00:40:55 · Varun Badhwar, Siddhartha Ahluwalia
[00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense. [00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security?
00:42:18 · Siddhartha Ahluwalia, Varun Badhwar
[00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security? [00:42:27] S0: Uh that's a that's a good question. Look, I think the um the question I think I I maybe answer that slightly differently is where are the most logical places that we can insert security that is most native to the experience? And I would say like GitHub comes up as an obvious answer, right? If if you could have security just be transparent, you don't even know it is there, it just works. Developers love GitHub. If you and I think GitHub had initially made some really good investments, you know, I think over the last year or so they're trying to figure out their strategy on some of these things. But I have a high degree of respect for GitHub for what they've delivered around that. Um, so I think that's one. Uh beyond that, I think without naming specific companies, I'll say there are there are some of them that have truly taken the pain of figuring out what are real developer problems. Let's not just build another compliance reporting tool. But like what are real problems in the workflow and solve them? And I think those companies that will tend to do well versus ones that'll put some checkboxes. [00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market?
00:43:38 · Siddhartha Ahluwalia, Varun Badhwar
[00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market? [00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along.
00:43:52 · Varun Badhwar, Siddhartha Ahluwalia
[00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along. [00:45:29] S1: And do you imagine like how much people pay on cloud security and infra security, they would pay the same for code security and app security also? [00:45:41] S0: Probably more. Probably more. [00:45:44] S1: Why?
00:45:44 · Siddhartha Ahluwalia, Varun Badhwar
[00:45:44] S1: Why? [00:45:45] S0: Um just where in the value chain you sit. Like if you think about it, like your revenue as a company, right? If I'm Snowflake or MongoDB, my product, my software is my revenue. I exist as a public company because of my software. If I lose trust or erode trust, or there's an incident, or there's a security issue that affects my customers and my software, overnight I will erode 10 to 20% of my market cap. That's probably 20, 40 billion dollars. Will be eroded overnight if I have a security incident in my software. So I think your software, if software is your business and your lifeline, security matters significantly. [00:46:32] S1: But let's say for non-software companies like Ford or GM, General Motors, or anybody else, wouldn't that be still be critical for them? [00:46:42] S0: Great question. I guess the the thing I would ask you back is which company is not a software company today? Do you think GM and Ford can operate without connected cars? What if, and there's been lots of uh public um research on hacking cars? How are the cars hacked? Not through the engine, from the software. [00:47:01] S1: Yeah.
00:47:01 · Siddhartha Ahluwalia, Varun Badhwar
[00:47:01] S1: Yeah. [00:47:02] S0: What happens if somebody hacks and crashes cars now on the highway? So I think software fuels the world. Um yes, hardware is back again, not dismissing that, but software still fuels the world. And I think any company where the core of your product somehow fits in software, maybe it's not more than 10%, but I think on a base case it should be 10% spent on your overall IT budget for code security as well. Uh maybe take it from a different lens, okay? Most companies I talk to, the engineering teams spend 20 to 30% of their time on just security issues. Follow-ups, bugs, security bug fixes, vulnerability remediation, pen test report. So take that and say, if I can give you back half of that, that economic impact is about 15% of your total payroll cost, fully loaded headcount cost of your engineers. So if I'm gonna do that, arguably if you spend, you know, we're sitting in the Bay Area, so let's talk Bay Area salaries. You're spending $300,000 a year on um an engineer's salary. [00:48:18] S1: Yeah. [00:48:19] S0: If $90,000 worth of their time is spent on security, and I can fix that for $9,000 a year, I think you would happily pay that. [00:48:28] S1: Yeah. [00:48:29] S0: Right. And now is $9,000 a year for that security solve on where you're spending $300 for their GitHub license, you would still pay that if I can create the value connectivity and prove to you that I can give you back $90,000 worth of efficiency. So that's how I think about kind of value-based selling.