00:38:50 · Varun Badhwar
[00:38:50] S0: It's a good question. Um look, I think the biggest thing is just scale and density, right? As a startup, you're very scared about like I was, I'm a frugal guy. I mean, you know, I I've come from where we had $10 million to go build and scale RedLock. Um and what you realize, especially today, more so than ever, is the noise in the spaces is too high. You have to build all the way to and get much closer and have the density. Like if your competitor has 300 reps and you have three reps and you feel really good about your win rates, the problem is 98% of those conversations you're not even a part of. So, and and Wiz did this really well, right? You have to blitz really fast. Like when you feel like you have product market fit and repeatability, you have to scale faster. It's a bold move, it's a scary move, it requires heavy capital investment. Because, like with sales, you know, you've got ramp times and other things, but you've got to do it fast. The other thing that I'm a big believer in is you can't go at it alone. So, like the alliances, the channel, the partnerships matter even more because the customers want a holistic problem to be solved. No matter how much you try, you will solve maybe some part or a big part of that problem, but not chances are not the entirety of the problem. So you have to pair up with the right like-minded companies where you have technical alignment, but also core fundamental alignment on ICP and um core how you sell and how you position. And then you can take much stronger outcomes to the customer that don't necessarily have to be delivered by one company.
00:40:33 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:33] S1: So, so a lot around how to build an ecosystem. Yeah. [00:40:39] S0: How to build an ecosystem, how to build trust with buyers, not be transactional. Um I would say are probably the two big things. [00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer?
00:40:49 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer? [00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense.
00:40:55 · Varun Badhwar, Siddhartha Ahluwalia
[00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense. [00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security?
00:42:18 · Siddhartha Ahluwalia, Varun Badhwar
[00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security? [00:42:27] S0: Uh that's a that's a good question. Look, I think the um the question I think I I maybe answer that slightly differently is where are the most logical places that we can insert security that is most native to the experience? And I would say like GitHub comes up as an obvious answer, right? If if you could have security just be transparent, you don't even know it is there, it just works. Developers love GitHub. If you and I think GitHub had initially made some really good investments, you know, I think over the last year or so they're trying to figure out their strategy on some of these things. But I have a high degree of respect for GitHub for what they've delivered around that. Um, so I think that's one. Uh beyond that, I think without naming specific companies, I'll say there are there are some of them that have truly taken the pain of figuring out what are real developer problems. Let's not just build another compliance reporting tool. But like what are real problems in the workflow and solve them? And I think those companies that will tend to do well versus ones that'll put some checkboxes. [00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market?
00:43:38 · Siddhartha Ahluwalia, Varun Badhwar
[00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market? [00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along.