00:43:52 · Varun Badhwar, Siddhartha Ahluwalia
[00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along. [00:45:29] S1: And do you imagine like how much people pay on cloud security and infra security, they would pay the same for code security and app security also? [00:45:41] S0: Probably more. Probably more. [00:45:44] S1: Why?
00:45:44 · Siddhartha Ahluwalia, Varun Badhwar
[00:45:44] S1: Why? [00:45:45] S0: Um just where in the value chain you sit. Like if you think about it, like your revenue as a company, right? If I'm Snowflake or MongoDB, my product, my software is my revenue. I exist as a public company because of my software. If I lose trust or erode trust, or there's an incident, or there's a security issue that affects my customers and my software, overnight I will erode 10 to 20% of my market cap. That's probably 20, 40 billion dollars. Will be eroded overnight if I have a security incident in my software. So I think your software, if software is your business and your lifeline, security matters significantly. [00:46:32] S1: But let's say for non-software companies like Ford or GM, General Motors, or anybody else, wouldn't that be still be critical for them? [00:46:42] S0: Great question. I guess the the thing I would ask you back is which company is not a software company today? Do you think GM and Ford can operate without connected cars? What if, and there's been lots of uh public um research on hacking cars? How are the cars hacked? Not through the engine, from the software. [00:47:01] S1: Yeah.
00:47:01 · Siddhartha Ahluwalia, Varun Badhwar
[00:47:01] S1: Yeah. [00:47:02] S0: What happens if somebody hacks and crashes cars now on the highway? So I think software fuels the world. Um yes, hardware is back again, not dismissing that, but software still fuels the world. And I think any company where the core of your product somehow fits in software, maybe it's not more than 10%, but I think on a base case it should be 10% spent on your overall IT budget for code security as well. Uh maybe take it from a different lens, okay? Most companies I talk to, the engineering teams spend 20 to 30% of their time on just security issues. Follow-ups, bugs, security bug fixes, vulnerability remediation, pen test report. So take that and say, if I can give you back half of that, that economic impact is about 15% of your total payroll cost, fully loaded headcount cost of your engineers. So if I'm gonna do that, arguably if you spend, you know, we're sitting in the Bay Area, so let's talk Bay Area salaries. You're spending $300,000 a year on um an engineer's salary. [00:48:18] S1: Yeah. [00:48:19] S0: If $90,000 worth of their time is spent on security, and I can fix that for $9,000 a year, I think you would happily pay that. [00:48:28] S1: Yeah. [00:48:29] S0: Right. And now is $9,000 a year for that security solve on where you're spending $300 for their GitHub license, you would still pay that if I can create the value connectivity and prove to you that I can give you back $90,000 worth of efficiency. So that's how I think about kind of value-based selling.
00:48:29 · Varun Badhwar, Siddhartha Ahluwalia
[00:48:29] S0: Right. And now is $9,000 a year for that security solve on where you're spending $300 for their GitHub license, you would still pay that if I can create the value connectivity and prove to you that I can give you back $90,000 worth of efficiency. So that's how I think about kind of value-based selling. [00:48:49] S1: And today, um, out of Fortune 500, how many logos would you have? [00:48:54] S0: Look, I think what's interesting about our business is for the reasons we were just having this conversation on like software is the lifeline for tech businesses. Um, a lot of our customers end up started out being the tech companies, companies like DoorDash companies, like the big labs that I can't name here on uh on air. Cursor is a customer, Glean's a customer, Atlassian, MongoDB, Snowflake, Peloton, Robinhood. So I think for us, where we were trying to drive efficiency are the companies that were really manically focused on that. So you know, they weren't your legacy Fortune 500s, if you will. But you know, over time we have several Fortune 500 companies, several of the world's top insurers, financial services. But just as a metric, we focus and fixate less as our claim to success being the Fortune 500, versus we we kind of look at it more as are the world's most prolific software companies, how of those, how many are using an Endor? And that number continues to uh you know go up and to the right.
00:48:54 · Varun Badhwar, Siddhartha Ahluwalia
[00:48:54] S0: Look, I think what's interesting about our business is for the reasons we were just having this conversation on like software is the lifeline for tech businesses. Um, a lot of our customers end up started out being the tech companies, companies like DoorDash companies, like the big labs that I can't name here on uh on air. Cursor is a customer, Glean's a customer, Atlassian, MongoDB, Snowflake, Peloton, Robinhood. So I think for us, where we were trying to drive efficiency are the companies that were really manically focused on that. So you know, they weren't your legacy Fortune 500s, if you will. But you know, over time we have several Fortune 500 companies, several of the world's top insurers, financial services. But just as a metric, we focus and fixate less as our claim to success being the Fortune 500, versus we we kind of look at it more as are the world's most prolific software companies, how of those, how many are using an Endor? And that number continues to uh you know go up and to the right. [00:50:01] S1: And engineering wants to shift faster, always, right? And never been fast as today. And security wants to hold back and slow things down, making sure nothing breaks. So you think that uh the equilibrium has further distorted than five years ago?
00:50:01 · Siddhartha Ahluwalia, Varun Badhwar
[00:50:01] S1: And engineering wants to shift faster, always, right? And never been fast as today. And security wants to hold back and slow things down, making sure nothing breaks. So you think that uh the equilibrium has further distorted than five years ago? [00:50:18] S0: I I think it's a challenge and opportunity. For sure, we're producing more code than ever before. And so the bottleneck is no longer code generation. That's not your constraint. Generation is a solved problem. Everything after that is where the bottlenecks are, security being a major one, quality being another one. Um but yeah, I I think I think as people are moving even faster, now security looks like even slower because of that reason, unless they're retoolable. And and I think this is also a great opportunity because all of the things that were unsolvable security problems, you can now do more efficiently with agents. And so I think the whole idea here at Endor Labs is how do you use a genetic software security solution to keep up and deliver far more effective security programs. [00:51:03] S1: So, how do how do you make uh the engineering team and the secure team work in in uh in the same harmony at the same pace?