204: Finding creative ways to attract and engage customers can lead to more loyal and lasting relationships with Tom Pace, CEO @ Netrise

Andrew Monaghan [00:00:00]:

Sometimes tackling an old but underserved part of the market can make the most impact. That's what Netrise is doing. And their co-founder and CEO, Tom Pace joins me to talk about why is their market underserved the reaction from prospects when they realize it can actually be solved? Their biggest sales challenge right now. And also how Tom's first computer he ever had as a kid. It was from a brand that doesn't exist anymore, bought from a store that doesn't exist anymore. But don't go away. Welcome to the Sales Bluebird podcast, where we help cybersecurity companies grow sales faster. I am cybersecurity go to market guy. Andrew Monaghan. Our guest today is Tom Pace, co founder and CEO at Netrise. Tom. Welcome to Sales Bluebird.

Tom Pace [00:00:57]:

Thanks for having me, Andrew. Happy to be here.

Andrew Monaghan [00:00:59]:

Yeah, I'm looking forward to this because we've got a lot of common connections. You spent a bunch of time at Cylance and I was at McAfee, never Cylance, but a lot of the McAfee folks went to Cylance. And secondly, you're tackling a part of the industry, which it seems to me anyway, you can correct me, not many people are thinking about or at least tackling right now. And I think it's probably a part of industry that's based on some assumptions that don't necessarily need to be true. So I'm going to test my thought with you when we get to that point in the discussion.

Tom Pace [00:01:31]:

For sure. Yeah, I mean, it's definitely an emerging space within cybersecurity in a market that is, I guess you would call it nascent and ripe for disruption. So we're excited about the opportunity a.

Andrew Monaghan [00:01:50]:

Quick break to say that this episode is sponsored by It Harvest. With over 3200 vendors in cybersecurity, it is hard to keep track of all the latest developments, as well as research and analyze categories and subcategories within cybersecurity, which is where the It Harvest cybersecurity platform comes in. Want to know which subcategories in cloud security are growing the fastest? You'll get it in a few clicks. Want to know and track everything about your main competitors and keep up with their hiring and news? Simple search to be done. Want to know the top 20 fastest growing companies based out of Israel? Easy. Just a couple of clicks to get that. It Harvest is the first and only research platform dedicated to cybersecurity and it's run by Richard Steenan, who has done it all in cybersecurity. From the VP of Research at Gartner, a CMO at a cybersecurity vendor, a lecturer on cybersecurity, advisor to startups, advisory board member at Startups, and a main board member as well, the whole lot. Find out more by going to Salesbluebird.com Research. That's salesbluebird.com research. Now, back to the episode. Well, let's look at your background, Tom. I'm going to use LinkedIn as the source of truth about what you've been doing for your whole career. I want to try and summarize this as effectively as I can. You started off in the Marine Corps back in the early 2000s. Spent about four years there. Came out of there, did a little bit around, looks like police, crime units, forensics, things like that. And your first real I don't know if it's quite true. First real tech job, PNC Bank, where you're an analyst and then an incident Response investigator. And between PNC and your next stop at Floor, you were involved a lot of IDs. It sounded like network based IDs and also host IDs. That was over. It looks like about five or six years between the two companies. And then from there, you made probably quite a big decision, a big movement in your career to join Cylance, where you ended up running their worldwide consulting organization. Of course, we all know silence was acquired by BlackBerry. You went over to BlackBerry and held a role there for almost two years. And then fast forwarding a little bit. We go to officially January 2021 when you said, now is the perfect time to go and be the founder, co founder of my own company. Take us back to that moment in time when you and your co founders were whatever you're doing sitting around the campfire going, you know what? We should start something.

Tom Pace [00:04:41]:

Yeah. It had been an idea for a number of years to kind of do my own thing, but I was very happy at silence. I really liked it there. I've said many times, if we didn't get acquired, I probably would have never left. I probably wouldn't have. My life was great. It was just awesome. And then we got acquired. Listen, Blackberries, they're a great company. I'm just not a big company, guys. It's just not what I am. I never have been. I don't do well surrounded by so much structure. It's just not for me. It's not bad. It's just different. So that was really it for me. And so I've had to figure out, what do I want to do with my life? I can stay or I can go to another company and basically do the same thing I was just doing, which certainly would have been more lucrative. Or I can take the opportunity to go do my own thing. And that's really the decision making process. I think that a lot of people think it's this. I've been dreaming of starting a company my entire life. Couldn't be further from the truth. I'm certainly passionate about what we're doing and all of that. You have to be. Otherwise it'll just never be successful. But that was like the motivator for me was solving a hard problem and kind of being responsible for my own future. That's what was really interesting to me and that's even evolved now. Since I've started the company, I get so much more satisfaction around seeing the people that work at this company feel like they're doing something important and feel like they are contributing to something and can see the output of their efforts in the product, in customer satisfaction, in whatever. And that's just really hard to get at big companies. Right.

Andrew Monaghan [00:06:52]:

I feel like at big companies, you're part of a big, big apparatus. At the end of the day, for most people in the organization, what they do isn't going to have a big impact on customer success in general. Obviously, you're contributing towards it, but you can't sit there and go, yeah, that's what I did. Right. Whereas at startups that you have to there's no choice.

Tom Pace [00:07:14]:

That's all there is. If you can't point and show me what you did, then I don't know what you're doing here.

Andrew Monaghan [00:07:19]:

Right. So how easy was it to get your co-founders on board and how did you know them?

Tom Pace [00:07:25]:

Yeah, so I met my co founder. There's just two of us, me and Mike. I met Mike at Cylance. We built some stuff together there. We built, like, an incident response platform, and that turned into a black hat class that I taught for, like, three or four years. So that was really fun. And then Mike left and went to Tanium, where he built their EDR product and was responsible for developing a lot of their machine learning patent stuff. And Mike and I just had a super unique relationship in terms of, number one, we're just two totally different human beings. I have a technical background and all of that, but I'm not one 1,000,000th as technical as Mike. I've taken plenty of programming classes. I have never been a professional software developer in my life. Mike has done that his entire life. So I'm just much more focused on the operations and go to market side of things and all of that. Mike is a product builder, so we just had a very complementary set of capabilities, and we were both super excited about stepping into the void, I guess, and trying to make it happen. So him and I just kept in close communication and kept the conversation going. And one day I was like, all right, it's time to do it. And I've made this comment a bunch of times. Like, I given two options in my life. I've pretty rarely taken the easier one. In fact, I can't really think of any time. And deciding to raise money during COVID is certainly one of those times. But we did it, got enough money to get out. And then since then, it's been great.

Andrew Monaghan [00:09:14]:

Who's advising you through all this? Who are your mentors? You're like, I think this is a good idea, but I need someone who's done this before to guide me a little bit.

Tom Pace [00:09:21]:

Yeah, that's a lot of people. My boss at the time, a guy named Steve, was very helpful. He had started a number of his own companies. Stuart McClure, the former CEO of Cylance, was amazing. A number of C-Level folks that I worked with at Cylance or started other companies, like the guy who hired me at Cylance is a guy named Eric Cornelius. By the time he left Cylance, he was the CTO. He's now the chief product officer of another startup. Now a number of our original investors were very helpful. Guy, who's the CEO of Sevco, JJ. Guy was one of the people who frankly wouldn't be here without him. I don't think he made a boatload of introductions for me from a venture capital perspective. And so without him, it's hard to imagine things would be where they are. Might have got there eventually, but he was really helpful there. So yeah, I mean, the idea that you do this kind of thing on your own is totally insane and impossible. It took a lot of people to get us where we are.

Andrew Monaghan [00:10:32]:

So then you get going and was there a moment when you're through, I don't know whether product development or hiring, when you're like, you know what, I think we might just pull this off. There's something here that is going to really be useful.

Tom Pace [00:10:44]:

Yeah, for sure. A lot of things were happening from a macro perspective that were really good for us. Like the massive push around SBOMs, software, billing materials that's come out is something we didn't plan on. Obviously, the legislation and all that around there, CISA taking a very big active role in that space was really good. We've built an unbelievable team here, which has allowed us to build an unbelievable product. So we're winning deals with massive companies that are not easy to sell to and we've done that repeatedly now. So seeing that kind of result, we're barely two years into this thing is pretty crazy. We're definitely solving a problem. I guess. I guess this is always the case, but our challenge is just execution at this point. We have the team, we have the product, we have the processes in place, the market's there, we know who the personas are. It's just execution. It's just an execution problem.

Andrew Monaghan [00:12:00]:

Now let's talk about Netrise itself. I'm going to do something a little bit different here, Tom. I'm going to go into limb here and explain to you what I think NetRise does and let you tell me where I've got it completely wrong or where I've got it right. I'm a simple guy from Scotland, so I'm going to use simple words to explain it to myself as I'm doing this. So what I saw looking at this was that we've got this whole class of devices out there that are in various stages of being old, sort of old or relatively new. That the explosion of IoT come in and many of them operate under the model of there shouldn't be much going on on those devices except for just the core functions. And therefore, the firmware becomes an important part of what they do. Right. And that firmware might have been developed many years ago. It might have been developed with different practices involved to develop it. But the feeling so far has been don't touch it. Right? In case you break something. But still we don't know. I haven't known what's going on with that firmware, what's there, what we learned in the last five years compared to when it was developed ten years ago. And I think what Net Rise is doing is coming in to shine a light on that whole class of devices and the firmware that runs them so that people can make good operational versus risk based decisions about is there something we shouldn't do differently based on what we learned about that whole firmware environment? What have I got wrong?

Tom Pace [00:13:31]:

No, I think that's a good generalized explanation of what we do. I mean, it's really about providing visibility and risk identification to a class of devices that historically has had none. And our initial focus has been on this class of devices that we call xIoT, which stands for Extended Internet of Things, which is basically just an umbrella term that encompasses IoT, so security cameras, printers, smart things. Then you have industrial control systems, medical devices, embedded systems and vehicles, satellites and telecommunications equipment. So those are kind of like the six device classes that we view as belonging to the umbrella of xIoT.

Andrew Monaghan [00:14:26]:

And then what did Netrise bring to the party? Then? What's the thing that is the innovation or the uniqueness that you have?

Tom Pace [00:14:33]:

Yeah. So being able to automate the process of analyzing this firmware is very challenging. A lot of this work has been historically done via consulting engagements and things like that because it requires a very kind of specific set of skills and capabilities and analysis techniques that are not easy to acquire or grasp. However, the capability is needed everywhere and it's not able to be consumed by everyone. And that's because people can't obviously afford to have an army of consultants come in and manually reverse engineer all of their firmware that is running on their thousands of devices. It's a totally unscalable approach. And so what we are able to do is automatically reverse engineer is even really the right word because that's not actually what's kind of happening. We can do that. But, I mean, it's more about getting visibility into the specific artifacts and file systems that exist within the firmware and then going through that and enumerating all of the various components and generating an S bomb, as I mentioned. In the past and then taking that S bomb and enriching it with vulnerability and exploit and threat intelligence information so that End customers have better ways to prioritize those vulnerabilities and risks above and beyond. CVSs, which we've all agreed at this point, is not adequate for doing that. And in addition, we provide visibility to a number of other artifacts that are important. Public keys, private keys, certificates, credentials, misconfigurations, binary protections. We give you a search capability, you can export the data, you can do all these different things due to it being a platform. So that's really what we're doing, is attempting to provide you with the same kind of visibility that you expect on like a laptop, desktop or server. But for all of these other devices.

Andrew Monaghan [00:16:48]:

And before net rise, was it just purely a consulting engagement they bring in? Was it Pen testers or engineers to figure it all out? Or were there other ways they were kind of doing it manually?

Tom Pace [00:17:00]:

Yeah, there were and are a small number of companies out there kind of going after this problem in a few different ways. In my opinion, it was and still is overwhelmingly done by consulting companies. If you took all of the work that's happening globally or even in the United States, I would venture to bet there's more money being spent on consultants doing this work than on products doing this work for a number of different reasons that's obviously changing rapidly. Yes, that was the one approach. And then you'd have other approaches for companies that are building these devices where they could integrate in certain capabilities into their dev, SEC ops, pipelines and things like that. So that was like maybe the other approach you would have, but the vast majority of these things were just not being assessed or evaluated at all, I think would be a fair statement.

Andrew Monaghan [00:17:59]:

Ignore a little bit, we got other things to worry about, or they're paying probably hundreds of thousands of dollars to consultants to do it for them. And there's your budget for a person in that rise, right?

Tom Pace [00:18:10]:

Exactly. Yeah.

Andrew Monaghan [00:18:11]:

And when you go to a company, who are you targeting? Who's the buyer who gets this?

Tom Pace [00:18:15]:

Yeah. So we target multiple different customers. I would say our focus right now is definitely around the device manufacturers. They have the most pain in the space. I guess the way I talk about it is it's a painkiller for them, our platform, and we augment either their existing product security capabilities or we can come in and kind of be their product security capabilities in a box. So anybody building a device, so building networking equipment or ICS devices or medical devices or cars or whatever, and then we also sell to the people who are just end users of those devices. The use cases are different, the value proposition is different, the pricing is different. But we have built our platform in such a way that we can serve both of those customers. Now, over time, we'll have to make adjustments and things like that for things that are very specific for an end user versus a device manufacturer. But as of right the second, we're basically using one platform to rule them all. And then we also sell to consulting companies. So companies, those same companies that are doing all that consulting work can now do ten times as much consulting work and provide 100 times more value. So there's an obvious value prop there.

Andrew Monaghan [00:19:39]:

Going back to the manufacturers. You said you remove a pain for them. What's that? Pain. Are they on the hook to know all this and they just can't do it?

Tom Pace [00:19:46]:

Then yes. So if you think about something like Log4J as an example, the overwhelming majority of companies do not have a way in which they can determine where, number one, if they have that component somewhere, and if so, where is it? And if we have it and we know where it is, is it vulnerable? And if we know where it is and we have it and it's vulnerable, is it vulnerable in the context of the device? So these are a lot of questions that you need to be able to answer, like very rapidly. So that's one part of it. You also have just the general S bomb problem where they have their end customers demanding or requesting whatever word you want to use, the list of ingredients that make up a particular device so that's the ability to prioritize the risks and vulnerabilities using something other than CVSs, as I mentioned, and then identifying risks such as open source license misuse or violations. There's 2030 different things that we can provide them all in one spot. That also assists from a tool and product consolidation perspective at the end of the day.

Andrew Monaghan [00:21:03]:

Before we go any further, Tom, let's get to know you a little bit better. I've got a list of questions right here. I'm going to ask you to pick three numbers between one and 35, and I'll read out the questions.

Tom Pace [00:21:12]:

They correspond to 1717.

Andrew Monaghan [00:21:16]:

What's the first computer you ever owned?

Tom Pace [00:21:21]:

I think it was like a gateway desktop. I was in 7th grade, 6th or 7th grade. I'm 38. So what year was that? 1990. 619 97. And man, I think we bought it from Circuit City or something like that.

Andrew Monaghan [00:21:41]:

There's two names that don't exist anymore, gateway and Circuit City.

Tom Pace [00:21:44]:

Yeah, I remember it just blowing my mind. And then I spent a lot of.

Andrew Monaghan [00:21:51]:

Time were you gaming or tinkering around or what?

Tom Pace [00:21:55]:

Yeah, I played a couple of games on it at the time, but I was more tinkering around more than anything. I was one of those people who I clicked on every possible thing there was to click on to figure out how stuff worked. And I quickly realized that you could do some things that were fun and interesting that probably weren't meant to be done kind of thing. So that was fun. I was one of the kids messing around with all the getting all the AOL CDs and getting more free minutes and all that other stuff. So that was fun. Dealing with terrible dial up internet connections and people can't be on the phone and all of those challenges that no longer exist from a computing perspective. But yeah, all over the place.

Andrew Monaghan [00:22:52]:

I love that though. That's launched a career. Your gateway PC right there, right?

Tom Pace [00:22:57]:

Yeah, I kind of always knew I'd end up in cybersecurity, which is a weird thing, I guess.

Andrew Monaghan [00:23:03]:

All right, one more number. Team one in 35 29. 29. Tea or coffee?

Tom Pace [00:23:09]:

Coffee.

Andrew Monaghan [00:23:10]:

Strong coffee. How many cups a day?

Tom Pace [00:23:13]:

Think I'm on my fourth.

Andrew Monaghan [00:23:15]:

You're a coffee lover then?

Tom Pace [00:23:16]:

You know, man, I like coffee. It's like a habit. More than a I don't need it. Trust me, I'm I'm wound pretty tight as it is. Coffee is not what I need. I'm always drinking something, whether it's coffee or like a sparkling water or something, but, yeah, I drink a lot of it, but I'm not one of those people. I don't care about going to Starbucks or any of that.

Andrew Monaghan [00:23:42]:

You enjoy the habit. You enjoy the kind of like the ritual, right? You make coffee, it's nice coffee, and you enjoy it, but that's it.

Tom Pace [00:23:50]:

Yeah, I'm not like a coffee snob or anything like that. Like, great coffee great, but good coffee is equally as great to me most of the time.

Andrew Monaghan [00:23:57]:

Cool. Last number. Team one and 35 33. 33. You can't pick your own company. Which cybersecurity company do you admire right now?

Tom Pace [00:24:09]:

I guess I'm a big fan of what Tenable is doing. They are building this thing called Platform One, and they have, in my opinion, a unique set of capabilities that have come together from acquisitions and other things that I think will be able to provide a very compelling end to end platform experience for a lot of enterprise customers. So that would probably be and they're an older company also, obviously.

Andrew Monaghan [00:24:43]:

Yeah. They've been around for ages, right?

Tom Pace [00:24:45]:

Yeah, they've been around forever. I'm always interested in companies. Like, all new cybersecurity companies are pretty interesting. Of course they are. So I'm always more fascinated in how does a company who's been doing kind of the same thing forever end up doing something new and interesting like that's fascinating to me, I guess.

Andrew Monaghan [00:25:04]:

Yeah. I kind of feel like the last few years have been really interesting in our space because there have been so many new companies coming in and most of them are trying to do things different or you take on things. I mean, who knows how this year will shake out in terms of the funding environment to keep some of them going? But I feel like there's so much going on in our space right now, it's kind of exciting.

Tom Pace [00:25:27]:

Yeah. I mean, it seems like 23 and 24 are going to be are going to be very, like, put your money where your mouth is kind of thing. I mean, companies are there's going to be a lot happening from an acquisition or investment or winding down.

Andrew Monaghan [00:25:51]:

We talked about one important day at a company, which is the starting the founding of the company. Another important day is that day when you win your first real, live paying customer. Take us back to to that moment and and tell us what happened.

Tom Pace [00:26:04]:

Well, we had a design partner. You know, it was a first paying client, for sure. It was what? November of 21 was our first paying customer. I mean, we weren't even a year old, so that was pretty cool. It was I don't know what you a token amount. What to say it was not a big deal would be an understatement.

Andrew Monaghan [00:26:22]:

It was money, though, right? Real life cash.

Tom Pace [00:26:25]:

It was money. Yeah. I got a physical check in the mail. I still have that check.

Andrew Monaghan [00:26:29]:

That's awesome.

Tom Pace [00:26:30]:

Yeah, I'll never get rid of it, so, yeah, it was really cool. I think what's probably a better kind of one to talk about would be we closed the six figure deal, which was our second deal, like, four or five months later, and that was amazing. So that was, I think, when we were like, wow, this is a thing. So we went through a long evaluation process. We built a bunch of capabilities that they wanted, which also were capabilities that other people were asking for. So it all kind of made sense. But yeah, that was a big deal for us, for sure.

Andrew Monaghan [00:27:13]:

And the second one, was that a design partner as well?

Tom Pace [00:27:17]:

Yeah, our product went ga in August of 2022, and that deal closed in June of 22, something like that. So we weren't even ga yet in that neck of the woods. Something like that.

Andrew Monaghan [00:27:34]:

And then how do you think about the sales team that go to market then, Tom, as you're building that site up, when did you know it was the right time to start hiring people?

Tom Pace [00:27:46]:

We probably hired the person we originally brought in was doing more than sales also, so that was helpful. They were able to help with a number of different capabilities within the company from, like, an operational perspective. So it wasn't just out there carrying a bag and carrying a number kind of thing. That was part of it, for sure. It was really once the product got to a place where we knew we were providing a significant amount of value, that was when we knew we had to start bringing people on board. That's what we've done.

Andrew Monaghan [00:28:23]:

And then with that one person, let's just drill into that a little bit. So how did you manage that transition from you doing the work, you being the founder, leading the sales engagements to I want to trust this person with more and more, but you have to get the stuff out of your brain into their brain somehow. How did you manage that?

Tom Pace [00:28:41]:

Yeah, I don't know that it really changed. I'm still very involved in almost every opportunity we're working on to some extent, but it's really about just immersion and the problem. So we have daily calls where we talk about what happened the day before, what's happening today, what worked, what didn't work. So we have a very strong operational communication cadence when it comes to that. So I try to operate under this premise of giving the sales team everything they need. And what I mean by that is I don't want any excuses. As long as something's reasonable like, okay, I need this piece of collateral, I need this customer testimonial, I need whatever this blog. I'll do those things. However, I then expect results. Right? So that's the kind of arrangement and deal I have with folks is, listen, if you need something, okay, but then these are the expectations. But yeah, that's an ever evolving process. And I think as we kind of hit the next phase of the company is when I'll probably begin to take a slight step back from a go to market perspective.

Andrew Monaghan [00:30:06]:

Is it hard to do that?

Tom Pace [00:30:08]:

Yeah, I'm terrible at doing that. I'm the furthest thing from a micromanaging person. I make the joke all the time. Like, everyone at this company is smarter than I am, which is true. So the idea that I could even micromanage them is funny. But I am involved. I am involved in a lot. I could certainly take some lessons from doing a better job at delegating some stuff. What's happened for me has been it's just became a thing that happened organically, which is how things work best for me. Right. It wasn't until the cup was overflowing until I realized that there was too much water in the cup. That's how I am. Even though I can see that the cup is filling up. I don't take action until I absolutely need to, but then that just creates you figure out what matters the most really fast whenever you have too many things to do. So it kind of forces an automatic prioritization of certain things.

Andrew Monaghan [00:31:21]:

I love that idea of constraints force you to think about what's really important. I think I worked at a startup once where it seemed like whenever we wanted money, we had money from various rounds. But I think it actually held us back in many ways because there's lots of things that we're doing with hindsight, that you wondered why we're even doing that at that stage. And someone made a good ask and there was money in the kitty, and it was like, yeah, we'll give that a go. Whereas constraints force you to think about, well, we can't do it all, and we can't even do half of it. So what's the 10% we should be doing and how do we do it best? It's such a powerful lever to pull.

Tom Pace [00:31:58]:

Especially in this environment. Man. Yeah. It's tricky and it's a lot of pressure. I think there's a big difference between stress and pressure. Right. But there's lots of pressure for sure. Making the right decision, selling into the right market, talking to the right people. We had a call yesterday about what's the next big feature we're going to build into the platform. And, I mean, you can make a just really good argument for three of them. That we have customers asking for all three of them. So then the question becomes like, okay, is there a sequence of features that makes more sense? If we build this one, does it make building the second one easier and the third one easier? So you get into these you have to really figure out which one matters most now, like, rate this second. And that's hard because then you're never going to make everyone happy. We're probably 18 to 24 months away from having everything that everyone wants, generally speaking. And then after that, it's just about refining things, I think. But that's how we really feel about because we've moved very fast from a product capability perspective. I mean, the team is just crazy. So it's a good problem to have, but doesn't make it not a problem.

Andrew Monaghan [00:33:28]:

Yeah. When you think about your go to market motions, when you're adding more customers, what's one thing you wish you could solve really easily overnight? That's kind of bugging you?

Tom Pace [00:33:40]:

The go to market is the problem in this space. You know what I mean? There's a lot it's not like people are like, Well, Tom, isn't that always the problem at companies? It's like, no, that's not always the problem at companies. Look at silence. There was no question about what the go to market is going to be at Silence. Right. The former CTO of McAfee is now running an antivirus company. Guys, I think we understand how to go to market, right? We're going to leverage the channel, blah, blah, blah, blah. That's not the case here. The go to market here is the tricky part. Like, how much time do you spend on product security versus enterprise customers? Who's the best persona to sell into? Do people care about having an on prem solution? I guess awareness that the problem is solvable, I guess, is maybe the one thing I would kind of fix is maybe that sounds like, wildly generic, but we've talked to so many companies and we show them the platform, they just go, we didn't even know this was a thing. And that's crazy to me at this point.

Andrew Monaghan [00:34:51]:

Well, I could see that, though, because they've worked for 20 years without it, right?

Tom Pace [00:34:55]:

Yeah.

Andrew Monaghan [00:34:56]:

And they probably and truthfully, know it's something they should work on. But if we can't fix it, what's the point?

Tom Pace [00:35:01]:

Yeah. So I've used this analogy with us multiple times around, comparing us to EDR in a number of different ways. I remember the first time I saw an EDR solution, I was like, blew my mind. I was like, wow, I didn't even know that something like this was possible. This is great. And I think we're in a similar point in the market right now, right. Where EDR was, I think probably fair to say, limping along for a number of years. And then it just went crazy. Primarily due to the cloud based nature of EDR that came around with companies like CrowdStrike and silence and Sentinel one that was the big turning point. Nobody wanted to.

Andrew Monaghan [00:35:45]:

Lots of companies did.

Tom Pace [00:35:46]:

Like Carbon Black was deploying EDR on physical servers and stuff like that. But that was just kind of a pain and that was just the only way to do it initially. So it was fine. That's what I did, the company I was at. But I think that's the awareness of us and our capabilities is probably the big thing.

Andrew Monaghan [00:36:07]:

Let's flip things around. Tom, is there a question for me about the go to market side, since we're talking about that, that I could have a stab at giving you some thoughts about?

Tom Pace [00:36:16]:

Yeah, I think one of the things I think is I'm curious about is how do you see people targeting prospecting challenges and filling the pipeline as it comes to the change in remote work? Now, to me, I'm not a big fan of cold calling, and I think that's kind of I know there's entire companies built around cold calling, so obviously there's a use case for it. But for our specific go to market and sales motion, it seems not the best tactic for a number of reasons. So what are you seeing in terms of reach out to people you haven't talked to before being successful? We have a number of other things we do that work really well. But I'm curious what you've seen from other folks.

Andrew Monaghan [00:37:04]:

Yeah, I think there's 3300 vendors in cybersecurity right now. Right. And everyone's making their noise, usually by trying to use these traditional approaches of let's hire some SDRs, let's give them one of these tools to go and bombard people to emails and phone calls. And through Attrition or Luck or whatever, we might get some meetings booked on the back of it. Right, but I think your observation is right, which is that post COVID where more people are working at home, but also, I think just from being tapped out with just too much, those approaches are working less and less than they were maybe two or three, four or five years ago. It's interesting. So we're recording this on March 7. This morning. I just released an interview with the CEO at Strata Identity, eric Olden. And Eric has built and sold two companies in cybersecurity already. He's now in his third. And at Strata, he had a rule as a seat company and a series a company, no one is making cold calls and sending cold emails. That was his rule. We're not doing that and for the reasons that you talked about. Right. But they had a lot of inbound. And the reason that they had inbound is he doubled and tripled down on the company's ability to produce content and go and be known in the space that they're in. So he wrote himself a bunch of content. They spoke, they did podcasts, they did a whole bunch of things to go and evangelize the problem that they're solving not evangelize necessarily strata itself, which comes by default, but to evangelize the problem that they're solving. And that helped get people to go, God, yeah, that sounds like my sort of company. What they talk about really hits home with me. Let's get in touch. And they obviously got their inbound through doing that. So I think one thing I would say is that if you are thinking about as a company that makes a ton of sense, go and evangelize the problem. So if you get those people, whatever the number is, percentage of the of the audience, 50% who didn't know it could be solved, you're going to hit them better. By being incredibly active in the community and fighting every damn reason you can to go and speak and talk and show up and shake hands and produce content that does all that for you. And then when you do have people who are on the hook for generating pipeline, whether they're SDRs, AES, who might be in your process, what they can do is use that. They can say, there was Tom talking at this conference or Mike talking at this conference, and listen to this section in minute 23 to minute 28. I think that's going to make a difference for you as whatever you are at Honeywell. Right. And here's why I think that, right. So you're actually giving a lot of context and relevance to why you're engaging with people as opposed to just sending these blind, cold things, saying we should talk. You're actually helping your team by doing that kind of company strategy of doing it like that. That's one thing I would say, if you're not doing it already, is figure that out. I've seen companies hire people who are evangelists, and these are not lacking in experience, like at Silence. You guys hired Malcolm Harkins, right? They're someone who's the sort of caliber of the person to hire right. Known in the community, is not afraid to have a point of view.

Tom Pace [00:40:40]:

Certainly not.

Andrew Monaghan [00:40:41]:

No. Go talk about this. I talked to a CEO last year, and I've used this example a few times, but Snehal Antani, he is a CEO at Horizon Three. AI horizon three. I think it is.

Tom Pace [00:40:56]:

Oh, yeah.

Andrew Monaghan [00:40:57]:

Okay. So I taught this. Nah. And I started the conversation, and it was all kind of nice and pleasant. And he was formerly a siso, right. And he decided to start his own company, and he used the phrase, all these chasm tools out there are snake oil. And I know that because I bought them all as a siso. That makes you stop. Right? You're like, Whoa, whoa, hold on a minute. When you stay stakehold. But it got the attention of people. And I think you need, in general, we as an industry need to be more bold in our claims and how we want to go out there and hire the people that can go out there and say, you know what? We're completely missing a whole vulnerability that we have. The belief is you can't do this. We're proving you can do it, and here's how easy it is to do. And by the way, you don't need to spend half a million dollars on a consultant every couple of years to come and tell you the same thing. So someone, I believe, needs to get out there and just create some noise, not be stupid about it, right? But make some noise that people stand up and listen and go, right? And then your salespeople can use that as a way to do their outreach, right? And then when I think about outreach, I think one of the things that is happening right now is there is that movement away from let's send 1000 emails and make 100 phone calls, right? What I would encourage people to do is say, look, you need to get hold of just ten people this month or this week or this two weeks, whatever the Sprint is, right? Let's get each of those people surrounded, is what I call it. Right? So who do they know? Who do we know? What partners are involved? Where have they been before? Where have they talked before themselves? What can we do to sort of learn about that person so that when we are engaging with them, we'll stand out as people who, A, know what we're talking about, and B, know them enough to be able to say, I'm pretty sure we're going to be relevant for you, and here's why, and having that much more pinpoint spearfish. Use a good analogy from our world, right. That's the bit that's going to make a difference as you're doing that at that point. From there, you don't have to rely on cold call tactics. It might be introductions. You might realize that someone in your network knows them. If you say, who knows these thousand people feel like, yeah, whatever. Right? But if you could think the company that says, who knows these five people, then, okay, well, let's figure out who knows these five people, or who I know that might know them and things like that. I think that's the way to be relevant.

Tom Pace [00:43:25]:

I think that's right. I think that's good feedback. Yeah. And we've certainly done a ton of that. I've done boatloads of public speaking and podcasts and a number of other things. So I think that works well. And man, I'm just not a big believer of the traditional marketing spend that exists in cybersecurity. And I think that's going away with what's happening in the venture space. Right. You're not able to raise this crazy amount of capital anymore and growth at all costs is no longer the status quo. So this idea that buying a bigger booth matters. None of it matters. None of it matters. Maybe at the top end it does. If you're IBM and you want to know that the company you're buying from is I don't know, but I just see so much waste that goes on there. I mean, there's all the swag thing, which is just like, who can spend the most money on cheap plastic things that everyone throws away? It's like why? Stuff like that just drives me nuts. So I have that mentality where, guys, we're not giving out any swag. That's useless. Right? So we have beer coozies, the most useful piece of swag. No demand. Right? But the idea that here's a shitty pen. If you're going to give out a pen, give out a great pen. It's like stuff like that, though. Here's a personal hand fan. That it's like, what?

Andrew Monaghan [00:45:07]:

Okay, that goes straight into the hotel room trash can right there.

Tom Pace [00:45:11]:

Exactly. And it's just so much waste and time and energy for no value. I think that's a good thing. At the end of the day, being more conservative with capital and not spending it frivolously is better for everyone.

Andrew Monaghan [00:45:26]:

I think that's a great thing. And as you say, part of the constraints that are going to come down is these are things that are pretty easy to cross off that line in the spreadsheet. Right? It's like, no, right. Here's the five things we think actually might be able to drive some value for us. Quick aside, I remember last year, probably a year ago, when things were still frothy, this pretty early stage company had a job advertised, and I think they had less than 100 employees. They had a job advertised for a swag manager. I was thinking, how much swag are you giving out? You need to employ someone full time to do that. It just seemed a little bit nuts to me.

Tom Pace [00:46:05]:

It's baffling. Yeah. Imagine saying that in the board meeting, like, yeah, we just hired a swag. Like what? What did you do?

Andrew Monaghan [00:46:13]:

Yeah, you know the thing, we need some help hiring some people. We need a new this. We got to need to get a new VP of engineering. We need to get a swag manager. A swag manager.

Tom Pace [00:46:22]:

Yeah.

Andrew Monaghan [00:46:23]:

Anyway, thomas, I loved this conversation. If someone wants to get in touch and keep it going with you, what's the best way to do that?

Tom Pace [00:46:30]:

Yeah, I mean, LinkedIn is always the best approach. Thomas pace on there. I'm on Twitter and stuff, but I don't do anything. I don't do anything on social media, really, but my Twitter handle is at Tommypastry and yeah, reach out emails. Thomas pace at netrise IO.

Andrew Monaghan [00:46:50]:

Okay. And are you planning, even though we just talked about the waste of time and money, are you planning any events this year such as Biggest Black Hat or even RSA?

Tom Pace [00:46:59]:

Yeah, I mean, we'll be at both of those events. We're not doing a booth at RSA. We'll have one at Black Hat, but we have a ton of dinners and more like strategic things like that, relying on a bunch of partnerships. We have with much bigger companies. So that's another angle we've taken, but we will be at those events for sure.

Andrew Monaghan [00:47:23]:

Awesome. Well, I encourage everyone to look out for you guys there and connect and learn more about what Net Rise is doing. Tom, thanks for joining us today.

Tom Pace [00:47:32]:

Thank you, sir.

Andrew Monaghan [00:47:33]:

Well, I really enjoyed that interview with Tom. What a compelling person he is, working, creating Net Rise with his co founder to make a big impact. I had three takeaways that come to mind immediately. One is this idea that they're tackling an underserved part of the market with all the hype right now about cloud security and all the players jumping to all the submarkets in cloud. Sometimes it's what might be seen, the more boring parts of the market where you actually have a bigger impact. Right. And tackling things that have been assumed in the past, can't be fixed, won't be fixed, shouldn't be fixed, whatever it might be. And actually coming in with a fresh approach and a fresh pair of eyes from modern days, as opposed to things that were thought of 1015 years ago, can sometimes have a really big impact. And I think that's what Netrise is doing and whether to have the biggest impact. Second thing that I took away was when I asked Tom about the advice and the support that he got early on, he said, the idea that you can do this on your own is ludicrous. Right? And he listed out all those people that had been advisors and connectors and people that came in to help them out in some way, I think is so important, especially as a first time founder, having people that have done this before, coming in and giving that advice is so important. He said even like his old boss at Silence had done a couple of companies before and were able to give advice. Stu McClure, who was getting advice, JJ. Guy was getting advice. All these people were the ones that were helping out. And as he said, I think he said specifically for JJ. Guy, it wasn't for him, Net Rise might not exist because he was the one that delivered a whole bunch of introductions to the VC world. So they got their first round of funding. And then I think the third takeaway for me was what we talked about at the end there being different and being bold is so important, we think not just about the product, but also how we go to market too often. I think what we do is we kind of default to the old ways, default to what we think is proven. And it might be proven ten years ago, but it might not be proven right now. Right? And that whole thing about, well, we need to get a bunch of SDRs and we need to start getting some A's on board, and then they'll just pound the market. I think anytime you think different to that is going to pay off at the moment, there's not many companies in cybersecurity right now, certainly startups, who are deploying a bunch of SDRs and seeing an incredible return from that. They're either failing or they're working okay. And very few are stellar performances. So thinking about with a constrained budget and resources, what can you do to be different is where things might pay off. And the phrase I've heard and used myself in the past is different and better than better, right? And using that, let's be different, let's be bold and try and get more than our fair share of attention out there, I think is going to really pay off. So that was a great conversation. I really enjoyed chatting to Tom, hearing about his views, what's going on in Net Rise, how they're thinking about this part of the market. And I wish them every success for the events they're doing this year at Black Hat and all at RSA and for 2023 and beyond.