00:35:54 · Varun Badhwar
[00:35:54] S0: Yeah. I'll give you one concrete example. We, you know, there's lots of benchmarks about how functionally correct the code is. And we said, well, look, everybody's talking about, oh, the coding agents are so good because they can write functional code, but there's no benchmarks that exist to talk about how securely they are writing that code. So we said, what can we do? Carnegie Mellon and Columbia Universities were working on some research in their labs. We partnered with them, we took harnesses that were believable and benchmarks that they had built, not us. As a vendor, how are you gonna believe my benchmarks? We took that, we invested around that, and we created the entire infrastructure and investment plan where now, every time there's any new model released within 24 to 48 hours, we will test the security efficacy as well as functional efficacy, and we'll publish those results. It's called Agent Security League. What does it do? It just brings people, you know, there's conversation, people are sharing some of these benchmarks. Those benchmarks are created by this company called Endor Labs. Maybe people will want to know what Endor Labs does, how it can help. But like we do a lot of unique research. We've invested heavily on the research side of this company. We uh, if you look at our blogs, most of our blog posts are written by engineers, not by marketing people and salespeople. So we're very thoughtful about the depth and quality of the content we create. So those would be a couple of examples.
00:37:19 · Siddhartha Ahluwalia, Varun Badhwar
[00:37:19] S1: So, but you're still going to these conferences? [00:37:21] S0: Yes. But we're going from a perspective of not let's have the biggest booth and let's lead scan, but it's presence and like again, it's the halo effect, right? When somebody is ready to buy, they will come to us and want to talk to us because they have seen us at places, their friends talk about how great our product is, they have the best experience, we have solved really hard problems, they're seeing good quality research from us in the learning. So, you know, you never know when a buyer is ready to engage, but you want to be there at the time and you want to be the top name in their mind when they're ready to engage in a problem that you can solve. And so we create a lot more of that halo effect, the community, the content. As an example, last week was Black Hat, one of the largest cybersecurity conferences in Las Vegas. We didn't have a booth, but we had this incredible restaurant we had taken over inside the convention center that everybody had to pass through to get to the booth. We had brunches and lunches and talks and dinners, and people could walk in, spend five minutes, relax, sit down, have a coffee, follow along, move along. There's no sales pressure, there's nobody coming in, like, you know, forcing you to take certain actions to get in there. And and you know, our hope is it's a memorable thing people leave behind with. [00:38:39] S1: What are some of the things, you know, in RedLock uh that you were not doing that you learned on distribution at Palo?
00:38:50 · Varun Badhwar
[00:38:50] S0: It's a good question. Um look, I think the biggest thing is just scale and density, right? As a startup, you're very scared about like I was, I'm a frugal guy. I mean, you know, I I've come from where we had $10 million to go build and scale RedLock. Um and what you realize, especially today, more so than ever, is the noise in the spaces is too high. You have to build all the way to and get much closer and have the density. Like if your competitor has 300 reps and you have three reps and you feel really good about your win rates, the problem is 98% of those conversations you're not even a part of. So, and and Wiz did this really well, right? You have to blitz really fast. Like when you feel like you have product market fit and repeatability, you have to scale faster. It's a bold move, it's a scary move, it requires heavy capital investment. Because, like with sales, you know, you've got ramp times and other things, but you've got to do it fast. The other thing that I'm a big believer in is you can't go at it alone. So, like the alliances, the channel, the partnerships matter even more because the customers want a holistic problem to be solved. No matter how much you try, you will solve maybe some part or a big part of that problem, but not chances are not the entirety of the problem. So you have to pair up with the right like-minded companies where you have technical alignment, but also core fundamental alignment on ICP and um core how you sell and how you position. And then you can take much stronger outcomes to the customer that don't necessarily have to be delivered by one company.
00:40:33 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:33] S1: So, so a lot around how to build an ecosystem. Yeah. [00:40:39] S0: How to build an ecosystem, how to build trust with buyers, not be transactional. Um I would say are probably the two big things. [00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer?
00:40:49 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer? [00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense.
00:40:55 · Varun Badhwar, Siddhartha Ahluwalia
[00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense. [00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security?