A Product Market Fit Show | Startup Podcast for Founders
00:03:27 · Pablo Srugo
[00:03:27] S2: I'm curious to undertake on this, but I think it's a good story to pull on, right? Because product market fit is hard to define. It's easy for somebody to say, I have product market fit and then you get into it. And you try, and figure out, do you, do you not? And you can have ten people with ten opinions. But in this particular case, it's like, what is the most important thing for a CIO, right? What rises to the top of their pile? I think my formula, especially in B2B, is whoever you're selling into, they need to have meaningful budget. They need to be important in that organization and you need to solve a number one or number two problem for them. If you're doing that consistently, that is an early indicator. Certainly that you're delivering value, but it's an early indicator of product market fit. Seems like that was the case here.
00:04:08 · Damien Lewke
[00:04:08] S0: Yeah, a hundred percent. I think like all founders, you got to take a bet, right? And we took a position two years ago that at some point, you would have threat actors that would do things that existing tools might have missed and we've been building towards that eventuality. And it was one of those things that the two kind of hit at the exact perfect time, and that's allowed us to prove that value to keep earning budget, and displacing solutions. Which is where we're at now as we scale and now validated by the Series A. I guess we'll go back a little bit because the journey to product market fit is a long and different one than you might expect. So, I've only ever worked in security. I was an operator in the defense industrial base here in the United States. I was fortunate to work at CrowdStrike, you know, from the CRC through and after the IPO. So I got to see hyper growth, was fortunate then to do some grad school and study at MIT's computer science AI lab, and then work in a security operations company. But basically, cyber is my jam and all of that informed my initial thesis about the company. But actually, it's been really formulated not just about my opinions, but constant customer discovery. Understanding, to your point, what your top two priorities are, what the real pain is, and how at first the idea. Now the platform that is Nebulock, can align with those and it really was a combination of. I mean, we're talking about constant calls, getting on planes, sitting with customers that got us to this point, and then. Honestly building an amazing team of practitioners, engineering, marketing, sales, and customer success leaders who really helped bring this enterprise to where it is today.
00:05:45 · Pablo Srugo
[00:05:45] S2: Well, maybe then let's go through the story. You know, how you shared a little bit of your background. Obviously you've been in cybersecurity for a while. Cybersecurity is a weird one from the outside in, right? I'm no cyber expert, but I've spoken to quite a few cybersecurity founders and it's like, it just always sounds like the same thing. We find the thing that nobody else finds, right? And you're like, don't they find the thing that I thought that, you know? So, and I get it's a cat and mouse, I get constantly evolving. There's constantly new threats. But I don't know even how you could do this for an outsider, like you're in the game, you're in it. What do you see that is a gap that nobody else is solving? And why is it a gap? Try and give that context. And we could get into what you did, and how you turned that into a business.
00:06:26 · Damien Lewke
[00:06:26] S0: A hundred percent, so Pablo, you touched on it perfectly, right? Where you're like we catch the things that other people don't catch, it's constantly evolving and really what that implies, my friend, is reactivity. And the challenge with security in general, and this is no fault of our customers or existing vendors but it is an inherently reactive game. We are waiting for the alarm bells to go off to take action and because bad guys innovate faster than we might be able to build something that catches them, we're constantly backpedaling. So the real focus for us was to go back to first principles and ask ourselves, how would you build a proactive by default system? So cybersecurity is all about identifying a bad thing that's happening, validating that that thing has happened, and then informing teams what to do about it. And our whole thought process was, instead of waiting for other systems to tell us stuff that's gone wrong, we know where the gaps are. Let's build a system that continuously looks for things that might have been missed and then, does that validation and information response to teams. So the whole focus was to be proactive by default and that has served us quite well in our growth.
00:07:33 · Pablo Srugo
[00:07:33] S2: I get the idea, but again, even that. Like Huntress, I don't remember telling me, I spoke with Kyle back then. I think he was telling me, you know, proactive, find it before it happens, these sort of things. Maybe we get to have maybe an example. I know these things are very specific, so it's hard to maybe do. But an example of something that they would catch here, but you caught there, or you would catch there. At least under this kind of thesis.
00:07:51 · Damien Lewke
[00:07:51] S0: Yeah, no, it's a great question. Huntress is an amazing company. I was fortunate to spend a little bit of time working at ForgePoint, which invested in Huntress. So really big respect for the ForgePoint team and Huntress. Yeah, I think there are three key examples I can give you. The first is, if you think about existing systems. Especially if you are running in a customer's environment, you have to balance like, do I detect all the things or do I detect what I'm good at? Because if I detect all the things, I promise you, because no two enterprise environments are the same. You're going to lead to a bunch of false positives. So every vendor has to run this very fine Pareto front of finding the optimal space. Which again, if I'm starting to cut stuff at some point, I'm going to miss things. So the real example here is, we'll focus on something topical like OpenClaw. So when OpenClaw first deployed, came out, right? Really exciting, cool productivity piece, nightmare for security teams. What we were able to do that no other system could was, we'd actually built some really comprehensive machine learning models around command line investigation and in GenSec systems, as it just so would happen, run command lines. So out of the box, as soon as OpenClaw hit the market, we were able to start detecting what OpenClaw was doing. More importantly, because we could also understand the intent of these command lines. We could actually see when the OpenClaw agent wasn't doing things like it should, like catching an OpenClaw agent touching a production DB. Which it should not have had access to, and being able to trace back, how and why it was able to create the accounts to access that. So that's a great example, right? The second piece really is focusing on what we call the telemetry, right? The raw data itself. So most security vendors, right? Back to that Pareto front, generate detections, they'll generate alerts but because they can't catch everything, there's this whole swath of data that is undiscovered, right? That doesn't really remain touched and our whole process is to constantly look at that data and go, what might be amiss, and use data inputs like context from the customer organization, right? They can upload a threat model or intelligence, right? What are bad actors doing with existing tools that are running on this system?