How SecurityScorecard Exceeded $100M Run Rate and Grew to 600 Employees (SaaSOpen 2023 Talk by CEO Aleksandr Yampolskiy)

Opening and Introduction

Aleksandr Yampolskiy

00:01>> So right at 04:00, it's hard to have much empathy. You just want a coffee and a snack and not talk about not talk not talk about ideas, but it's great to be here. It's awesome to see founders sharing ideas, sharing insights from each other. There's no one playbook that works, so I think the best ideas that always happen are out of spontaneous interactions like this. I'm going to talk in this presentation about customer empathy, understanding customer

How SecurityScorecard Got Started

Aleksandr Yampolskiy

00:37>> and how it could lead to 10x in the company, and share some stories that we learned as we scaled securityscorecard. So let me actually first tell you how the company got started. So about eleven years ago,

Aleksandr's Role as CISO at Gilt Groupe

Aleksandr Yampolskiy

00:58>> I was a chief security officer in an e commerce startup called Gilt Groupe. I'm a security guy. I kind of alternate between building things and breaking things. So I just hired for this rapidly growing e commerce fashion startup, which was going from a few 100 people to 2,000 people in just a couple of years as a first chief security officer where I was overseeing security of millions of customers. And

01:25>> right around month three, Kevin Ryan, who is the founder of Gilt Groupe, Business Insider, MongoDB, he was my boss. Now, he's a friend and an investor into a startup. He sends me a message and says, Alex, I'd like you to come in and present to me what you're doing to make security for Gilt. And I felt great. I prepared this elaborate deck talking about people I was going to hire. I talked to him about the fact

01:52>> that I deployed Akamai Prolexic for SYN flood mitigation on the production network. So, I shared this elaborate technical deck with me and I thought, got it covered. It's going to be a great meeting. I walk in. He starts flipping through the slides in a printout out of sequence, completely ruins the frame of a conversation, looks at me and says, You're not doing a good job. And I was confused. Like, how am I not doing a good

The Inspiration for SecurityScorecard

Aleksandr Yampolskiy

02:16>> job? Like, look at all the things that I put together. And Kevin's response was, I don't hear enough people complaining about you. If you were making enough difference as a chief security officer, I'd hear more people complaining about you. So I took the advice to heart and a lot of people complained about me, but we made a difference. But that was actually the inspiration for security scorecard because I realized about nine years ago that security is

02:43>> the only industry where you have no KPIs. You drive a car, you have a speedometer showing to you how fast you drive. You go to a doctor, they measure your blood pressure. You look at a SaaS company, you have all kinds of metrics LTV to CAC, magic number, rule of 40. In cybersecurity, we're at zero. I mean, if you invested a million dollars into the latest, greatest technology and you asked, did they become 1% safer, 2%

03:08>> safer, 10% safer? Nobody could tell you. And furthermore, as we all became interconnected to each other, the problem got even worse because you could be doing a good job. Then you send your paperwork to an outside law firm, the law firm gets hacked and all of a sudden your sensitive information is out in the open. So as well became interconnected, actually 65% of data breaches today happen due to negligence of third parties which are not even

03:36>> within your control. You could use a marketing software, an HR software, then they get hacked and you're in trouble. For example, just out of curiosity, how many people heard of a Fazio data breach by raise of hands? Okay, one person, Target data breach?

The Dream of a Security Score

Aleksandr Yampolskiy

03:54>> Target got hacked, no? So Fazio was a small air conditioning company that serviced Target, and the hackers broke into it and then they got into Target. So nine years ago, we had this dream, and the dream was why can't there be security score? Just like you have credit scores, why can't you pick up data points non intrusively from outside for any company in the world and reduce those data points to a score? Easier said than done

Company Scale Today: 600 Employees and $100M Run Rate

Aleksandr Yampolskiy

04:19>> because at the moment, market did not exist. When we went and knocked on the door of prospective customers, we got a lukewarm reception which was a very important lesson for me at the time. When you start in a company, if the idea is obvious to everybody, you're actually too late to the game. So you got to time it properly. And fast forward into today, nine years later, we're about 600 employees used by thousands of companies worldwide,

04:48>> nine of the top 10 pharmaceuticals, banks, all of the top insurance companies using us. We exceeded 100,000,000 run rate last year and we're going to probably grow by at least 50% this year. So, fast forward into today. So, the question is where did we go right and where did we go wrong? How much of it was good decisions, bad decisions? And, you know, we did a lot of reflection. We did a lot of reflection and thought

05:15>> where did we go right? Where did we go wrong as we scaled the company from two people, me and my business partner, $0 in revenue, staring at a shell then a co working space to, you know, customers in over 46 countries today and employees all over the world. So the interesting part is that the ideas that we thought were good actually ended up being bad and the ideas that we thought were bad or like maybe we

Good Ideas vs. Bad Ideas: Lessons from Scaling

Aleksandr Yampolskiy

05:39>> didn't put a lot of attention to it, they actually ended up being good. And like you don't quite know what's a good idea, what's a bad idea because if you knew it, you would have already done it. So, to share two examples, on the right, you see this bridge multiplier where in 2015, I got super excited. I'm an engineer, so I had this idea that you can use a way to compute likelihood of two portfolios to

06:08>> be too similar. Just like you can have all houses located in a flood zone, and if all houses are in the same neighborhood, they can all get flooded because they're in a proximity to each other. If you have all of your suppliers using GoDaddy, for example, to host themselves or all of them are using HubSpot, And then HubSpot becomes like the single point of failure. So, how do you compute similarity between the two portfolios? So, we

06:31>> came up with a very clever idea to use Kolmogorov Smirnov Complexity to compute the difference between portfolios. We spent four months, 10 person team working on it for four months, millions of dollars, total flop. I was the only person in the company who knew how to pitch it. My sales guys couldn't understand it, didn't do anything. On the flip side, back in 2015, right around the same time on a weekend, one of my developers called Josh,

The Free Score Widget That Became the Top Lead Gen Tool

Aleksandr Yampolskiy

06:59>> he looked at a website and said, Why don't I just take the scores that you guys compute and write a small widget and just put it on a website and anybody who can go get request a score can go type the email, we send a score and then we bombard them with marketing messages and it becomes a lead, a warm lead. And nobody asked them to do it. It didn't come from me. He just went and

07:20>> coded it on a weekend and became our number one lead generation tool actually even today. And Josh is now actually Founder and CEO of our Customer Success Startup, about 20 people now. I'm an angel investor. The reason I put my money in them is because you bet on people who take a risk. You bet on people who are dreamers, risk takers, have a healthy dose of disregard for the impossible. So, what does it tell us though,

Culture of Cheap and Fast Experimentation

Aleksandr Yampolskiy

07:46>> right? Like what do these two lessons tell us? So, they tell us that most organizations overvalue great ideas and that cheap quick experimentation outweighs great ideas every single time. And you need to build a culture for people to really innovate because a lot of the time, especially as companies grow, people are going to say, Oh, I got this two month project to build a marketing campaign or website or it's going to take me a month to

08:13>> ship a feature. And then you do it and you don't even know if it works 90% of the time. You think it does, but then at the end, it doesn't. So, I'm a huge fan of this five by five by five framework by Mike Schrage, who is an advisor and a friend, professor at Harvard. But he came up with this framework and said, Imagine you have five people, five days, $5,000 and it's an artificial constraint

08:35>> and constraints breed creativity. And you say, Okay, like come up with an experiment and test a hypothesis. So for example, if somebody comes to you and says, It's going to take me two months to build a website. I'm like, How do you do it in ten minutes? They look at me like I'm crazy. I'm like, Well, you've to think crazy. Think creative. Don't think linearly. Think non linearly. What about you just putting up a picture in

08:59>> a landing page and seeing how many people click on it? But this is very important for the culture of a company that helped us iterate, number one. Number two,

Jobs to Be Done Framework

Aleksandr Yampolskiy

09:09>> have people heard of a framework called jobs to be done? Yes. So that's a hugely important framework for product development. People do not buy products and services. They hire them to get jobs done in their lives. Jobs are problems that your customers do. So at the end of the day, every startup is there to help people do a job. And it's very easy to get fixated on features, operational metrics, but you need to zoom out and

09:34>> say what are the jobs that your customers who are paying you money are actually doing and how is your product, your company helping them solve it? That's a really good book. Like, get that book. I have zero affiliation with the book, but I still love the book, Secret Lives of Customers, a very good book. And so in that book, it poses a question, why do you hire a cup of coffee? You go to a local coffee

09:58>> shop and you hire a cup of coffee, right? You pay money, so you hired a cup of coffee to do a particular job. Why do you do it? Who can tell me? Just shout out the answers. Caffeine, you want to get caffeine? Anybody else?

Nathan Latka

10:12>> Experience of a coffee? Take a break? Socialize? Okay, good, good. So, the answer is it's not just caffeine. If you run a coffee shop and you're competing, then if you think that the only reason people go to you is to have a coffee, then you're going to compete on quality of coffee, variety of beans that you have, that type of stuff. Maybe you're going to add some sandwiches, snacks, but you're missing the point that the job

10:37>> to be done to hire a cup of coffee is totally different. So, I listed my jobs of why I hire a cup of coffee over the past couple of years. Sometimes I want to go meet a friend and have an informal chat somewhere outside of my house. I used to compete in chess back in college. I'm pretty good. So I would meet local chess players at 05:00 on a Friday because they would congregate there. I wanted

Aleksandr Yampolskiy

10:58>> to feel alert before I would go to a workout. Every single morning, I would commute into a city, go get a coffee, draft my day, and just that's my routine. I worked on my PhD dissertation back in college. I lived in a small tiny studio, was uncomfortable, faced a brick wall. I wanted to be around people but not talking to people while I'm writing this dissertation. So, there's a lot of jobs to be done. But when

11:21>> you compete on those jobs, all of a sudden, your coffee shop no longer competes on the quality of beans, but you might be competing with WeWork on what type of ambiance you create. You might be competing with social meetup groups by congregating people. So, it really expands how you think. So if you adopt a product centric lens, which by the way, we as a company often are very guilty of, you start saying a product centric lens

Cyber Risk Quantification and Job-Centric Thinking

Aleksandr Yampolskiy

11:46>> is you compete on a quality of coffee. You get a cup of coffee. But a job centric lens, you start thinking how do you create an experience in your coffee shop to have an informal chat, get work done on the go. If I apply it to what we do, we've recently released a module called Cyber Risk Quantification where you can quantify in dollar terms how much your risk exposure is. If you adopt a product centric lens,

12:09>> you're going say, Oh, it shows this dollar's exposure. But if you adopt a job centric lens, why would somebody pay money for it? Well, they might be trying to justify a budget to convince people that we'll lose this much money, so I need an investment or you might show to the board that you're doing a good job. So you expand your horizon when you think that way. Now, customers pay you exactly proportionate to the value you

12:35>> bring, which means the pain you alleviate versus alternate solutions. A lot of startups underestimate it, but this is the trick. A lot of the time you might not be getting traction in a startup, but the point is you have a customer, he has a set of circumstances and a certain amount of pain, inefficiencies. You might be standing outside in a rain trying to look for a taxi, it's not there. That's a certain amount of pain. So,

13:02>> and Lyft recognize the pain where you can now just click a button and order a car without looking for a taxi and it's tied to your credit card. And it was a big enough pain where it became a big successful company. Similarly, a lot of the time, people underestimate how valuable their solution is, right? Like, I mean, I think if you're under 10,000,000 in ARR, you actually probably did not reach your product market fit yet. Like

Product Market Fit and Becoming Indispensable

Aleksandr Yampolskiy

13:31>> you need to work with the industry to try to cross the chasm and try to really understand deeply how do you become a drug and not a vitamin because drugs are must have, vitamins are nice to have. How do you become indispensable and embedded into your customer lifecycle? And to do it, you have three types of approaches, right? One approach is you become a system of record like Salesforce where it's almost impossible to rip it out.

13:57>> A second approach is you become a company where you have a lot of integrations like Zendesk. It's easier to rip it out, but you integrate it into the workflows. And a third, you could become a company like Gainsight or some other companies where much easier to rip it out, but they created a great brand, great community, people like it, so you create the stickiness to your solution. And you need to talk to your unhappiest customers. That's

14:22>> your secret of how to scale your company. Talk to your unhappiest, most pissed off customers. They'll tell you the secret. And so, the deadliest competition is actually not competitors and not your adjacent solutions, but it's doing nothing. That's the deadliest competitor that you face and it's a very hard competitor to fight with because before you came along, people survived, you know, things were happening. So why is it that now your startup or your company is around,

Building a Customer-Obsessed Culture

Aleksandr Yampolskiy

14:54>> why do they really need to have it? So that's a very important kind of point to focus on. And the next part is as you scale the company, the values are not what you put on a wall or what you say it is, but it's a behavior. It's the positive and the negative behaviors that you embody. So, it's very crucial to create a customer obsessed culture. And customer is always a number one priority. We hire, we

15:21>> fire, and we promote based on this. I parted ways with an executive who was a smart, talented executive

15:30>> about a month ago and it caused a big turnover in the team. I asked her, How many customers have you talked to? She showed the calendar, not many. I said, Okay, next week when I talk to you, I need to see you talk to customers. Wasn't happening, so we moved to a different role. Didn't work out, so but you have to do what you say. If customers are your number one thing, do what you say. Reward,

15:52>> promote, and fire based on those things. We start every executive meeting with a twenty minute recap of customer stories before we talk about anything else, updates, OKRs, KPIs, roadblocks. We start by talking for twenty minutes about stories from the market, bad and good. That means that we put customer first. We invite customers to talk to our town halls. We share stories. We do calendar audits to make sure that people are mixing those activities. Every executive is

Taking Customers on a Journey and Transforming Them

Aleksandr Yampolskiy

16:22>> mandated to talk to customers. It's not an option. And then Amazon has a very famous expression, the most important chair is an empty chair in the room representing the customer. That's the most important thing. Is the stuff that we're talking about actually going to benefit the customer? The last part I'm going to mention is you also want to take your customers on a journey and understand who are your customers, who are your customers'customers. If you're

16:52>> a retail customer, who do they sell to? If you're a cruise line, who do they sell to? And then you want your company to transform your customers. Mike Schrage again talks about this quite a bit and he said the Facebook innovation was the fact that it asked its users to share more openly even if they were introverts. They did not do it before. It's easy to talk about Henry Ford and people say, Oh, Henry Ford's idea

17:17>> was a mass assembly line or producing the Model T at scale. But in reality, it wasn't actually that. He recognized that a transformation is possible when people didn't make enough money to buy an automobile. So he raised the salaries. He envisioned that people are gonna travel longer on a weekend when they didn't travel. The roads weren't paved. There were no bridges, no infrastructure. But he envisioned this transformation. Google transformed us into people who don't hesitate for

17:46>> a second to type an ill defined query into Google and believe the results. That was a transformation of the customers and that's how you take your customers on a journey. And similarly, we transformed the customers into people who don't hesitate for a second to use our scores to decide whether somebody is trustworthy to do business with. So that's some tips and advice. You're never done. You never achieved a milestone. You always have to work on it

18:10>> and continuously get out of bed and think about how you evolve, but those are some of the things that work for us. And as I mentioned, this quote by Bill Gates is very relevant. Your most unhappy customers are your greatest source of learning. And so, that's my email. You If guys have any questions, reach out and I think I'll also be hanging out a bit, but thank you very much.