference material online. They do a lot of research themselves before they're willing to say to a vendor, hey, this is my company and this is my name and speak to a salesperson. So again, whatever we can do to educate customers earlier in the buying cycle, the better.

Yeah, I think it's important when you've got a different approach like you have, that you do get to influence earlier. I would imagine that you know if someone comes to you and says, Yeah, we got an endpoint protection project and we're looking at try to strike and Sentinel One and said, Dad, that I don't know if that would be you probably don't influence them early enough to change the whole buying criteria, right?

Yeah. Again, if someone's come to us and said we're looking at these tools, we're gonna know who they are. So they're probably 70% of the way through the cycle at that point. So it's gonna be tough to get them to take a look at us. It may be too late at that point. So if we can get to them earlier, that's gonna give us a huge advantage.

Sure. Tell us about your sales team, Ashley. How many do you have? What sort of roles have you staffed up?

So we have an SDR team, and we've got about four people in the SDR team, and then we have a sales team, both in the US and in Europe, and uh sales manager and uh CRO.

Cool. And what did you hire first when you started selling? Do you remember?

Yeah, it was my now CRO. And he's been with me from the very early days of the business, and just uh a phenomenal sales leader, took over from me during the very early days to the sales work.

And when you brought him on, was he a sales leader already, or was he someone who was a great scrappy seller who's built into being a CRO?

Yeah, he was a very scrappy salesperson. And I'm well aware that the best salesperson is not the best sales leader. We got very, very lucky because that's not a normal transition from being a you know a phenomenal contributor, a revenue contributor, to being a sales leader. I know that's a mistake many companies make in their sales because they feel that the sales team is going to take the top revenue producer and make them the manager. So uh we got very lucky. And did you pair him up early with an SE or is that we we've got a very good relationship, but uh yeah, as the company grew, certainly yeah, we we bought an SE in and now we've got a whole SE team as well.

Did you start in the UK and then move to the US or that way around?

No, I yeah, I started in the US and then we grew to the UK for about five years.

I'm interested to know how you knew you were ready for the UK. It's a tough thing, right? When do we expand and when do we not?

Yeah, we kind of got drawn into it. We closed some larger enterprise customers that had businesses in the Europe and they wanted to have local resources and local support. So we got drawn into opening in the UK. But it's been good for us. It's our second largest market, and it's been a good market for us.

Yeah, that's good. And go back to your saying about the seller who turns into the Sierra. I think that there's different roads people go in, right? Some people want to hire in early, the first real leader, and some people want to build out a team first and then bring someone in. I actually personally think the ideal is is halfway between the two, right? It's the person who has maybe just started being a leader, got a little bit of leadership experience, maybe somewhere else, but it's not afraid to roll their sleeves and get going, but also has that mindset about, you know, six months, a year down the road, how the sales team might grow out. But those people are few and far between, unfortunately.

Yeah, they are. You know, I one of the things I always look for in people for my team is someone who's willing to do the job they're hired for, but is also thinking about the job they want to go to next. And uh they're getting their work done day to day, but they're also thinking about, well, if if I was the CRO, I'd do this, this, and this. And then they're kind of coming to me with ideas and thoughts. And that's something I look for from my kind of team members and it's uh served as well.

Do you try and select for that at hiring? And if so, any tips about how to do that?

When you have no relationship, if you're hiring gold, it's very, very difficult to do. When you've got people within the team already that you're looking to promote, it's a lot easier. So typically it's when I'm looking to promote.

Yeah, they'll tend to you know naturally just step forward more often than not, right? And have an approach that's different. And when you look at the sales team for this year and next year, actually, what are the big things you want them to tackle and deliver on, except for obviously revenue?

So we're growing and so we're scaling a sales team as we grow. And so onboarding is uh a challenge when you're adding to your team. So it's very important that we have a very cohesive sales team that works together. Um we try and create kind of a buddy system as we bring people in so that there's guidance and mentoring at a peer level within the team. So that's kind of one element. I think the other one is for us, channel is another major area of growth for the business. And so we've been growing our channel organization.

Yeah, are you thinking traditional security channel, or is there a different one that's a better fit for you guys?

Yeah, for us there's two. We work through both fulfillment type channel partners as well as through MSSPs and MSPs. So we treat both of those as to us as channel essential.

Okay. Well, it's it's a great time to be working in cybersecurity right now, as you say. The market's growing very rapidly, even with the stately economy right now. And great to hear the success and growth you're having. And I wish you every success going forward. If someone wants to get hold of you, Ashley, what's the best way to do that?

You can connect with me on LinkedIn. That's nice and easy. So just search for Ashley or Leonard on LinkedIn at Six Sense.

And because Six Sense is spelt a little bit differently, can you spell it out for people so they know where to go?

Yeah, S-Y-X. S-E-N-S-E.

That's a great name right there.

Thanks. I appreciate it. Nice to meet you, Andrew.

Actually, I enjoyed the conversation. Wish you every success. Thanks. For me, this was a fascinating conversation. You know, here's a company that doesn't have all the hype and Rasmataz of some of the bigger names in the endpoint security world, and yet they're executing, they're growing, they're doing it sensibly, they've got the target market they're going after, and they're doing it very, very well. It kind of reminds me back in the day of the email security market when everyone was getting acquired. Proofpoint was almost the last company standing, and you kind of wondered what they're going to be doing, but they were just you know slowly executing on their vision about how to do it properly. They were growing and keep growing and now look at the size of where they are and what they're doing. I've got three takeaways from my discussion with Ashley. First of all, that you know, in general, unifying disparate tasks is usually an attractive proposition to buyers because it makes their lives so much easier. You know, just thinking about it in that lens. Except for the largest and most sophisticated companies, having a good enough set of features and capabilities is good enough for the market. You know, a lot of companies out there don't need the 199th feature and the 200 feature or the thing that uh is really just for the biggest and most sophisticated companies. Most companies don't need all that, right? So if you just think about what your target market needs, you can deliver on that and make their lives much easier, which many are willing to pay for. Second takeaway for me was you know, in security, many companies start with visibility, right? Visibility is important, but then the question is then what? What do you deliver after you've given your customers visibility? And Six Sense's ability to make it easy for remediation seems to really resonate with their customers. You know, we've seen this trend recently in the cloud security space where there was a a lot of hoopla around some companies that gave visibility, and now I think maybe a couple of them are struggling to really find their sweet spot beyond that because customers are saying, okay, now I know what I should I need to work on, but you know, I need help doing this. And then a third takeaway from me was that Six Sense moved from the mid-market up to the enterprise, and they do have some enterprise customers. In doing so, they will have had to create a product which is simple enough to use for the mid-market, and then also be useful for those bigger companies that don't need the bells and whistles. So it's kind of similar to the first one. Not every big company needs the most sophisticated features and scale and all the rest of it, right? There's protocols in the big company world that just don't have the same approach to security and investing in a multitude of uh tools and all the rest of it, right? So that you know being good enough for them actually lets you tap into the enterprise space without having to have supposed enterprise features. So those are wide three takeaways. I'd be interested to know what yours were. And with that, I wish actually the team have a success with this year and beyond.