Rebranding vs. Distribution: What's Really Holding Cybr Donut Back? - Rob Sobers, CMO at Varonis

[00:00:00] Hey, it's Andrew. And just quickly before we start this episode, I want to tell you about one of my favorite podcasts. It's the Bare Knuckles and Brass Tax Podcast. Not only does it have a great name, it also has a really good format that's interesting. The two hosts are both named George. That's not what's interesting about it. It's that George K is on the vendor side and George A is a CISO on the customer side. And they have real conversations, sometimes with guests, about the world of vendor customer interviews.

[00:00:30] They're not afraid to call out bad behavior on both sides and talk about the weird and wonderful nature of this world of ours in cybersecurity. Recent favorites of mine are the one about building trust called taking a flamethrower to FUD and buzzword mumbo jumbo. And also the one with someone who's a field CISO and advisor to startups called how security buyers think and go to market strategies for young companies. I'm not getting paid for this promo. I just really enjoy the show that two Georges put on.

[00:01:00] Check it out. It's the Bare Knuckles and Brass Tax Podcast. Now on with this episode.

[00:01:30] I'm going to ask you to ask for Cyber Donut to get to that $10 million ARR. And someone recently has put a bug in his ear that one of the problems they have is awareness. People don't know enough about Cyber Donut. These companies got a cool name, but they don't really know what they do and things like that.

[00:01:47] And what they also said was you need to fix this by doing a rebrand of the company.

[00:01:53] But Bill's not a marketer, right? He's a founder from the technical side. He's not sure whether the rebrand idea is good advice or whether it's bad advice, which is why I'm pleased that Rob Sobers, the CMO at Varonis, is joining us today.

[00:02:12] Rob actually recently took Varonis through a rebranding and has an opinion on whether it is the right thing or the wrong thing for a Series A company such as Cyber Donut to do.

[00:02:25] I'm Andrew Monaghan, and this is the Cyber Security Go-To-Market Podcast, where we tackle the question,

[00:02:31] how can Cyber Donut get to $10 million in ARR by the end of 2025?

[00:02:47] Well, Rob, welcome to the podcast. As you know, and I was going to remind the listeners, what we're doing is we're on a mission to save Cyber Donut.

[00:02:57] They have to get to $10 million of ARR by the end of next year. And given that they closed Q3 of this year at about $1.1 or $1.2 million, they've got a way to go.

[00:03:07] So Bill Wallace is the CEO. He's scrambling a little bit. He's feeling the pressure, and he's figuring out different things that he and the company should be doing to get to that big number.

[00:03:20] He realizes it's a stretched goal where he's kind of in the mode of, let's try some things and, you know, more of the non-standard things, let's say, and see if we can really make a difference here.

[00:03:30] And recently, he was somewhere at a conference or talking to one of his buddies, and they said, you know, Cyber Donut's not well known.

[00:03:39] What you need to do is rebrand the company to help with the awareness problem that you have.

[00:03:45] And that's what we're going to talk about today to see if that's what he should be doing and if it is, how he should do it.

[00:03:51] And if not, maybe some other things he should be doing.

[00:03:54] So, you know, you've got the chance to look at the profile of Cyber Donut, you know, the Series A company that just had that ARR I talked about.

[00:04:00] Anyone else following along can go to CyberDonut.com, and it's spelled C-Y-D-R-Donut, D-O-N-U-T.com.

[00:04:09] You can see the full profile of where we're at.

[00:04:12] Rob, you've got the chance to look at it.

[00:04:14] You know, when you hear Bill saying, we need to rebrand, what's the first thing that you start thinking about is think of, A, if that's the right thing to do, and B, how he might start?

[00:04:23] Yeah, rebrands are almost never the answer to the question you're trying to ask.

[00:04:30] So I think what we have here is a distribution problem, not a brand problem.

[00:04:36] And you also, I think, have to dig into what we mean by brand, right?

[00:04:41] There's sort of capital B brand, which is how people perceive you, what they say about you when you're not in the room.

[00:04:46] And then there's a visual brand, which is like the little B brand.

[00:04:49] And you almost never want to spend time fussing about color palettes and brand identities and sort of doing this very deep academic work on like, you know, what should our brand convey and make people feel if you're trying to build pipeline, right?

[00:05:05] Now, I think a brand awareness problem, which is nobody knows us and therefore they don't want to try our product and we don't have a sales pipeline.

[00:05:12] That's a different problem.

[00:05:13] And I don't think changing your fonts on your website or redesigning your trade show booth is going to solve for you.

[00:05:22] That is a different problem, which calls for different tactics.

[00:05:26] It feels like that people do that, though, right?

[00:05:30] And I think that's a common thing that happens is people kind of view this, you know, some sort of event has to happen.

[00:05:36] Therefore, let's update our brand a little bit.

[00:05:38] Why do people get sucked into that, do you think?

[00:05:40] Yeah, I think it could come from a multitude of of angles.

[00:05:44] So it could be that you have a new marketing leader who just wants to put their fingerprints on it.

[00:05:48] You know, they don't like the old color scheme.

[00:05:49] And so they want to, you know, remake it in their own image.

[00:05:53] In some cases, you might have a terrible visual brand and it is something that is impacting people's perception of you and you do need to fix it.

[00:06:01] But rarely is that the case.

[00:06:02] Usually it's good enough and it's your messaging.

[00:06:04] That's a problem, right?

[00:06:05] No one can understand what you do based on your homepage or, you know, maybe it's a product market fit problem, which is more a deeper issue, more existential issue.

[00:06:14] Sometimes it's the CEO or a board member that sort of doesn't like the aesthetics of your brand.

[00:06:19] And so these requests to sort of rip down the visual sort of like window treatments, so to speak, and recreate them.

[00:06:26] It can come from anywhere.

[00:06:27] But again, almost always it's never going to solve the root problem, which is how do we get more demo requests?

[00:06:33] How do we get more trials?

[00:06:34] How do we build more sales pipeline?

[00:06:36] That's usually you just don't have enough reach.

[00:06:38] People don't trust you.

[00:06:39] Your content isn't, you know, compelling, you know, or you're in the wrong market.

[00:06:43] It could be any number of reasons, but almost never is changing your color palette going to solve that problem for you.

[00:06:50] I view it as a very incremental and additive thing.

[00:06:53] Unless you have a very unless you're on a very different mission than people need to know about us.

[00:06:58] If you're on a mission that is we want to completely change what people think about us.

[00:07:03] Think about celebrities who kind of reinvent themselves or artists, right, who decide to stop producing country music and they want to start producing a different style of music.

[00:07:11] They're actively trying to re-educate, you know, the world on who they are.

[00:07:15] That's a different mission.

[00:07:16] And that many times should be coupled with a visual rebrand to jar, you know, jar your audience into saying, hey, something is different about this person or this company or this product.

[00:07:27] Right. I think that is a good tool for that job, but it's the wrong tool for an early series age series A company who's just trying to learn and build a good product and attract a wider audience.

[00:07:39] I don't think you do that by changing your color palette or having a new logo.

[00:07:44] OK, so let's put that to one side for Bill.

[00:07:46] Let's say, you know, we've kind of gone off the track of fonts and colors and said, OK, we really have an awareness problem.

[00:07:54] How do how should he be thinking about the big B brand, let's say, or the company in terms of therefore solving the awareness problem that they have?

[00:08:04] Yeah, I think the first thing you have to do is and it doesn't have to be complicated is a little bit of work around who's your ICP, who's your ideal customer profile.

[00:08:13] You know, like what company sizes are we targeting?

[00:08:15] Are we targeting SMB, mid market, enterprise, Fortune 500?

[00:08:20] You really have to kind of start there.

[00:08:22] What personas within those companies?

[00:08:23] Are you building a cloud security product where cloud security architects are super important to you and are going to be influencers in your deals?

[00:08:30] And they have to know, like and trust you.

[00:08:32] Or maybe it's network admins or, you know, some other persona within the organization.

[00:08:36] I think it's important to do that work.

[00:08:38] Figure out if there's certain industries or certain attributes of a company that could make them more likely to want to buy your product.

[00:08:46] For instance, highly regulated industries or if you sell a product that helps protect AWS, you kind of want to narrow your target pool down to companies who store data or use AWS.

[00:08:58] So I think there's a lot of that pre-work that needs to be done so that you're not just sort of shouting into the abyss and trying to attract everybody as a customer.

[00:09:05] You're not Coca-Cola, right?

[00:09:07] You're not Apple where any consumer could be a potential buyer.

[00:09:10] You really are fishing in a, you should be fishing in a smaller pond and really trying to drive awareness within that targeted, targeted group.

[00:09:17] Your job is going to be much easier.

[00:09:18] And then you need to figure out what channels to use, right?

[00:09:21] I think you have to meet people where they are.

[00:09:23] So what media do they consume?

[00:09:25] Who are the influencers they trust?

[00:09:27] You know, what YouTube channels do they watch?

[00:09:29] What trade shows do they go to?

[00:09:30] So these are some of the questions I would start asking.

[00:09:32] But you can't ask those questions until you know which companies and which people within those companies are your actual buyer.

[00:09:39] Or likely to be if you're very early on.

[00:09:41] You may not know.

[00:09:41] Yeah, a couple of thoughts.

[00:09:42] One is, you know, most deals that sales gets into these days have multiple personas they're involved in, right?

[00:09:49] Even, you know, outside security into other areas.

[00:09:52] As you're thinking about, you know, awareness, as you're thinking about targeting and getting very specific who you're at, how many personas is too many?

[00:09:59] And how many is too few in terms of how you should be, you know, messaging like that?

[00:10:05] Yeah, that's a great question because I do think you can go overboard.

[00:10:08] And I think your traditional, if you just Google like persona template, you're going to find some goofy stuff out there.

[00:10:14] Like so-and-so likes to walk his dog on Tuesday mornings, right?

[00:10:18] Like it's just you can kind of go crazy.

[00:10:19] When I think about personas, I really think about what pains they have in their job and what are the typical job titles.

[00:10:25] Who's on the hook for the result, you know, that we're helping drive, whether it's preventing data breaches or passing compliance.

[00:10:34] Yeah, maintaining compliance.

[00:10:36] So for me, you know, three would be a good place to start.

[00:10:40] We'll start with one and then maybe you want to go to three.

[00:10:43] And then you start getting into sort of like influencer land where, yeah, the procurement person is going to have to get involved.

[00:10:50] But are you going to run targeted marketing campaigns and build content for procurement?

[00:10:53] No, legal officer, maybe in cybersecurity, you know, you can hit a nerve with a legal person who will sort of be the tip of the spear for a data security project or a cybersecurity project within that company.

[00:11:05] But it's less likely.

[00:11:06] It's mostly driven by the people tasked with solving the issues on a day to day basis.

[00:11:11] So your security operation team, your CISO, your CIO.

[00:11:16] So I think you really have to narrow it down.

[00:11:18] You know, there's plenty of frameworks out there, many which define sort of like who's your economic buyer.

[00:11:24] So who has to sign the check?

[00:11:26] You know, who's going to be your likely champion and then maybe pick one influencer.

[00:11:30] And if you can kind of narrow those three down and really figure out who they are.

[00:11:34] And if you're lucky enough to have a bunch of customers, you can kind of look back and see what the data shows you.

[00:11:39] But if you're brand new, you know, you're going to have to figure that out.

[00:11:42] Yeah.

[00:11:43] I feel like most companies should probably get to two or three, you know, core ones.

[00:11:47] And then, you know, maybe a little bit distracted with it.

[00:11:49] And these guys and those guys.

[00:11:51] And, you know, don't forget those guys.

[00:11:53] It's like, well, we can't do it all, right?

[00:11:54] We're a series A company, not bigger.

[00:11:56] We can't possibly have the resources to go after and probably do a good job on all of them.

[00:12:01] One thing that I've often thought about this is that I think intuitively the obvious channels might be to reach these people, right?

[00:12:10] You kind of look at some of the events and you hear about the events, the B-sides and the big conferences and things like that.

[00:12:16] And maybe we could use Varonis as an example.

[00:12:18] You know, what other channels are the ones that you see as really good to go and target some key personas?

[00:12:27] Yeah.

[00:12:27] Yeah.

[00:12:27] Obviously, offline events are pretty good because there's little spillage, right?

[00:12:33] You show up to a B-sides event and, you know, 99% of the people in that room are going to be relevant to you.

[00:12:38] And if you do it in a certain geolocation, let's say you do one in Atlanta, you're likely to get people who work for target accounts in the Atlanta region.

[00:12:45] And for a lot of us, CMOs, like we're responsible not only for generating demand, but generating geo-specific demand, right?

[00:12:51] We have a team in the Southeast that needs to hit a number.

[00:12:54] We have a team in the UK that needs to hit a number.

[00:12:56] So events let you really sort of geo-target very well.

[00:12:59] Of course, you have these situations where someone who comes to the Atlanta B-sides works for a company that's headquartered in San Francisco, right?

[00:13:06] That happens too.

[00:13:07] But it's a good way to do that and kind of drive regional demand.

[00:13:11] Obviously, there's, you know, YouTube pre-roll.

[00:13:14] There's sponsorships, right?

[00:13:16] There's so many cloud security newsletters.

[00:13:19] There's cybercrime newsletters.

[00:13:20] There's so many ways you could sponsor great content that's being made by people that your audience trusts.

[00:13:26] I think that's a fantastic way to get your brand out there in a very targeted way.

[00:13:30] And it helps you, again, avoid spillage where you're not just advertising, you know, on United Airlines where anyone sitting in that seat could be, you know, have no idea what cybersecurity is and not your target buyer.

[00:13:41] It's, you know, very scattershot approach.

[00:13:44] Of course, if you're CrowdStrike and you can do a Super Bowl commercial every year, you know, doesn't hurt.

[00:13:48] Would love to be in that seat.

[00:13:50] I'm sure many of us would.

[00:13:51] But from a Series A company, from a cyber donut standpoint, you really need to think about what are these sort of low cost, highly targeted ways to reach that audience.

[00:14:00] And I love podcasts.

[00:14:01] I love YouTube.

[00:14:02] I love Reddit is a good example of a channel that I think a lot of people in cybersecurity spend a lot of time on, you know, and there's great, there's very specific subreddits for different topic areas.

[00:14:13] So you can get kind of targeted in that way as well.

[00:14:15] There's just a handful.

[00:14:16] It feels like from what you're saying, this is an exercise in and moving your pawns all over the board as opposed to, you know, going all in on one thing, right?

[00:14:25] You could really try and cover many different bases.

[00:14:28] Yeah, I like to look at marketing kind of like the same way you look at an investment portfolio.

[00:14:33] You know, you kind of want to have your big bets, you know, things that you either trust, like have a good track record of return, that you have evidence of strong returns or pretty safe bets.

[00:14:45] You want to be able to, you know, move some chips into areas that are experimental and have diversity.

[00:14:50] And so not all your eggs are in one basket.

[00:14:52] So it's a lot like that.

[00:14:54] And if we all knew what channels would work, you know, the best heading into next year, we'd all be, you know, sitting pretty, but things change, right?

[00:15:02] Especially when, you know, when thinking about SEO and paid search right now with the proliferation of AI as a replacement for search, you know, that you have to start thinking about what, how do you change your investment in content that's specifically designed to rank in Google search?

[00:15:20] You know, how do I make sure it also ranks in perplexity?

[00:15:23] How do I ensure that, you know, AI is like, is exposing our brand?

[00:15:29] You know, I don't even, I don't think anybody really knows how that's going to all play out.

[00:15:33] Are you trying things right now around the AI search, AI, you know, discovery process?

[00:15:38] Not really, to be completely honest.

[00:15:41] You know, I think it's right now, it's so much of a black box, how these responses are generated, right?

[00:15:48] You can go into chat GPT right now and ask for the top 10 data security companies ranked by, you know, preference on brand color, right?

[00:15:56] Like who knows how that answer is formulated and spit out.

[00:16:01] So it's a little bit of a black box right now, but I'm sure, you know, leave it to marketers to ruin everything.

[00:16:06] I'm sure we'll figure out a way to infiltrate and add some advertising and yeah, some way to hack in and figure out how to compromise the results.

[00:16:14] It's going to make an interesting acronym like the AIEO or something like that, right?

[00:16:19] Instead of SEO.

[00:16:20] Yeah, right.

[00:16:25] All right, Rob, well, let's get to know a little bit more about you as a person.

[00:16:29] We've been talking about rebranding and awareness already with Cyberdonald, but let's learn about you.

[00:16:35] I have a list of, believe it or not, 49 questions here.

[00:16:39] The good news is I don't ask you 49.

[00:16:42] I'm going to spin a wheel.

[00:16:43] It's the random spinning wheel of magic.

[00:16:46] It's got a unique AI driven algorithm that makes sure it's completely random and is protected obviously with all sorts of data protection and encryption as well.

[00:16:57] So I'm going to spin it and we'll see what numbers come up and see what random questions you get.

[00:17:01] Let's go.

[00:17:06] All right, number 12, Rob.

[00:17:08] How did you first make money as a kid?

[00:17:10] You know, I used to draw a lot when I was a kid.

[00:17:13] So during class when teachers were giving a lesson, I'd be doodling away and drawing Simpsons characters or Wile E. Coyote or something like that.

[00:17:23] And my classmates started to see what I was on to and they wanted to buy my drawings.

[00:17:28] And who was I to tell them no?

[00:17:29] So I would sell drawings for a quarter or 50 cents.

[00:17:33] And that's kind of how I first made money.

[00:17:36] And then it eventually evolved into creating websites for the local sushi restaurant or something like that.

[00:17:41] That I kind of, you know, transformed that talent into web design.

[00:17:44] But when I was very little, probably fourth and fifth grade, I was selling my little cartoons to my classmates.

[00:17:52] Fantastic.

[00:17:53] Do you keep up drawing and that aspect of it?

[00:17:57] Yeah, you know, every now and then with the kids, I'll sit down with them and spin up one of the cartoons that I used to draw as a kid, but not so much anymore.

[00:18:06] Very good.

[00:18:06] Well, you have design shops then, it probably sounds like, right?

[00:18:09] Yeah, I actually thought I would be an animator when I was little.

[00:18:13] I wanted to be an artist for either The Simpsons or Pixar and that eventually evolved into product design.

[00:18:21] So I do really love UX and UI and all that stuff.

[00:18:26] But once I got my hands on backend code and, you know, eventually marketing, which we'll talk about today, you know, it kind of took me away from the art side of things.

[00:18:37] All right, let's spin the wheel and get another question.

[00:18:45] All right, number 33.

[00:18:48] What is a funny or memorable moment in your work life?

[00:18:52] Yeah, I would say one of my first job out of college, I was a software developer for a company that made apps for furniture companies.

[00:19:03] So some of the biggest furniture companies in the world would use our software to run their warehouses and their front end stores or retail stores.

[00:19:08] And we had to migrate one of the biggest retailers in the world from one version to another.

[00:19:14] We had to run a whole bunch of like gnarly database migrations and data transforms.

[00:19:17] And it had to happen in a very tight time period where they shut down all of the warehouses and all of their stores.

[00:19:22] And I think I was 23 years old and doing this single handily over a weekend.

[00:19:26] And they just left me alone to do it.

[00:19:28] And in hindsight, I look back at that moment.

[00:19:30] And while it didn't end in disaster, I just really questioned their judgment in putting me, a pretty junior employee, in charge of making sure that these stores could come back online on Monday.

[00:19:41] And yeah, in hindsight, that was a very odd moment.

[00:19:44] And something I will always remember as a moment where I'm lucky I didn't mess that up.

[00:19:50] Did you feel the pressure at the time or was it only afterwards in retrospect?

[00:19:53] You thought, God, that was weird to let me do that.

[00:19:56] I did.

[00:19:57] I did feel the pressure.

[00:19:58] I just didn't feel confident enough to say, hey, is this a bad idea?

[00:20:02] I was just sort of like, okay, this is my mission for the weekend.

[00:20:05] It was a weekend migration.

[00:20:06] And I felt the pressure.

[00:20:07] I wanted it to go well, but it felt like I was a bit flying without, you know, a safety net.

[00:20:13] All right.

[00:20:14] Last question.

[00:20:15] Let's spin the wheel.

[00:20:20] All right.

[00:20:21] Number 17.

[00:20:22] How did you first get into cybersecurity?

[00:20:26] Yeah.

[00:20:27] I guess the very first time was back in the, you know, late 90s when I realized that I was playing a multiplayer game online.

[00:20:38] And I realized that if I was using Telnet at the time, if I Telneted into a different server, but used the same credentials that I had on my home server, I could, it would work.

[00:20:52] And I would log in to this remote server that didn't belong to the company that I was working with.

[00:20:57] And I'm like, oh, this seems wrong.

[00:20:59] This seems like a vulnerability, right?

[00:21:01] It was a vulnerability.

[00:21:02] And that was like the first time I discovered, you know, how bugs can result in these big security flaws.

[00:21:07] And so I really got into bounty hunting, bug bounty hunting and web application security and SQL injection and things like that.

[00:21:17] So I used to do it sort of not as a job, but as more of a hobby.

[00:21:20] And then eventually when I became a full-time engineer, it became an aspect of my job and then eventually ended up doing cybersecurity marketing.

[00:21:28] So that's kind of the weird pathway.

[00:21:31] Now, when you joined Verona's, did you go straight into marketing at that point or did you have a different path to get there to be the CMO?

[00:21:38] I did. I went straight into marketing.

[00:21:40] My first job title was technical marketing manager.

[00:21:43] And they hired me because I had a strong technical background and we were selling to a technical audience.

[00:21:48] But I loved creating content.

[00:21:49] It was one of my favorite things to do was to write about the tech that I was building.

[00:21:54] And so I had my own personal blog.

[00:21:56] I wrote a book.

[00:21:57] I helped co-author a book on Ruby on Rails.

[00:22:00] So I was big into content creation on technical topics.

[00:22:04] And that's what Verona's really needed was to build trust amongst an audience that was highly technical.

[00:22:09] And so I got into creating security content and doing product marketing and content marketing, blogging, stuff like that.

[00:22:16] And then eventually kind of accrued more responsibilities over the year, more aspects of marketing, such as event marketing, PR, all the sort of nitty gritty.

[00:22:25] But that happened over the course of over a decade.

[00:22:31] You brought up the CrowdStrike Super Bowl commercial.

[00:22:35] I thought it was interesting, right?

[00:22:37] They were going for clearly a narrative, a storyline.

[00:22:40] Rather than just look at our stuff, isn't it good?

[00:22:42] They were trying to make it a bit more engaging.

[00:22:46] I have no idea whether they viewed it or anyone viewed it as a success or not.

[00:22:50] But what were your thoughts about that?

[00:22:52] You're clearly trying something a little bit different there.

[00:22:54] Yeah.

[00:22:54] I think with a mass market audience like that, you don't really want to make your ad too narrow.

[00:22:59] I think you do want to do more storytelling.

[00:23:02] And a lot of brands, I think, pull on the heartstrings during Super Bowl.

[00:23:06] That's one tactic is, you know, hit you in the feels, as they say.

[00:23:10] I like CrowdStrike's ad.

[00:23:11] I thought it was entertaining and kept your attention for that 30 seconds.

[00:23:16] I think that's the key.

[00:23:17] I think it was Coinbase that ran the ad that was just a QR code on the screen.

[00:23:20] I thought that was brilliant.

[00:23:21] A, because the cost of production must have been, you know, approximating zero versus,

[00:23:27] you know, the $2 million, $3 million, $5 million, $10 million you can spend if you're getting

[00:23:31] a celebrity to appear in your commercial.

[00:23:33] So I thought from a production value and intrigue, you know, if we're weighing it based on that,

[00:23:39] I thought it was brilliant.

[00:23:40] But yeah, I think when you're going mass market like that, you have to consider not going so

[00:23:45] much about your product and more about a story.

[00:23:47] Yeah.

[00:23:48] Yeah.

[00:23:48] They seem to do that pretty well.

[00:23:50] Let's quickly talk about Varonis there, Rob, because you've been there now for over 10 years,

[00:23:55] right?

[00:23:56] As you said, you worked your way through the marketing organization now to be CMO.

[00:24:00] It looked like from the outside that you did go through some sort of change in brand or visuals

[00:24:06] or whatever over the last while.

[00:24:08] What was the genesis of going through that process?

[00:24:12] Yeah.

[00:24:13] So I think we were in the rare situation where we might've waited a little too long.

[00:24:17] To rebrand and change our visual look and feel.

[00:24:21] You know, we were already a public company at that time when public in 2014, we've been

[00:24:28] around for a while.

[00:24:29] We've had a really strong track record and we relaunched our product as a completely new

[00:24:36] cloud native platform.

[00:24:38] So Varonis used to be a self-hosted solution where you would install yourself.

[00:24:44] Now we have an incredible new architecture.

[00:24:47] It's so much easier.

[00:24:48] There's so much more innovation happening.

[00:24:50] And so we really wanted to signal to the market that, hey, this is a new Varonis.

[00:24:54] Like we are coming out blazing into this new era of data security and we're ready to go.

[00:25:00] And so we really wanted customers and, you know, people who don't know us yet to really get

[00:25:06] a feel for who we are now, not who we were five, 10 years ago when we were the leaders

[00:25:11] in unstructured data security.

[00:25:12] Now we're, you know, leaders in data security period.

[00:25:16] And so it really, in my mind required that signaling, that visual signaling that, hey, some, I know

[00:25:22] Varonis, they're tried and true Varonis.

[00:25:24] We love them, but something is different here.

[00:25:26] We need to take another look at them so that, you know, they can get a feel for what we're

[00:25:30] doing today.

[00:25:31] All the stuff we're doing in the cloud, all the stuff we're doing with AI security.

[00:25:35] So that was the impetus behind it.

[00:25:37] And why do you think you almost waited too long?

[00:25:40] It's for the reason, uh, the same reason that I would advise cyber donut not to worry about

[00:25:44] this stuff is because we were focusing on the things that are existential, which is acquiring

[00:25:50] new customers, building pipeline, you know, having a great customer experience.

[00:25:55] We're sort of making sure that the foundation of the house was strong and sort of like making

[00:26:00] sure that year over year as a public company we're performing because there's no way you can

[00:26:04] sort of attribute, um, that bottom line performance to a brand change.

[00:26:08] You know, it is sort of one of those intangible things that is very difficult to measure.

[00:26:13] And so we were so laser focused on the building blocks that we maybe waited a little too long

[00:26:18] to kind of do this more surface level, but still very important change.

[00:26:21] Yeah.

[00:26:21] Yeah.

[00:26:22] Well, let's go back to cyber donut.

[00:26:23] We were talking about awareness.

[00:26:24] We talked about the channels that they should be focusing on.

[00:26:27] What's next for them once they've done that?

[00:26:30] What do you think they should be focused on?

[00:26:32] Yeah.

[00:26:32] I think there's, there's a lot of things that could make a difference right away.

[00:26:36] Right.

[00:26:36] So first, obviously you have to attract the right audience, get them to the website.

[00:26:41] So once we're starting to see some traffic, uh, I would look at the core user flows on

[00:26:45] the website.

[00:26:45] It's a great place to start.

[00:26:47] So are we offering a free trial?

[00:26:49] Are we pushing people towards requesting a sales demo?

[00:26:52] Whatever flow, you know, first of all, we should be testing different flows.

[00:26:55] And then second of all, once we have those flows established, measuring maniacally the conversion

[00:27:00] rates between steps and removing as much friction as possible.

[00:27:02] I think that is the absolute key.

[00:27:04] And we need to focus on how many of those hand raising events we're seeing on a daily

[00:27:09] basis on our website of people wanting to try our product.

[00:27:12] And that's going to be a good proxy for whether all of these quote unquote brand investments

[00:27:16] or distribution brand awareness investments that we're making are working, right?

[00:27:20] Do more people want to try us?

[00:27:22] Um, so that's where I would focus next is, is if we're getting this traffic in, if we're

[00:27:26] building some awareness, let's convert that awareness into consideration.

[00:27:31] And I imagine we have to do both at the same time.

[00:27:34] You've got to, you know, get the high wire act going.

[00:27:36] We've got to get the little things stringed across between the two buildings.

[00:27:39] We've got to start walking and start learning all at the same time, right?

[00:27:43] It must be quite hard to get really reliable measurements about which channels are truly flowing

[00:27:48] through and working well.

[00:27:49] Yeah.

[00:27:49] And I wouldn't fuss too much over that.

[00:27:52] And attribution is a big rabbit hole that many of us fall into where we really try to

[00:27:57] prove out which channels are working, which campaigns are working to what extent, um, so

[00:28:02] we could steer our investments.

[00:28:03] But at this stage, I think, um, it doesn't make sense to do.

[00:28:06] I think, uh, also people can do onsite optimization too prematurely.

[00:28:11] Like if you're only getting, you know, a hundred visitors a day, don't run AP tests, right?

[00:28:15] Your sample size is not big enough, but you still want to make sure that those hundred

[00:28:19] users are, have a nice flow from homepage to product page, to demo, whatever that flow

[00:28:24] might be.

[00:28:24] And that the messaging is very clear as well.

[00:28:27] So that's another thing is, um, doing a lot of message testing is important at an early

[00:28:32] stage.

[00:28:32] Make sure that when you, you know, say what you do in a very concise way, your elevator

[00:28:37] pitch, people actually understand it.

[00:28:39] They can bucket you into an existing category.

[00:28:41] Uh, hopefully we're not doing any category creation.

[00:28:44] That's kind of like black belt level stuff, but hopefully people know what you do by just

[00:28:49] reading your homepage and you have some sort of differentiator that's making you stand out.

[00:28:55] So I would really spend a lot of time there.

[00:28:57] And again, on these core user flows to make sure that we're good to go.

[00:29:01] I wouldn't get into trying to quote unquote prove that these things are working.

[00:29:06] You just want to run a bunch of experiments and then see if the trials and demos are coming

[00:29:09] in.

[00:29:10] Don't try to kind of trace it back all the lineage between this ad click led to this visit

[00:29:16] led to this form submit led to this open opportunity like that can, you know, consume weeks and

[00:29:21] weeks of time that we're, we're just too early at cyber donut to focus on.

[00:29:25] I think.

[00:29:26] Yeah.

[00:29:26] It really feels like the, I don't know if the industry, but the focus has changed a little

[00:29:30] have been the last five years or so from one being heavily attribution focused to one is

[00:29:34] let's just get things working and then improve from there.

[00:29:38] One thing you haven't mentioned is traditional PR.

[00:29:42] Is that still a thing these days for a company like cyber donut?

[00:29:46] It is, but it's something where you have to have a good story.

[00:29:50] I think journalists are not likely to write about your product.

[00:29:54] Maybe if you have something unique when you're coming out of stealth, that's a good

[00:30:00] story for a tech crunch or something like that.

[00:30:02] But again, it's just going to be a blip on the radar.

[00:30:04] It's going to get posted and then kind of move on.

[00:30:07] The world moves on.

[00:30:08] You have to have real stories.

[00:30:10] So are you tracking certain threat actors?

[00:30:13] Are you, do you have inside knowledge on a big breach?

[00:30:17] Do you have a proprietary data set?

[00:30:19] We've seen companies do really cool stuff with proprietary data.

[00:30:22] The Verizon DBIR is probably one of the most well-known reports that people trust.

[00:30:28] And journalists love to write about the trends when the new DBIR comes out.

[00:30:31] So ask yourself, do you have some proprietary data that a journalist might want to write a story about or have an angle on?

[00:30:37] So it's much more about having good stories than having a good product.

[00:30:42] Unless you're Tesla or Apple, the press is not writing about CyberArk's new product launch.

[00:30:49] Not to pick on CyberArk, but...

[00:30:50] Right, right, right.

[00:30:51] Yeah.

[00:30:51] Version three came out as like, okay.

[00:30:54] You know, it's just not a great pitch.

[00:30:56] It's a very self-centered pitch.

[00:30:58] You know, the one caveat is if you're spending a bunch of money with that media outlet on the paid side, like they probably will write that piece for you.

[00:31:04] It feels like, you know, in a lot of the cyber companies around today, they do, you know, the delivery mechanism of the product means that they're collecting a lot of customer data.

[00:31:14] Whereas, you know, 10 years ago, if your software was installed on-prem, it was kind of blind to what was there.

[00:31:19] Would you say it's worthwhile for a company such as a Series A company to actually spend a little bit of time saying, what can we pull out of?

[00:31:29] Obviously, anonymized and all the rest of it, data to actually put together some sort of research or some sort of model.

[00:31:36] The thing that springs to mind, which I think has been really well done, is gone, you know, five, six years ago.

[00:31:43] They produced all this stuff about go-to-market effectiveness based on all their analysis.

[00:31:47] And I'm wondering if a company such as Cyberdonut should be thinking about that as well, or that is a distraction for them from their core mission of building a great product.

[00:31:55] No, I think that could be an interesting tactic.

[00:31:57] You know, obviously, you have to be super careful with this stuff, like you said, with anonymizing the data and only reporting trends.

[00:32:03] I think Mandiant does a good job with this stuff, like based on their investigations, they kind of release trend reports or release specific reports on certain threat actors, which is useful to the community, which then, you know, is positive for their brand and also can, you know, draw in new customers.

[00:32:20] Recorded Future does a good job here as well, or did a good job.

[00:32:23] I don't know if they're still doing this sort of thing where they have like a weekly free newsletter with a lot of threat intel.

[00:32:29] It's kind of like the surface level part of their product.

[00:32:32] So, yeah, I think it could be a great tactic.

[00:32:34] Just tread carefully.

[00:32:35] I remember, I think Basecamp a while ago, like they kind of reported like, I don't know, it was like the millionth file upload to Basecamp and they reported it was like cat.jpg.

[00:32:46] And they thought it was innocent saying that cat.jpg was the millionth file uploaded to Basecamp.

[00:32:51] They didn't say which customer it was or they didn't, you know, post the file.

[00:32:55] They just said the file name and everyone was up in arms like, hey, you're looking at your customer's data and then you're divulging it.

[00:33:01] Something as innocent as the file name.

[00:33:03] And they weren't wrong.

[00:33:05] I don't think, I think they crossed the line and they admitted that they crossed the line.

[00:33:09] So, again, you have to tread very carefully, but there's so many examples of this out there.

[00:33:13] And I think Gong is a phenomenal example of using their proprietary data to create content marketing.

[00:33:17] That is really useful and compelling.

[00:33:19] These analytics can be very useful.

[00:33:21] So, I love it as a strategy.

[00:33:24] Okay.

[00:33:24] Well, listen, we're unfortunately running out of time here, Rob.

[00:33:28] Your advice to Bill Wallace, the CEO, is taking on board.

[00:33:33] You're a de facto advisor now to the Cyber Donut leadership team.

[00:33:38] And they're going to start thinking about how to use some of your tips and ideas going forward to try and crack that $10 million.

[00:33:44] So, thanks so much for joining us.

[00:33:45] What's the best way for someone to get hold of you?

[00:33:47] Is it LinkedIn?

[00:33:48] Yeah, LinkedIn works.

[00:33:49] Very good.

[00:33:50] All right.

[00:33:50] Well, thanks for joining, Rob.

[00:33:51] All right.

[00:33:52] Thanks for having me.

[00:34:05] It would mean a lot to me and to the continued growth of the show if you'd help get the word at.

[00:34:10] So, how do you do that easily?

[00:34:12] There are two ways.

[00:34:13] Firstly, just simply send a link to a friend.

[00:34:17] Send a link to the show, to this episode.

[00:34:19] You can email it, text it, Slack it, whatever works for you and is easy for you.

[00:34:24] The second way is to leave a super quick rating.

[00:34:28] And sometimes that can seem complicated.

[00:34:29] So, I've made it as easy for you as I can.

[00:34:32] You simply have to go to ratethispodcast.com slash cyber.

[00:34:38] That's ratethispodcast.com slash cyber.

[00:34:41] And it explains exactly how to do it.

[00:34:43] Either of these ways will take you less than 30 seconds to do, and it will mean the world to me.

[00:34:48] So, thank you.