A Product Market Fit Show | Startup Podcast for Founders
00:04:08 · Damien Lewke
[00:04:08] S0: Yeah, a hundred percent. I think like all founders, you got to take a bet, right? And we took a position two years ago that at some point, you would have threat actors that would do things that existing tools might have missed and we've been building towards that eventuality. And it was one of those things that the two kind of hit at the exact perfect time, and that's allowed us to prove that value to keep earning budget, and displacing solutions. Which is where we're at now as we scale and now validated by the Series A. I guess we'll go back a little bit because the journey to product market fit is a long and different one than you might expect. So, I've only ever worked in security. I was an operator in the defense industrial base here in the United States. I was fortunate to work at CrowdStrike, you know, from the CRC through and after the IPO. So I got to see hyper growth, was fortunate then to do some grad school and study at MIT's computer science AI lab, and then work in a security operations company. But basically, cyber is my jam and all of that informed my initial thesis about the company. But actually, it's been really formulated not just about my opinions, but constant customer discovery. Understanding, to your point, what your top two priorities are, what the real pain is, and how at first the idea. Now the platform that is Nebulock, can align with those and it really was a combination of. I mean, we're talking about constant calls, getting on planes, sitting with customers that got us to this point, and then. Honestly building an amazing team of practitioners, engineering, marketing, sales, and customer success leaders who really helped bring this enterprise to where it is today.
00:05:45 · Pablo Srugo
[00:05:45] S2: Well, maybe then let's go through the story. You know, how you shared a little bit of your background. Obviously you've been in cybersecurity for a while. Cybersecurity is a weird one from the outside in, right? I'm no cyber expert, but I've spoken to quite a few cybersecurity founders and it's like, it just always sounds like the same thing. We find the thing that nobody else finds, right? And you're like, don't they find the thing that I thought that, you know? So, and I get it's a cat and mouse, I get constantly evolving. There's constantly new threats. But I don't know even how you could do this for an outsider, like you're in the game, you're in it. What do you see that is a gap that nobody else is solving? And why is it a gap? Try and give that context. And we could get into what you did, and how you turned that into a business.
00:06:26 · Damien Lewke
[00:06:26] S0: A hundred percent, so Pablo, you touched on it perfectly, right? Where you're like we catch the things that other people don't catch, it's constantly evolving and really what that implies, my friend, is reactivity. And the challenge with security in general, and this is no fault of our customers or existing vendors but it is an inherently reactive game. We are waiting for the alarm bells to go off to take action and because bad guys innovate faster than we might be able to build something that catches them, we're constantly backpedaling. So the real focus for us was to go back to first principles and ask ourselves, how would you build a proactive by default system? So cybersecurity is all about identifying a bad thing that's happening, validating that that thing has happened, and then informing teams what to do about it. And our whole thought process was, instead of waiting for other systems to tell us stuff that's gone wrong, we know where the gaps are. Let's build a system that continuously looks for things that might have been missed and then, does that validation and information response to teams. So the whole focus was to be proactive by default and that has served us quite well in our growth.
00:07:33 · Pablo Srugo
[00:07:33] S2: I get the idea, but again, even that. Like Huntress, I don't remember telling me, I spoke with Kyle back then. I think he was telling me, you know, proactive, find it before it happens, these sort of things. Maybe we get to have maybe an example. I know these things are very specific, so it's hard to maybe do. But an example of something that they would catch here, but you caught there, or you would catch there. At least under this kind of thesis.
00:07:51 · Damien Lewke
[00:07:51] S0: Yeah, no, it's a great question. Huntress is an amazing company. I was fortunate to spend a little bit of time working at ForgePoint, which invested in Huntress. So really big respect for the ForgePoint team and Huntress. Yeah, I think there are three key examples I can give you. The first is, if you think about existing systems. Especially if you are running in a customer's environment, you have to balance like, do I detect all the things or do I detect what I'm good at? Because if I detect all the things, I promise you, because no two enterprise environments are the same. You're going to lead to a bunch of false positives. So every vendor has to run this very fine Pareto front of finding the optimal space. Which again, if I'm starting to cut stuff at some point, I'm going to miss things. So the real example here is, we'll focus on something topical like OpenClaw. So when OpenClaw first deployed, came out, right? Really exciting, cool productivity piece, nightmare for security teams. What we were able to do that no other system could was, we'd actually built some really comprehensive machine learning models around command line investigation and in GenSec systems, as it just so would happen, run command lines. So out of the box, as soon as OpenClaw hit the market, we were able to start detecting what OpenClaw was doing. More importantly, because we could also understand the intent of these command lines. We could actually see when the OpenClaw agent wasn't doing things like it should, like catching an OpenClaw agent touching a production DB. Which it should not have had access to, and being able to trace back, how and why it was able to create the accounts to access that. So that's a great example, right? The second piece really is focusing on what we call the telemetry, right? The raw data itself. So most security vendors, right? Back to that Pareto front, generate detections, they'll generate alerts but because they can't catch everything, there's this whole swath of data that is undiscovered, right? That doesn't really remain touched and our whole process is to constantly look at that data and go, what might be amiss, and use data inputs like context from the customer organization, right? They can upload a threat model or intelligence, right? What are bad actors doing with existing tools that are running on this system?
00:10:00 · Damien Lewke, Pablo Srugo
And then finally, we've got a brilliant group of folks that do research and test, and build these agents. So we have these three new axes that surface things that otherwise might have gone missed and to that end, you know, over our company's lifecycle. We've run over three hundred million agentic investigations, and we've surfaced over four thousand active incidents that had otherwise gone missing. [00:10:23] S2: Is this like, and I'm always trying to simplify as much as possible. I understand the other point, which is if you flag everything, you're creating so much noise now. You're just lost in this all, you can't do it. So is this bringing AI to find the signal in that what normally is discarded as probably not relevant by more. Let's say, heuristic driven deterministic system, you're using agentic AI to say, let's look at that, you know, double, triple check it, and now pull out the signal out of it without all the noise that normally would come along. Is that a good frame of thinking about it? [00:10:23] S0: Pablo, that is the perfect way of thinking about it. [00:10:23] S2: Boom, there you go, there you go. [00:10:58] S0: It was amazing. [00:10:58] S2: That's it, that's why I'm here. [00:11:00] S0: Amazing. [00:11:01] S2: Oh, man. All right, cool. Well, I think at least I get it now. That's the good thing. That's, you know, one person gets it now. But so that's, I guess, the core idea. Maybe walk me through even just how you make the decision. This is what, 2024 at this point? Like mid-24? [00:11:14] S0: Yeah.