Zach Lewis runs IT and security at a university on a tight budget, and when he needs a problem fixed, he goes looking in the startup community. He's been a sub-10 customer at Concentric AI, a very early customer at Island, a design partner for Jazz DLP, and he ran an email security product from a barely-out-of-stealth startup for four years. He explains what he gets for buying early, what he needs to see before he'll take the bet, and why your LinkedIn message almost certainly isn't how you'll reach him.
In this episode
- Why a four-year run with a sub-10 email security startup turned Zach into a repeat startup buyer
- The trade he makes for being early: lower pricing locked in for three or five years, and features built in weeks
- What he watches during a design partnership: the whole problem solved, the team growing, the product moving fast
- How his DSPM vendor ended up working like a remote member of his team
- Why nobody inside the university pushed back on buying from startups
- 10 to 20 LinkedIn pitches a day, three replies in seven years, one purchase, and where he finds new vendors instead
- How a deal actually gets funded in a July-to-June budget, and why something usually gets switched off first
- Why two out of three startups he sees are pitching shadow AI, and why he covered it with tools he already had
About the guest
Zach Lewis is CIO and CISO at the University of Health Sciences and Pharmacy in St. Louis, a Venture Advisor at Glilot Capital Partners, and the author of Locked Up (Wiley, 2026), the story of his university's response to a LockBit ransomware attack. He was named Non-Profit CISO of the Year in 2023.
Notable quotes
- "I've done a 5-year on a couple startups just because we want to lock in that low pricing."
- "Best email security product I've ever seen."
- "I don't think anyone even really knew they were a startup, nor did they care."
Chapters
- 00:00 Intro
- 03:18 Advising at Glilot and the St. Louis "cyber mafia"
- 07:23 What he listens for in a first startup conversation
- 09:31 How a design partnership really works
- 13:37 Why legacy DLP failed and what Jazz does differently
- 16:41 His first startup bet: email security
- 20:00 Price, multi-year lock-ins, and features in weeks
- 21:00 How much time early-stage vendors actually take
- 23:38 Does anyone push back on buying from startups?
- 24:38 Sorting out AI security without adding tools
- 28:04 "Stop messaging me on LinkedIn," and what works instead
- 33:28 How deals close: budget cycles, sunsetting, the CFO
- 39:09 Buying after a breach
- 41:00 Locked Up
- 43:31 Visionary or smoking crack
The Cyber Go-To-Market Talk is the show for cybersecurity sales leaders, founders, CROs, and go-to-market operators looking to improve cyber sales performance and build more predictable revenue growth. Hosted by Andrew Monaghan, founder of Unstoppable.do, covering cyber sales leadership, revenue leadership, sales onboarding, forecasting, pipeline generation, and cybersecurity go-to-market execution.
Follow me on LinkedIn for regular posts about growing your cybersecurity startup
Want to grow your revenue faster? Check out my cybersecurity sales consulting and training
Need ideas about how to grow your pipeline? Sign up for my newsletter.