00:40:49 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer? [00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense.
00:40:55 · Varun Badhwar, Siddhartha Ahluwalia
[00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense. [00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security?
00:42:18 · Siddhartha Ahluwalia, Varun Badhwar
[00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security? [00:42:27] S0: Uh that's a that's a good question. Look, I think the um the question I think I I maybe answer that slightly differently is where are the most logical places that we can insert security that is most native to the experience? And I would say like GitHub comes up as an obvious answer, right? If if you could have security just be transparent, you don't even know it is there, it just works. Developers love GitHub. If you and I think GitHub had initially made some really good investments, you know, I think over the last year or so they're trying to figure out their strategy on some of these things. But I have a high degree of respect for GitHub for what they've delivered around that. Um, so I think that's one. Uh beyond that, I think without naming specific companies, I'll say there are there are some of them that have truly taken the pain of figuring out what are real developer problems. Let's not just build another compliance reporting tool. But like what are real problems in the workflow and solve them? And I think those companies that will tend to do well versus ones that'll put some checkboxes. [00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market?
00:43:38 · Siddhartha Ahluwalia, Varun Badhwar
[00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market? [00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along.
00:43:52 · Varun Badhwar, Siddhartha Ahluwalia
[00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along. [00:45:29] S1: And do you imagine like how much people pay on cloud security and infra security, they would pay the same for code security and app security also? [00:45:41] S0: Probably more. Probably more. [00:45:44] S1: Why?
00:45:44 · Siddhartha Ahluwalia, Varun Badhwar
[00:45:44] S1: Why? [00:45:45] S0: Um just where in the value chain you sit. Like if you think about it, like your revenue as a company, right? If I'm Snowflake or MongoDB, my product, my software is my revenue. I exist as a public company because of my software. If I lose trust or erode trust, or there's an incident, or there's a security issue that affects my customers and my software, overnight I will erode 10 to 20% of my market cap. That's probably 20, 40 billion dollars. Will be eroded overnight if I have a security incident in my software. So I think your software, if software is your business and your lifeline, security matters significantly. [00:46:32] S1: But let's say for non-software companies like Ford or GM, General Motors, or anybody else, wouldn't that be still be critical for them? [00:46:42] S0: Great question. I guess the the thing I would ask you back is which company is not a software company today? Do you think GM and Ford can operate without connected cars? What if, and there's been lots of uh public um research on hacking cars? How are the cars hacked? Not through the engine, from the software. [00:47:01] S1: Yeah.