00:12:49 · Varun Badhwar, Siddhartha Ahluwalia
And so Nikesh was incredible at funding me and my team and giving me the opportunity to not just scale that team of 80 people up to eventually close to a thousand people in three years, but in that midst, we acquired nine other companies to fold them into the Red Lock architecture and really create this monster platform, which was for cloud security. And to a great degree, I'll take a little bit of credit for Wiz's success because we showed such a great acceleration of revenue and path that Wiz eventually and the founders there were building something else, pivoted to cloud security, got funding on the backs of Palo Alto Network's Prisma Cloud Success. And obviously, kudos to them. They've built uh you know a 32 billion outcome for themselves and the teams there. Did you angel invest in Wiz? No, I couldn't. I mean, it was a direct competitor to us. [00:13:40] S1: Got it. But but they started, I think, just at the time that you were leaving Palo Alto to start Endor? [00:13:48] S0: They started about 18 months before that. They started right when COVID started, like at the beginning of 2020 is when they pivoted to cloud security. They started a little bit before in 2019. Uh, but yeah, 2020, and then I was still at Palo Alto Networks for another 18 months. [00:14:02] S1: Yeah, probably, you know, if you hadn't known it's inside of 2020, that it was so strategic, you could have asked for a billion dollars.
00:14:10 · Varun Badhwar
[00:14:10] S0: People tell me that all the time. They're like, hey, you sold Redlock too cheap. And I like my my theory is I never look back and have regrets. I think it was an amazing outcome even till this point. Uh for those of uh the people that held on to the Palo Alto network stock, that stock is you know 15 times higher than what it was. So, you know, if you take that bet that that was a multi-billion dollar acquisition now. But but no, look, life is a matter of learnings. I think startups, the the people almost think about the initiation and the incubation of a startup as the hardest part. And I think in the moment it feels that way because it is really hard. But I think startup building gets harder. And um across the board, right? When you're raising, you're raising on a dream, you're raising on an idea. If you're a repeat founder like myself, we don't have to prove anything. Money comes easy. Fortunately, if you're a young founder, you still have to prove conviction in the business, but you're not showing for revenue and scale. You're selling the TAM and you're selling the product architecture insights. And you can raise the, you know, whatever valuation these days we see crazy valuations. There's a bunch of cybersecurity companies starting out with $100 million seed funding now with near zero revenue. And that's fine. But what do you do when you have to scale revenue? Now you could be the smartest founder with product instincts, but if you don't understand how to build go-to-market for scale, that's another hard problem to crack. And engineering can be scientific. Sales marketing is art and science, so it kind of starts getting more and more complicated. And then initially you have one building block of engineering, then you had engineering and marketing and sales, and all of these building blocks have to connect. And then people start asking you about go to market and efficiency and eventually CAC and LTV. And so growing and scaling a healthy, sustainable business, I think over time gets harder.
00:16:03 · Siddhartha Ahluwalia
[00:16:03] S1: So, what was the trigger point for you to start Endor? Because you started during COVID time, a very uncertain time to begin a company. You can you could have continued building Prisma to multi-multi-billion dollars in business.
00:16:18 · Varun Badhwar
[00:16:18] S0: That was my wife's uh argument against me starting a company, yes. Uh look, you know, they say founders have this bug. I mean, why is Travis Kalanick starting another company after Uber, right? Why I I feel like us founders have this crazy gene in us, and that gene doesn't let us sit comfortably or see and be a part of status quo. I feel like the natural instinct is if you see a problem, you want to go fix the problem. And in 2021, while us were building this incredible business, um I saw a problem. And that problem was software development was radically shifting from development to assembly. 18% of our code wasn't even being written by developers, it was open source, it was all of these other things. We had no idea who's written this code and published it on GitHub. Yet we were blindly trusting all of this code and just in the spirit of moving fast, bringing it in and using it. That's one side of the change. The other side is you are analyzing this with incumbent tools and security scanning tools for code, and they would find a bunch of stuff. And you would check a box and compliance reports that says, yes, I scanned my code for vulnerabilities. But the reality was the volume of problems that were being discovered and the fidelity of that volume was really low. So engineers just didn't trust the results. So you're building apps, you're using all this code, you're relying on third-party open source. And at the same time, you have all of these potential security issues, you couldn't figure out what's real, what's not, and how you're going to fix them. And I think ignorance was bliss. But like for me, as a problem solver, I was like, look, this is a bubble waiting to crash. Like it this cannot sustain. And you look forward, two years later, LLMs were starting to write code. And if you look at 2026 today, what is the biggest topic of conversation? The fact that every security vulnerability can easily be discovered faster than ever before by LLMs. Like they're really good at finding bugs. And so now the problems become well, if LLMs can find so many problems, why can't we secure that code and build it correctly from the first onset? And the reality is historically, it's been a friction point. Do you either ship code fast or do you ship it securely? It's never been an end.
00:18:46 · Varun Badhwar, Siddhartha Ahluwalia
And our mission at Endor that I took on is we can help you ship fast and ship securely. If you build the right architecture, the right technology, the right insertion point in the software development lifecycle, you can solve all of those problems. We started that in 2021. And I couldn't be happier because sitting here today, we've had the time to build and scale a platform, prove it out with the world's most amazing customers in technology, finance, insurance, et cetera. And now this is the number one problem that is constraining us from adopting a gentic STLC is code generation is not the problem. It's security, it's quality, it's everything to do with releasing of the software much faster, and we're primed to solve it. [00:19:33] S1: And you operate on the left side completely?
00:19:36 · Varun Badhwar
[00:19:36] S0: The way I describe to be bill where Endor fits in is um if you want to draw a box around the entirety of the agentic SDLC from cloud code cursor, pick your favorite ID, agentic ID, through your pull requests, through your um CI CD pipeline till you have an artifact that is ready to be deployed in the cloud, container or jars, whatever, that is our zip code. From the first intent of writing code to writing the code to checking it into your pull requests and GitHub to CI CD pipelines, securing all of that such that what is ready is the most secure piece of software you could possibly create without compromising on speed is the outcome that Endor uh drives for our customers. And kind of that, unfortunately, in security, that workflow continues post-deployment because now I deployed the product yesterday. Now, today, 10 new things were found in security, like vulnerability discoveries. Now you've got to figure out off that code base, off those 10 vulnerabilities, what actually affects me? And how do I quickly pinpoint what affects me? How do I fix it without breaking my application and redeploy really, really quickly? And that time window to remediate used to be six to 12 months because, yeah, sure, somebody found a vulnerability yesterday, but the the likelihood that somebody's going to build an exploit and target you and come at you was like very low, 1%, 2%. Today that's that's reality. Within 10 hours, people have found and created working exploits for new vulnerabilities. And so this loop of remediate triage and remediation of what affects my code, what do I need to fix? Could literally become a full-time job for every engineering team on the planet. But it's not sustainable. So that's what we're automating for our customers.