Why This CISO Buys From Cyber Startups First - Zach Lewis, CISO @ University of Health Sciences and Pharmacy

[00:00:00] [SPEAKER_00] This episode is brought to you by FastRamp2Revenue, the done-for-you new hire sales program built exclusively for cybersecurity companies. We bring the process, the frameworks, the training and the coaching, you bring your content, and we customize everything for your market and for your company and run the entire program for you. You don't have to pull a single person off your team to do it. Proven at over 15 cybersecurity companies? Get your new reps selling faster.

[00:00:28] [SPEAKER_00] Visit unstoppable.do to learn more. There are some buyers and some CISOs out there that will take an unproven product from a startup and use it to protect their company in their security stack. And there's some that will even commit to doing a multi-year deal with companies with just a few employees and a little bit of funding. The trouble on the go-to-market side is we don't get to see exactly how that call gets made.

[00:00:56] [SPEAKER_00] You know, sometimes we get the answer, yeah, we'll take a look at your stuff and sometimes even they might buy things as well. More often though, we get silence. We get silence from our outreach and we never really hear what goes on behind the scenes. Zach Lewis has made that call many times. He's the CIO and the CISO at a university in St. Louis here in the US. He was the first customer at a DLP startup. He was inside the first 10 customers for a DSPN company.

[00:01:25] [SPEAKER_00] He was very early in an email product that disrupted the legacy players out there. And he was within the first few customers of an enterprise browser company. And by the way, in the episode, he names not only the companies, but exactly how he got involved with them and what he did. Three more things to watch out for in this episode. What Zach needs to hear and see from a startup for him to want to work with them early on.

[00:01:50] [SPEAKER_00] Zach gets 10 to 20 LinkedIn pitches a day. And in seven years, he thinks he might have replied to as many as three of them. So he also talks about how to get in front of innovative CISOs like him. And he talks about what he has to switch off inside his own environment before he can say yes to you as a startup. Here's Zach.

[00:02:21] [SPEAKER_01] Well, Zach, welcome to the podcast. Andrew, thanks for having me. I'm happy to be here. This is a little bit different than my normal podcast appearance. I'm glad we can dive into some go-to-market stuff.

[00:02:31] [SPEAKER_00] Well, yeah, it's different for me, too. This is the first time we've had a real live CIO and a CISO on the call. So I'm exploring you, Andrew Monaghan, myself. Totally different conversation than usual. So this should be really interesting. Yeah, we'll try to keep it so. Let's dive in. Yeah, for some of the challenges, it's got to be interesting, right? First of all, though, the first thing we have to do is you have to spin the wheel.

[00:02:57] [SPEAKER_00] And to remind everyone, there's five categories. We've got overrated or underrated. We've got the cyber donut hot seat. Third one is it's personal. Another one called visionary or smoking crack. And the final one is differentiation tear down. And we're going to spin the wheel and I'll find out what questions I'll ask you at the end of the podcast. You ready to go?

[00:03:19] [SPEAKER_01] Do it.

[00:03:25] [SPEAKER_00] We are on visionary or smoking crack. One of my favorite ones. I first did this at Black Hat. No, RSA a couple of years ago. And got some interesting responses from people around this. So we'll get forward to that. But we'll do that towards the end, Zach. We won't do that right now. Okay. Awesome. All right. So what I noticed about your background is just over a year ago, you started working with Glilot Venture Partners as a venture advisor. How did you get into that world? How is that something that you wanted to do?

[00:03:54] [SPEAKER_01] Yeah. So I'm in St. Louis and the cybersecurity community here is really tight. And we almost go by what we call ourselves a cyber mafia, the St. Louis cyber mafia. And we're known all over the country for being really active in startups and the VC stuff. So a lot of my peers are very plugged into the VC network.

[00:04:14] [SPEAKER_01] And they know every startup coming out. They know if you're looking for a solution, they know a company either in stealth or just coming out of stealth that can kind of fix that problem for you. So I started meeting them. I got introduced to more companies. Eventually, I started doing some design partnership with a company in stealth. And then one of their VCs ended up being Glilot. And they brought me in and been sort of advising in a limited capacity when I have time for them.

[00:04:43] [SPEAKER_01] But then with the VC, I was doing some design or with the startup, I was doing some design partnership with. And since then, we've brought them on as a customer. We were their first customer and they came out of stealth and we've been very happy.

[00:04:55] [SPEAKER_00] What's most of the work you do when you're advising? Is advising on to the CEO and the CTO or some other part of it?

[00:05:03] [SPEAKER_01] There's a lot of different tiers. So for a lot of us, the advisors, we just come on, we get on calls, you know, a couple times a month and look at various stealth companies, various startups that are getting ready to come out of stealth to see if Glilot is something they want to invest in, a product we might be interested in. Do we think the product they're building is sort of worth it, useful? And we might give rankings or feedback to them on what's good. And then also if we think it's worth investing in or worth providing something.

[00:05:31] [SPEAKER_01] Now, there's another tier where they may need some cybersecurity expertise, some IT expertise. And one of the advisors may go on to become sort of like a virtual CISO or interim CISO or something. And a few people have gone on to become full-time CISOs there as well. So it really depends on the need and your availability and time and what you put into it.

[00:05:52] [SPEAKER_00] Are there any companies you can say, I was asked about and they've come out of stealth and they're now doing well?

[00:05:57] [SPEAKER_01] Well, so probably the most recent one was called Jazz DLP. I did some design partnership with them and picked them up as a customer. And then they went on to win the RSA Sandbox, Startup Sandbox, is the big winner of the year for this year. And they're starting to pop up all over the place. So I've been pretty happy with them. They got a great product.

[00:06:17] [SPEAKER_00] You know, it's interesting. I saw something today. Mike, who sends out the venture or the industry investment newsletter every Monday, he did an analysis of all the Sandbox winners. Well, all the ones that are finalists and then who the winners were and saw what happened to them. It's remarkable the success that the finalists actually have over the years.

[00:06:39] [SPEAKER_01] Yeah, it's pretty cool. I know we've picked up, I mean, we've picked up so many startups at the university where I'm at, but a couple of those went on to become unicorns. And I was actually talking to one that we haven't picked up yet, but we were in talks just last night who was the first company in stealth to become a unicorn. I was like, oh man, it's like the market's filled with money and filled with companies. So you got to try to find a good one.

[00:07:05] [SPEAKER_01] And eventually you go to, like I was in Black Hat recently and there's hundreds of these companies and they all, a lot of them sell the same thing. And you just think like, man, six months, this whole group is going to collapse down and like one company will have like three or four of these. So you got to kind of pick the right one that you think is going to stand the test of time.

[00:07:24] [SPEAKER_00] Yeah, that must be so hard to do. Yeah, it's Mike Pervetto as the newsletter, Return on Security. It's awesome. He's done, I don't know, he's up to episode or edition number 257 or something by now. It's really impressive what he's built right there. Let's go back to, you know, when you're talking to the startup for the first time, I'm really interested. You know, they come on, they must tell you what they do.

[00:07:46] [SPEAKER_00] What tells you, what were you looking for in the first half hour to try and figure out, is this a company that I might actually want to, you know, work with, do some business with, might actually want to use their tool if it comes through?

[00:07:57] [SPEAKER_01] Yeah, so I get approached a couple different ways. It can be through the VC advisory stuff. It can also be just like cold call type things that happen. I get a lot of outreach on LinkedIn and emails. I'm shocked, Zach. I'm totally shocked. I can't believe it. Non-stop, non-stop. And I think what, I mean, what I'm looking for is if I have a problem, I need it solved. And frankly, not every startup obviously is going to be able to solve a problem that I have.

[00:08:25] [SPEAKER_01] They might tell someone else's problem, but it might not stick for me. So I have, you know, in my head or at any given time, a few pain points. And if someone does the right sort of pitch or fits into the right niche that I need something fixed in, you know, I'll explore that conversation. We'll dive a little deeper and we'll see where things go. But, you know, I'm not looking for, you know, hey, I have this problem. Well, we can fix this part of it or we can fix this section of it or this tangent. Now I need the whole sort of thing fixed.

[00:08:52] [SPEAKER_01] So that's when I'll go and really dive in with some of them and see. And that's what's nice about startups too is that they'll kind of customize things for you. If you're an early customer, they'll build and you can get what you sort of want. But, you know, really looking at fixing a whole problem that I have and not just little parts of it.

[00:09:08] [SPEAKER_00] And I would imagine though, you know, as startups come through, they probably don't solve the whole problem out of the gate, right? It must be really hard for them to do that because they wouldn't have been developing a product for a year or two, right? So how do you assess, you know, if they got the right vision, are they going around the right track? How do you look at that?

[00:09:23] [SPEAKER_01] Yeah, a lot of conversation. So when I do like design partnership work, I'll work with a company. They'll give me their most minimum viable product, their MVP, and we'll kind of look at what it does. And then I'll say, well, you know, can we get reporting? Can it do this to the endpoint, the computer? Can it send emails? And, you know, we just kind of work through the different feature sets that, you know, I know I would like to see from my standpoint, what my team would like to see. They start building those in.

[00:09:49] [SPEAKER_01] And then we just keep expanding sort of the scope of that project till it really encompasses like a whole problem. And we might sit down and, you know, when they just have a rough outline and a PowerPoint of what a product might be. And we'll dive into some problem areas that they're trying to solve. And we'll say for DLP, for instance, I remember whiteboarding with them and being like, well, we have data. And so for those listening, DLP is data loss prevention. We have data.

[00:10:13] [SPEAKER_01] And, you know, sometimes people might take it and put it in a Google Drive or a Dropbox or something that's not approved by our organization. I need to know when that happens. I need to be able to stop that. But I also might just want to nudge people like here. Those are three use cases right there that we need to build into the platform. How are we going to notify the IT team or the security team that this is happening? How do we nudge? What should it say? Should we customize that nudge? What are all the platforms that you need to know about? And how are we going to tie that data back in? What do we want to see on the dashboard?

[00:10:43] [SPEAKER_01] How does it look like? Let's draw that out and just really conversation after conversation after conversation as we build up that technology, really.

[00:10:50] [SPEAKER_00] And are you looking or how much are you looking at the team and how they engage with you as well beyond just the product?

[00:10:58] [SPEAKER_01] Yeah. So usually early on, you know, these companies have three, four people. So you meet the team pretty quickly. And the whole team comes on, right? Yeah. The whole team's there. CEO, CTO, you know, everyone has a chief title. They're developing something and then they start bringing in more people. So I want to see growth over that time period. These conversations are happening over weeks to months. So we need to see that team growing. They might not have any customers yet. You know, we're still in design. We're still in stealth.

[00:11:26] [SPEAKER_01] But we need to see that team scaling some, the product coming along pretty quickly. And then when it's ready to go to market, like, all right, how many customers did we grab? All right, we got one in the first week. We're at 10 by week, you know, two, you know, whatever that might be. And make sure the team's still scaling with that. They're still doing development work. They're coming up with some of their own ideas. And we're just sort of playtesting those out in the environment. But we want to see growth and we want them to see scaling pretty quickly.

[00:11:53] [SPEAKER_00] Are there companies that, based on your feedback, you feel like they've gone a different direction or they've decided not to do what they were going to do?

[00:12:00] [SPEAKER_01] I don't, none jump out. I mean, they all, most companies have an idea of what they want to do. And I think that I did changes over time based on the feedback they're getting from different design partners and customers that they're talking to. The market moves very quickly right now, especially with everything in AI. And you have to be very nimble, very agile and be able to change that perspective. Because if you're, you know, pushing a product that, you know, the market's not interested in anymore, you don't have CISOs that are interested in anymore.

[00:12:30] [SPEAKER_01] It's not going to sell. Again, going back to solving that problem. You want to find a problem that a lot of people have. If I have it, there's probably others that have it. And we need to sort of gauge how big of an issue that is. So right now we're seeing a lot of stuff. I mean, and a lot, a lot of stuff around AI and like shadow AI and people using it for everything. So, you know, you kind of go and I think every, almost every one out of probably two out of every three.

[00:12:55] [SPEAKER_01] Because companies I see are doing something in that space to find your shadow AI and put a stop to it. Because it is a problem for a lot of CISOs and a lot of organizations. So everyone's just running to that.

[00:13:07] [SPEAKER_00] Yeah, that must be challenging when everyone claims the same thing. We'll come back to that actually a little bit. But so I'm actually kind of interested about maybe not jazz itself, but DLP, right? So when I think about DLP in this context, I would say two things I think about. One is a very old concept that people kind of got fed up with 10 years ago because it didn't work that well. It was pattern matching and not very accurate. And I don't know, there's a lot of black eyes, let's say, about people who tried to make DLP work.

[00:13:33] [SPEAKER_00] And then secondly, DLP, if you're actually doing the P and not just looking at the alerts, right? You can get in the way of business, right? You can stop things from happening. It's the whole idea of it. So your accuracy and things like that becomes very important. So I'm trying to wonder, like, you know, your risk appetite, you bringing them in and say, that's okay. We're going to do that. Even though it's a young company, it's okay for us to do that. I'm kind of fascinated by how you would decide that.

[00:13:58] [SPEAKER_01] Yeah, so historically, yes. Legacy DLP and Jazz will be the first to tell you that it sucks. It always has sucked. And so they're doing things a little bit differently where there's a small agent it runs on, a laptop, desktop, endpoint, whatever. And then it actually uses, Jazz uses AI to understand the context, the content, but also the intent of the user. Like, what are they trying to do? Is this malicious? Is this incompetence? And alert on it.

[00:14:25] [SPEAKER_01] And you can talk to the AI and say, hey, I don't want to see, you know, we might get alerts on people updating their resume. Well, hey, I don't want to see that. Yeah, they might be job hunting, but I in security right now, I don't want to know that. So, hey, AI, don't show me any more alerts about people updating resumes. And we won't get any more. And that trims out those alerts. Or, hey, I want to really pay attention to these few users. They're giving their notice and they deal with sensitive information. I want to make sure none of that leaves. So it'll give them a little bit more scrutiny or something like that.

[00:14:55] [SPEAKER_01] And we can do different sort of scoping things by just talking to the AI. And it goes out and provides that data back to us in a real-time alert, which is pretty cool. I haven't seen anything like it. So that is really helping. And the prevention piece, since that agent is on the endpoint, if they go and say, hey, I don't want anyone putting anything into DeepSeq. Or I don't want you uploading any documents that have a restricted label on it to your personal Google Drive.

[00:15:22] [SPEAKER_01] That agent will hard stop that activity from happening. It will recognize what's going on. It can see the URLs. It can see the software use. And it'll just hard stop it and pop up a message and say, you're not allowed to do that. So it's been pretty successful for us. And what I like about it is rolling into an environment. If people come back to you and you're like, hey, I can't do this. And it's like, well, yeah. What are you trying to do? There's a reason why that's blocked.

[00:15:47] [SPEAKER_01] So, so far, we haven't had any red flags where people have pushed back too hard on being blocked on something and not being able to do it. Either it happened and they're like, I shouldn't do that. And they didn't want anyone else to know. So they kept quiet. We'll take it.

[00:16:00] [SPEAKER_00] Yeah, I mean, it sounds like they've really advanced the whole thinking around DLP over the years, which is awesome. I'm thinking, you know, there will be not just CISOs, but there will be organizations that don't have the appetite to work with early stage companies. It's just not something that they want to do. And if they do, maybe they might pick something except for DLP, something that's not a critical path, right? And say, let's test something there. So let's talk to some of that.

[00:16:25] [SPEAKER_00] So what is it about Zach Lewis that says, you know, I want to spend the time with these other stage companies. I really think on the risk that maybe some of them might not pan out or their product might not work as well as it should. But you're willing to do that.

[00:16:39] [SPEAKER_01] Yeah, I think one of the first startup companies we brought on board was an email security startup. And we were looking, there were a couple of players in the world at this point. I call it advanced AI security, not your traditional, we'll call them SEGs. So email gateways, like things like, no disrespect to any of these companies out here. Like your Barracudas, your Mimecasts, your Proofpoints. These are named, these are, I'll call them legacy players. They've been around a long time.

[00:17:07] [SPEAKER_01] They're your traditional email security platforms. We were having some difficulty blocking different types of phishing emails. We're just getting a lot through and we needed something that was advanced. And so there were a few big startups on that had just come out making waves. We looked at those. It was cool. They were still, they were startups, but they were like further along in their journey. So they were pulling in quite a few customers and money. So the pricing was kind of going up and I ended up running into a startup that did something very similar. They were very, very new out of stealth.

[00:17:36] [SPEAKER_01] And it also made their, their platform was very, very cheap because they were just trying to get customers. So we adopted, we were probably sub 10 customer for them. They showed up proof of concept, which is, is a great, I do proof of concepts with all of these. I do several proof of concepts with different startups, some really long, some short, depending on what we're looking at. But we probably did one that lasted about a month. We virtually saw no phishing emails getting through. They threw out a great price point.

[00:18:02] [SPEAKER_01] So we adopted them and we reigned with them for four years. And it was great. Best email security product I've ever seen. They actually just got bought by a much, much larger company. So we're going to see how things shake out for them in the future now. But I mean, it was phenomenal and we loved it. And so with the success of that one, we're like, all right, well, there's something there. Let's, let's, let's see what else is out there. What other needs do we have? So every time we go out and try to find something that, that fixes a problem for us, we, we go to the startup community almost,

[00:18:31] [SPEAKER_01] I wouldn't say almost 100% exclusively, but quite a, quite a bit. So, I mean, we picked up automated pen testing tools very early. We were sub 10 customer for DSPM called Concentric AI. We were a very early customer of Island Enterprise Browser. Just, just loads of these startups that they come out and we're like, yes, this fixes a problem. Let's grab in and let's go.

[00:18:54] [SPEAKER_00] So the starting point for you is we do actually have a gap that we need to fill, right? And you like the idea that you can help them with the roadmap that's going to help you with what you need, right? And also the price point, you mentioned that you get a decent price, right?

[00:19:08] [SPEAKER_01] Yeah. I mean, education, we don't have a ton of money, not a lot of budget. So if we can negotiate with, you know, we negotiate with a startup, we get a good price because they're looking for customers. They need to show, you know, they can get customers and retain customers. If they have a good product, we've sussed it out over a POV, proof of concept, proof of value. And it's working really well. We'll, we'll go in, we'll negotiate that price down to a good point since we're early. They want to give us a discount for being a good customer. And then we'll lock it in with a three year.

[00:19:35] [SPEAKER_01] I've done a five year on a couple startups just because we want to lock in that low pricing. We think we've got a good product. They're happy to have that, that long-term revenue that's going to come in from us. So it's a, it's a win-win for, for everybody. But yeah, and, and that's, I get great products that are going to keep developing and get better. They're going to serve me. I can talk to them about issues. I need things I need fixed and they'll build those features into it within a, within a few weeks typically. And then I, my product just gets better and better over the years.

[00:20:02] [SPEAKER_00] And do you find yourself having to spend a lot more time though, with these early stage companies? It's not like buying some software and then making it work and away you go, right?

[00:20:10] [SPEAKER_01] You know, thinking back to the, the email security, when I touched, they, they didn't have a ton of bells and whistles in the platform. And I didn't want a bunch of bells and whistles because I don't want to be in the, these pieces of software all the time. So it was a very minimal product that worked. And I think the only time I ever got into that platform was when they reached out and wanted to have like a meeting to see how things were going. Like once a quarter or something. And I'd be like, oh yeah, let me log in there. I haven't been in there in three months, but, but it worked. And that's what, that's what I'm looking for.

[00:20:38] [SPEAKER_01] So there's a couple of products like our DSPM concentric AI, that data posture security management. So it's a way to sort of classify, categorize, label data, find where your data is, who's accessing it, what they're doing. We do a lot of stuff around data at the university. And I think that's an important security pillar. So I throw a lot of budget towards it. But so with them, I meet with them every two weeks and it's not so much that it's work. It's, it's that they give me a partial employee, a partial FTE.

[00:21:07] [SPEAKER_01] So I meet with them and I say, Hey, these are the things I'm trying to knock out in these next two weeks. I want to track all the data, you know, and marketing and HR, and I need to tag this and let's get rid of duplicates in this bucket. And they take notes. We work with me on a strategy and then they go out and actually do the work. So my team doesn't have to. And then in two weeks we meet back up and they're like, Hey, we got this done. We got this done. We ran into this issue. Are you okay with it? I'm like, oh, okay. So we just meet like that regularly, but they're doing work for me. It's like having a remote team member and I'm fine with that. That's awesome.

[00:21:37] [SPEAKER_01] We can get in there and do stuff if we want, but that's, that's one that's a little bit more touch and go. You know, Island was a lot of setup upfront. We were spending a lot of time in the platform at the beginning, just building out our, our dashboards and our user interfaces and what people were going to see from the enterprise browser. We wanted that transition since, since that one touched a lot more end users.

[00:21:57] [SPEAKER_01] We needed to spend more time with it, make sure the end user understood, provide more training material, made it a really sort of seamless process because we were changing a lot of people's workflows. But now that it's in place, we hardly ever go into it because it's, it's all customized setup and it's just running. So it depends, you know, automated pen testing tool. I run pen tests every week. They're set on a schedule, but we still go in and we look at them. What are the results? What happened? Do we need to fix anything?

[00:22:24] [SPEAKER_01] So it depends on the platform that you bring in and how much touch you have to do with them.

[00:22:28] [SPEAKER_00] So it sounds like you get a lot of benefit out of doing it. I'm wondering though, do you get pushback from other parts of the organization saying, do we really have to work the startup to do this? You know, is this company going to be around in six months or a year?

[00:22:40] [SPEAKER_01] Not, not really. I, you know, at the beginning, I think being the first email security platform we brought in, I don't think anyone even really knew they were a startup nor, nor did they care. I think this was pretty new for the rest of the organization. It's not something they thought about, you know, like IT is just bringing solutions. And, and from a startup standpoint, a lot of security tools, the end user is not going to even know really what we're, what we're bringing in. And I know our CFO and our COO and people I work with on, on acquisition stuff was very interested at a good price.

[00:23:10] [SPEAKER_01] So if I can get them a good price and I tell them it's going to work, they're kind of okay with that. But yeah, I've not had any real pushback from startups and the fact that they're startups. I can't think of any where I run into any problems.

[00:23:22] [SPEAKER_00] You mentioned AI security before, you know, like every company does AI security right now, apparently. But I'm curious how your team, well, let me phrase it like this, right? There aren't incumbents. There aren't the, the big companies already doing it. And some companies coming in, innovating a slightly different way, right? Everyone needs this right now. So how does your team evaluate, just give us an idea about how you look at it and go, okay, well, what do we do? We can go 25 different directions trying to do AI security, big topic, right?

[00:23:51] [SPEAKER_00] How do I, how do you guys assess, well, where do we start? How do we think about it? Where do we think the biggest threat is? What can you share with us around that?

[00:23:58] [SPEAKER_01] So we, we tried to evaluate what our, our end users are actually doing and in like how AI savvy they are. What are they trying to do with AI really? So what, what problem are we trying to solve for? Do we actually have a shadow AI problem? And if we do, is it, is it a real problem? Are people just using it to, to chat with and get feedback? Are students, you know, putting questions in there and getting answers back? Are we putting sensitive data in there? Okay. Let's run through a couple of these.

[00:24:26] [SPEAKER_01] Do we have controls in place for some of these problems already? When we look at the data piece, you know, we license, we, we, we, we categorize all of our data. So it all has a label on it. Um, those labels have different restrictions and we use our DSPM and our DLP tool in conjunction to sort of put controls around that. So I, I can use jazz in this instance to say, Hey, I don't want anything that's labeled confidential to go into any AIs, whether it's chat GBT or deep seek or copilot or whatever. And we can put blocks on that.

[00:24:56] [SPEAKER_01] So it doesn't go, okay, that kind of fixes that problem. Do we care about students uploading answers or questions? I mean, do I sort of, I mean, faculty probably care more, but also maybe don't leave your, your exams out for people to get the, the answers to. So I don't know if that's the problem where the security team is here to fix. So I'm going to mark that one off, you know, ancillary use. Okay. And we just kind of work through a bunch of different problem sets to figure out what the real issue is and if we need a fix for that.

[00:25:25] [SPEAKER_01] If, if there are issues in there, do we have the tools in place that can do it? Do we just need to add a couple of different controls? Can the enterprise browser help? Can the DLP help in conjunction? Do we get where we need to go or is there just a gap there that we need to bring in another tool for? And that's kind of how we assess things with AI security. And, and we haven't had to bring in anything other than we're, I mean, we're running everything through Inter Island and, and, and jazz and then labeling.

[00:25:49] [SPEAKER_01] And stuff with concentric AI, we feel like we have a pretty good platform in place to keep any sort of weird shadow AI miscreant work from happening.

[00:25:57] [SPEAKER_00] But your default is definitely, what do we have that's going to plug these gaps right now that we don't have to, you know, go and do something vastly different for, right?

[00:26:05] [SPEAKER_01] Yeah, we, we don't want tool sprawl or tool fatigue. You know, I, I don't have a huge team. We have a fair amount of tools, but I think in security we're, we're right, right sized. And, you know, if I got to bring on another one, that's, that's another dashboard. Someone has to look at, that's another alert. Someone has to go into another configuration. So is it really needed? If it's truly needed, okay, we will do it. But, you know, bringing on another tool pulls, pulls work away from other stuff because it's another touch point. We got to look at it. It's another amount of work for someone else. So we were pretty specific when we have to bring something on board.

[00:26:35] [SPEAKER_00] Okay. If there's probably going to be early stage founders or go to market leaders listening to this, what would you say the way to approach someone like you is as a design partner or finding design partners? And what's some things that you just, you don't like seeing or you just wish they wish they wouldn't do?

[00:26:52] [SPEAKER_01] Stop messaging me on LinkedIn. You're killing LinkedIn. That AI slop has made LinkedIn unbearable. I, you know, I don't think I'm trying to think through. I think out of all the cold calls, cold emails, cold messaging, I have maybe responded to two or three in seven years, probably.

[00:27:16] [SPEAKER_01] And that's because the pitch really did fit a very niche thing I was looking for at that exact moment. And it just lined up. So that's not a very high percentage of likelihood when you, when you consider I probably get, I know this is not a joke. I probably get anywhere from 10 to 20 LinkedIn messages a day, connections or direct messages with someone, you know, telling me about their, their product. Not a joke, not an exaggeration. And I pick, you know, I've responded to three. And I think those, that three resulted in one.

[00:27:46] [SPEAKER_01] I think I purchased one. If you go all the way down, I didn't end up purchasing the other two. The, the place I've found the most stuff surprisingly is either like startup showcases, VC showcases or, or conferences. I go to a lot of events. I talk to, I talk to every vendor that I can. I can't do it at Black Hat, but, but local conferences, especially. I mean, I was at one yesterday and I think they had 12, 12 vendors, 12 sponsors. I talked to every single one of them because I want to know what they got going on.

[00:28:16] [SPEAKER_01] It might be a product I already know. They had my, have some new stuff. I'll go talk to them. I definitely swing by any booth. I don't recognize the name of, I just want to hear. And that gives me a good idea of where the market is, what problems people are facing. I, I don't have a need for most of them at the time, but I'll know if, if that changes, you know, we see, so as we change jobs frequently. It's about 18 to 24 months. So you never know where you're going to enter a new, new company and you have a new problem, right?

[00:28:39] [SPEAKER_01] You might bring in some of your, your previous stuff, but you might have new issues, new, new industries and got to solve new, new problems. So I like to know everything. I know not all, not all CISOs will go through at a, at a conference and talk to everybody, but that's kind of what I do. But the VC showcases, we do a thing here. So this, again, CISO community is very tight. One of our big companies in St. Louis is like Centene and we'll do a big startup showcase there maybe once every six months or something. And we'll block out a whole day.

[00:29:08] [SPEAKER_01] We'll bring in four, five, six different startups and they can come in and they can pitch to us about a room full of CISOs. What their product's doing, you know, what their customer base is, what they're looking to do, what their interest is, blah, blah, blah, blah, blah. We'll ask them questions. If they have a proof of concept, we'll see it. We can poke holes at it and see what's going on. They can go back out and then refine their products. So we find a lot of cool stuff there. That's that. And just talking to our CISO community, you know, I mentioned this chat, I have a signal chat.

[00:29:36] [SPEAKER_01] And I'll go in there and be like, hey, you know, we need this issue. We have this issue. Do you guys do anything about it? Or someone will be like, have you heard of this company? Do you know how to get in touch with them? And we just share that information back and forth. That's really how we do it. We go to a lot of dinners. Startups will come in and host a dinner and we'll get 10, 15, 20 CISOs there and give us a brief pitch. And then we just, you know, eat some steak or something. You know, I'm not trying to say that we just, you have to give us something to get a meeting. But I mean, we're inundated with calls and messaging and stuff.

[00:30:05] [SPEAKER_01] So if you can get into one of these little groups and pitch to us or talk to us with some of our peers, we're a lot more receptive at that point, I would say.

[00:30:14] [SPEAKER_00] No, I like that a lot. I mean, I think we hear on the go-to-market side about these single chats and Slack channels that we don't get access to, which is great, right? You need to have that safe zone you can chat to. But it's not all black and white, right? There's ways to try and get invited to things and try to get your name out there and things like that, right?

[00:30:34] [SPEAKER_01] Oh, yeah. If you know a CISO or have had good relations with a CISO, just reaching out to them and be like, hey, can you help us get together a dinner or a group of CISOs for an event? Or, you know, we've done, I mean, some startups have done some pretty cool stuff in the area for us and either going out, whether it's not food or maybe it's a movie screening or it's a shoot skeet, you know, with the shotguns or something. Like, we've done some pretty cool, like, off-the-wall stuff.

[00:31:01] [SPEAKER_01] There's also some different, like, companies you can partner with, organizations, ISACA, IC Square, InfraGard, different groups there. If you know someone there coming in and asking to do a pitch to them, you can get in front of some people, some decision makers there as well. I'd say that not as successful as some of the other stuff, but that is a different way, a little off-the-beaten path where you're just not cold messaging people. Yeah, I don't know. That's what comes to mind.

[00:31:26] [SPEAKER_00] Yeah, yeah. No, I appreciate that. One of the things that I hear in the go-to-market side a lot is, you know, we're working with a company, we're in a sales cycle with them. I just know there's a whole bunch of things going on behind the scenes that I just don't know what it is. There's conversations. There's, I don't know, what's the secret handshakes you all have behind the scenes. So I don't know if you give us a flavor of what we just don't see. Like, I don't know, the discussions, the conflicts, the different viewpoints, let's say. How does all that happen?

[00:31:55] [SPEAKER_01] Yeah, I mean, I'll speak from my experience, and it's obviously different for other places. But like, so if we have a need, and we've gone through everything, we've figured out which product we want, like we want to move forward, a few things come into play. Where are we at in the budget cycle? Education, we have a July 1 through June 30 sort of cycle. We do zero-cost budgeting internally, so we kind of start with what our number is, and we have all of our software pieces, we know what they're going to cost.

[00:32:24] [SPEAKER_01] And by the end of that budget, we want to be back at, you know, essentially zero flat. And so if you guys come on board, you know, I search around for a product, we find it, and we're in March or April. I probably don't have a lot of budget right now. Like, we're nearing that end of the cycle. I just don't have any money. And it's probably going to have to wait. Now, I've worked out deals with different groups where we started early, like, hey, we're going to give you a couple months free. We're not going to bill you until July or something. Like, you can finagle. That's something also nice about startups.

[00:32:53] [SPEAKER_01] You can finagle different deals like net 90 terms or three extra months free or something like that and just work it to get to that budget cycle. I also try to align almost all of my spend to my budget cycle. I want almost every contract I have to start on July 1 and then on June 30 for a year. My CFO loves me for it. And if I can give her that, she's actually super happy about that. So we try to keep the CFO happy. That's got to go on. Anytime I'm going to purchase something, I usually talk to the COO about it.

[00:33:22] [SPEAKER_01] Him and I work very closely on stuff. I report into him. So I'll be like, hey, we're looking at doing this. He's going to solve this problem. It's probably a problem he's aware about already. I'll tell him why. I'll tell him the price point. We have a pretty good idea of what we want to do. A lot of the times if I'm bringing on something, I have to sunset something. That's how I get budget. I don't get just every ask that I go in for, right? But if I can shift some numbers around and sunset a different product or squeeze a little. Savings out of here. I can usually make it work. But again, it all depends on that budget cycle and where we are in it.

[00:33:52] [SPEAKER_01] And that can be a sticking point early on. I might be able to allocate a little bit more. But yeah, late in the cycle, we're just waiting. Legal reviews, contracts. So it'll go through general counsel. He'll do his review. I'll do my review. We'll go back and forth on that some of the time. But I mean, outside of that, if I can get the COO on board and then we go in and pitch to the CFO and she's on board. And if it's a net neutral ask for the budget where I'm just decommissioning something and bringing something on, usually no issue with that.

[00:34:21] [SPEAKER_01] It's some of those net US or if I need an extra five or 10 grand or something like that. Like, hey, I got to go to this is what we're fixing for. Here's our return. This is what it's going to look like. I got you that aligned up to the fiscal year. You know, whatever else I need to do. We got a great deal because we did a multi-year. They're not going to raise rates. Usually I can get that pitch done. So and once I get the green light from her, it's solid from there. But that's how most of our process works.

[00:34:46] [SPEAKER_00] And with your COO and your CFO, do you feel like you align the justification to purchase to something the university cares about? Like it's some big strategy thing or is it that they just kind of get that these are going to be security things that you have to do to mitigate risk?

[00:35:01] [SPEAKER_01] I usually align it to strategy of the university. OK. You know, something we're planning on doing. I think if I just come in with an ask for an ask, it's like, oh, OK, I guess, you know, like they don't understand the value of it. And I want to make sure it's tied to something at the university. Security, you know, has to for the most part needs to be frictionless. I know that's not always possible, but we want something that we're going to be able to plug into the university. It's not going to interfere with how business runs.

[00:35:28] [SPEAKER_01] It's not going to interfere with how we make money, which is essentially educating the students. So if I can tie it to that where people aren't going to see anything, but maybe we can get more students or will they be more secure or data is not going to leak out or whatever, then all the better. And I would say also fortunately, this is a weird fortunately, but, you know, a few years back we had a ransomware attack. And I've spoken a lot about this and actually written a book on it.

[00:35:53] [SPEAKER_01] But I use that as a point of reference for a lot of these talks around security tools and things. And not so much as like a fear, uncertainty, doubt sort of pitch, but like, hey, you know, like that ransomware attack happened. We bought these products afterward and that fixed this problem, this problem. But if we had this, this wouldn't happen. Well, you know how much that would have cost? OK, well, if we do this, we can actually decrease that cost by this and that ransomware can't get in.

[00:36:18] [SPEAKER_01] Or, you know, whatever it is and just try to really pitch it in terms of a scenario, a story of why we're doing it, why it works for the strategy of the university and how much our return is going to be. Because it's hard to say like security is going to ever make the university money or make an organization money. But we're more of a revenue protector than a generator. So how are we ensuring that that revenue is still going to come in and not go out the door?

[00:36:41] [SPEAKER_00] Yeah, that ransomware thing is fascinating. I mean, every salesperson who's been running for a while has the story of the company that underinvested in security and can never make any progress. And suddenly something happens. The budget goes wide open. And sometimes they make rapid and rash decisions about what they really need to do to recover, right? It seems like it goes from one extreme to the other. It must be frustrating on your side. Maybe I don't know if you experience it where you are right now, but try. Well, how can I how can we get some more investment? Because I know this could happen, right? And then suddenly it happens.

[00:37:12] [SPEAKER_01] Yeah, I mean, for us at the beginning, it was we thought we had a pretty good program. And then and then we got hit and we were able to expand the budget and get a couple other tools. And I call those tools prior to the incident. They were like nice to have. So we just didn't have the money for it sitting around. But again, never let a good crisis go to waste. It happens. They free up a little bit more funds. You know, the board doesn't want something like this to happen again. You don't want to be in the news.

[00:37:37] [SPEAKER_01] You know, we got lucky in our situation and didn't have to like pay a ransom or we didn't lose a lot of sensitive stuff. And that could be very different the next time. So how do we make sure it happens? And these companies sometimes go in. They go a little too hard and they buy way too many things. Again, you get tool fatigue, tool sprawl. I think you need to be very precise. Like what again, what problem are we solving for? Let's bring it in. Do we have the bandwidth for it?

[00:38:01] [SPEAKER_01] If it doesn't make sense, if you get $5,000 a day and the team can only read 500, there's 4,500 out there that you're missing. No one's ever going to look at. So it's irrelevant, right? Like that tool's not serving a great purpose. So be very specific, almost like a scalpel with that on what you're bringing in. And just make sure that the attack doesn't happen from the same entry point again after you've asked for tools. You don't want to get hit the same way because that's not going to look good. That's not going to look good, no. Tell us about your book. The book. So the book is called Locked Up.

[00:38:30] [SPEAKER_01] It is a real story, true story of a ransomware attack from the group Locked Up, which was the most prolific ransomware attackers, threat actors of the 2022, 2023 era. In 2024, they were taken down by the FBI. A couple of their members were indicted. A couple were arrested. But essentially, they operate out of Russia. They were a nasty group that had a compromised Boeing and TSMC and the Ministry of Defense and all sorts of big companies. So you're in great company.

[00:39:00] [SPEAKER_01] Yeah, we didn't stand much of a chance. But it just shows like it doesn't matter really how big you are or what your budget is. Like you can still get hit by this group or any of the groups, frankly. And so we got hit and the story Locked Up is all about everything that about our environment beforehand, where we built, where we were at, why we were at that stage. Then we get hit and I talk about everything that goes into decision making, the recovery, why we decided to do what we did and conversations that happened around it to everything that happened after the incident.

[00:39:28] [SPEAKER_01] What sort of software we brought in, why we brought it in, how our users handled it, just the emotional toll, the mental toll, everything that goes into some sort of cyber incident. There is nothing else like it on the market. I was pitched that to...

[00:39:41] [SPEAKER_00] No, I've never heard anything like this.

[00:39:43] [SPEAKER_01] Yeah, I pitched it to Wiley. Wiley loved it. They published it. They agreed nothing like it on the market. And the book sort of has gotten legs. It came out in January. It's sort of taken off. And a lot of people are reading and really enjoying it. So that's great. I'm very happy for them. I hope it helps the industry. There's this weird stigma about talking about your cyber incidents. And when you have attacks, people don't like to do it. It's sort of this like mark of shame thing.

[00:40:05] [SPEAKER_01] So trying to normalize it a little bit more, educate people on what it's like to live through one of these ransomware attacks and how to get through it and hopefully help the industry as a whole get better.

[00:40:14] [SPEAKER_00] Is it written for go-to-market people as well as technical people?

[00:40:17] [SPEAKER_01] It is. It is not a technical read. It is a narrative read. You're going to read it with characters of myself and my team and the university talking through stuff in conversation, talking about these decisions that are going on. Very, very high level in terms of technical detail. We explain anything that's a technical term. I have people like my mom who read it, understood it. So I think everyone's in good hands.

[00:40:42] [SPEAKER_00] That's the ultimate test right there. That's right. Well, Zach, let's go back to the spin the wheel and see what gets thrown up with these questions right here. So we span the wheel. So we go visionary or smoking crack. Let's look at the questions. All right. First one is by 2030, 80% of BTP purchases under 100K will happen without a human seller or buyer. It'll be AI agents buying and AI agents selling.

[00:41:10] [SPEAKER_00] Am I visionary by saying that or am I smoking crack?

[00:41:14] [SPEAKER_01] Man, that's a great question. Oh, I think you would be a super visionary if you're really predicting that's going to happen.

[00:41:22] [SPEAKER_00] That's a plain way of saying I'm smoking crack.

[00:41:24] [SPEAKER_01] Yeah, I don't think I don't think it's going to happen. But that is that's a nice visionary perspective on. I don't think we're going to be quite there yet. But definitely move in that direction.

[00:41:32] [SPEAKER_00] Let me ask you about this, though. So people in our world always talk about will salespeople get replaced by AI, right? My thought is that a lot depends on the buyer side of what you're willing to accept. Right. And, you know, would you make a 50K purchase? Would you make a 100K? Would you make a 2K purchase with an AI bought? Like, where's the line right now?

[00:41:52] [SPEAKER_01] I think letting an AI buy something, I think that line's very, very low right now. And I think that's part of the problem with all AI initiatives right now. If you look at the stats, most of them are failing in businesses. And I think it's I liken it back to even automation, like IT people and security. We love automation and we'll set up all the automation, but we just never turn it on. It's like it's all there, but we never just finally pull that final switch and let it run a lot of time because it's a trust factor.

[00:42:21] [SPEAKER_01] We're just not trusting yet of the technology. People are very comfortable in their workflows and their day to day lives. It's almost like an identity for them and how they do stuff. And when you want to take that away and change it and give it to something else that does it, even if you're not going to lose your job, like people still just get uncomfortable. You're shaking up their routine. And I think that's why a lot of these initiatives are failing. So, I mean, we're going to have to get there. I think the big companies will adopt.

[00:42:47] [SPEAKER_01] And as they adopt, there'll be that trickle down where then the large companies and the mediums and the smalls will eventually have to just to keep up with AI because AI is going to be everywhere, whether you want it to or not. It doesn't seem like there's anything to do about it. So adopt when you can. But I don't think you're going to see any big purchases being made. At least now, I can tell you from the university standpoint, they wouldn't be comfortable with a bot making $100,000 purchase.

[00:43:12] [SPEAKER_00] Yeah, I always feel like you never underestimate a human being's ability to try and stick with what they've been doing for a while, right? Yeah. And especially if there's big outcomes, big impacts, if you get it wrong. I'd be very worried if I was on your shoes. All right, let's go to the next one. The most successful cybersecurity salespeople in the next five years won't be salespeople. They'll be former security practitioners who also know the business of cyber really well. Am I visionary or am I smoking crack?

[00:43:41] [SPEAKER_01] Visionary.

[00:43:42] [SPEAKER_00] Tell me more.

[00:43:43] [SPEAKER_01] I think, so this goes back to a problem in the industry. I think there's a lot of burnout in the industry and we're seeing a lot of CISOs move from a true CISO role into more like a field CISO role. And they seem to be pretty happy. They still get to talk security and they get to pitch a product, usually one that they either were a purchaser of or they're familiar with. And they're getting in there and they're going to sell that to the masses. And they're finding out, hey, this isn't so bad.

[00:44:12] [SPEAKER_01] So I think as if burnout continues the way it is, CISOs are going to get tired and they get more stuff piled on them, especially with AI happening. Maybe they get outed by AI too and they need another gig.

[00:44:24] [SPEAKER_00] So real CISO, sales CISO, there it is. That's good. Fantastic. Just could be a salesperson a lot easier than the real job, right? Yeah. I do. I mean, I know it's always easy looking at a job going, oh, you know, it's always easier looking at it than actually doing the job. But it feels like to me, that's a great gig, right? You've earned your scars and black eyes and stripes for 20 years.

[00:44:47] [SPEAKER_00] And now you get the chance to go do something that's actually probably a lot of fun without all the downside that perhaps you have as a CISO.

[00:44:54] [SPEAKER_01] Yeah. Especially if you've worked your network too. If you know a lot of people and you were out there, you know, doing conferences, meeting people, and you're going to have an easy gig. Like the more people you know, like, yeah, go out there, introduce them to a product and do some sales, man. Yeah, you're going to crush it.

[00:45:10] [SPEAKER_00] All right. Last one. Third question. By 2030, only 10% leads will come from traditional outbound marketing. So I'm interested in your thoughts on this from your side.

[00:45:21] [SPEAKER_01] Again, probably visionary on this. It's probably true. I mean, a lot of stuff is, I mean, we see websites even changing right now for bot traffic, like just so AI and bots and agents can read it. But yeah, I mean, I think that's all going to change. The way we gather information on customers is going to change and how we pitch to them will change. I mean, definitely after they watch this episode, they're going to be like, yeah, change the whole thing. So we're going to make this a reality, I think.

[00:45:47] [SPEAKER_00] Well, I feel like there's something there, right? You mentioned before, right? You just get bombarded with what's called traditional ways, right? And, you know, as long as it's finite resources on the vendor side, you can't just keep doing that and try to scale something to actually work. So in terms of numbers.

[00:46:02] [SPEAKER_01] Yeah, you know, there's a saying where like threat actors will text you and they text you a number and they're like, hey, buddy, like, how's it going? Or you want to have the call with me? Or can you send me a gift card? And you get these things and you're like, there's no way this works. But at the end of the day, they keep doing it because it does work and it's working somewhere. So I don't know, maybe this cold outreach is working somewhere and that's why it keeps happening. But it's not working here.

[00:46:26] [SPEAKER_00] So let's chase it. There's always that one person somewhere that picks up the phone and suddenly it works. Cold calling works. Yes, we got them. Well, listen, Zach, it's been a lot of fun having you on. I really appreciate you joining us.

[00:46:37] [SPEAKER_01] No, thanks, Andrew. This was great. I love the change of pace for once. It was a good time. Thank you.

[00:46:41] [SPEAKER_00] If someone wants to get a hold of you, they don't message you on LinkedIn, right?

[00:46:45] [SPEAKER_01] If you don't want to sell to me, you can reach me on LinkedIn. If you do want to sell to me, I don't. I don't. Yeah, be creative, let's say.

[00:46:55] [SPEAKER_00] Be creative.

[00:46:55] [SPEAKER_01] See me at a conference.

[00:46:56] [SPEAKER_00] We'll do it there. And the books available in all the usual places?

[00:46:59] [SPEAKER_01] Barnes & Noble, Amazon, Books of Million, any place the books are sold, you can get locked up by Zach Lewis. Awesome. Well, Zach, thanks for joining us. Cool. Thanks, everybody.

[00:47:19] [SPEAKER_00] Hey, Andrew here. One last thing. If you enjoyed this episode, will you do me one small quick favor? And that's just send it to a friend. Simple as that. Your podcast player will have a share button somewhere. Click that and then text it, Slack it, email it, whatever is easiest for you to someone you know who you think might want to listen. That's the best way you can support this show. And I really appreciate you for doing this.