How Apozy CEO Erhan Justice grew Apozy to $1.4M revenue and 7 customers in 2024.

hello everyone my guest today is rick deakin he was a professional hacker for 10 years before founding his current company a posey raising money and then pivoting during yc and then now focused obviously now on growing the company ricky ready to take us to the top absolutely all right so talk to us about the company first off why get into you know being a founder that seems way more stressful than being a hacker uh actually you'd be surprised um essentially kind of the way i looked at it is when i was doing my penetration testing ethical hacking um i felt that there was a specific gap in the way that that particular industry solved that area of security and that was essentially around human security and i found that there was nothing on the market that i felt solved the problem that i was facing as a hacker which essentially was me fishing companies and then seeing what their weaknesses were when it came to that and there wasn't a product on the market that solved that so the only way that i saw it was a reasonable fix for that was to do it myself so uh obviously the best way to do that instead of trying to just build it and release something is to start a company around it yeah now when did you launch the company uh actually the company was launched in 2013 so we started a long time ago in the startup world and we've made some big pivots so the first product we built was actually focused on what we call workforce risk analytics which was the security posture of people inside of a company and then like you mentioned during 2017 went to yc and made the big pivot to the product now still and always been cyber security just with a different focus what did uh what did you like about yc and what do i see like about you when you applied um when we applied starting there i think that their uh their excitement about us was focused around the fact that we are resilient and we are dedicated to what we do with security their portfolio is actually limited from a security perspective they don't have that many companies that do security so i think they wanted to add another one and then um for us the big thing was actually getting the i guess you could say courage and the backing to make a big pivot because we had customers on our own product we had a team on our old product so having to let go of that team and having to say we're going to no longer support the customers we have wait how big was that loss i'm curious because the sunk cost kind of you had to get over i'm curious how big it was so how many customers what was revenue when you had to give it all up uh revenue was around 250 or 300 a year yeah okay so nothing major but it was enough to say like well this is you know we have some traction here problem is the growth wasn't fast enough the product in my opinion wasn't in the right market space that we wanted to be and we didn't want to build to continue to build that so it meant letting go of the team it meant letting go of those customers and making the big pivot yc helped us do that by essentially not only giving us capital but also the uh fortitude to say hey this is something that a lot of people do this is a smart decision jump into it instead of pushing something uphill yeah and so since that been 2017 back to today obviously it sounds like you started zero at all your customers go how many customers are now in the new product today uh around seven okay around seven so are you is this very much like an enterprise motion or it sounds like probably not a freemium model it's not a freemium model it's not enterprise either we're actually taking a model that most security companies don't which is targeting the high-tech smbs so a few hundred employees up to a few thousand employees those are the people that actually they experience security problems very similar to a large enterprise but they don't have the right type of solutions or the solutions don't culturally match what they're trying to solve so oftentimes uh these companies are looking for a solution can't find them because they're either targeted at the massive enterprise or they're just doing like antivirus which isn't enough what about some of these companies i mean i've had malwarebytes on we've had um obviously rapid seven uh crowdstrike uh stew at no b4 you know they all do different models whether it's bottoms up you know it's a one-time install by an employee then before you know a thousand people on the team then they're selling to the you know the cto or some of them start at the top and then work their way down um why didn't this you know market that this cohort of 100 000 customers high-tech smbs find one of those solutions um i think because they do something very different we saw a very specific problem related to phishing and browser security and any of the companies you mentioned don't do that so essentially we focus on a place where it's a new emerging threat and people are noticing more and more that it's a big deal because phishing attacks are essentially just links that open in your browser and unless you're using a content filter you trust or relying on people to be very intelligent diligent there's going to be gaps and things are going to get through so i would say that they haven't found those simply because they don't solve the same problem why i mean we hear about phishing attacks in the news all the time i would imagine cyber security companies especially when like crowdstrike about to go public has addressed these issues why have they not uh crowdstrike does something different right they do cloud-based malware analysis and trying to thwart those type of attacks crowdstrike also has a phishing type solution but it's focused on stopping malware it's always focused on stopping malware everyone focuses on what's the download from an email what's the download from the website we're saying we're going to protect every person inside your company from every bad website across the board so it's almost like we're a new way of doing security from that perspective also culturally we fit better with the smaller companies because we're focused on g suite people who are using chrome and g suite to do business which essentially aren't large enterprises and some of those companies are also not so privacy focused or require deployments inside of a network or require difficult deployments that require people to be centrally located yeah um we've done away with all that so okay so this market a min market can you quantify it in terms of like let's say you sign up this perfect fit kind of customer on average what are they going to pay you per year to use your tech um anywhere between depending on the size 20 to 100 grand okay got it so call it like maybe like two grand a month something like that as a fair average and that team size again usually between i assume you price based off number of seats is that right correct yeah the pricing is basically it varies anywhere from a few bucks up to 12 per user per month and that goes everywhere from like i said even 50 to 100 employees all the way up to two to three thousand okay is there any usage-based upselling number of blocked websites per month things like that no not currently we're actually focused on being extremely economical with how we price being very competitive and trying to make it easy for companies who may not even have a large security budget because when you're talking to two or three in a person company they may feel the pain but they're not you know they're not a bank that has a hundred thousand dollars dedicated just to buying this product well sure but i mean if your value metric is preventing again malicious websites from opening a good value metric would be how many you prevent from opening whether it's a one person team or a 10 million person team i'm just curious why you've chosen to price against seat size versus number of sites you've protected the company from um well i mean because mainly because of the fact that one site could be millions of dollars depending on the type of the company but um also they may only see one site per month so in that case we may be protecting them against millions of dollars but we if we're charging for one site stopped per week there's not much on our end so the value is essentially what we're basing it off of like if we can stop a phishing attack that has a value of 10 of your customers leaving your company from a reputation perspective and a million dollars in loss and we charge you 10 a month per site and we only block two that's a made up entirely made-up metric for what we would be charging that but you see what i'm saying yeah i imagine that education process that was very tricky i mean you're having to first convince these companies that hey if this happens and if it shows up on you know wall street journal you're going to lose 10 customers which is equal to a million revenue loss so paying us 20 bucks a month or 2 grand a month is nothing i imagine there's an education process there where they have to believe that that threat is very real uh no actually i think because ever it's in the news every single day i've never encountered a customer who didn't see that fishing is a serious and potentially detrimental um problem why don't you have more than seven customers well mainly because we've actually just kind of released this a few months ago it's only been in the market for like five or six months and we've actually been focusing on growing the team and marketing before we've actually gone full force with sales what does the team look like today how many folks uh four people so me my co-founder two engineers okay...