Since we started CISO Series, we understood selling cybersecurity products is quite difficult. But, it’s compounded by the trend that large companies, not smaller ones, are often the first to adopt new solutions. But that adoption rate is also hampered by the traditionally risk averse nature of enterprise businesses. How can and do small startups cross that chasm?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining us is CISO Series reporter and CISO herself, Hadas Cassorla.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:38.789 

[David Spark] Since we started the CISO Series, we understood selling cybersecurity products is quite difficult, but it’s compounded by the trend that large companies, not smaller ones, are often the first to adopt new solutions. But that adoption rate is also hampered by the traditionally risk-averse nature of enterprise businesses.

How can and do small startups cross that chasm? Because they do do it. 

[Voiceover] You’re listening to Defense in Depth. 

[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of the CISO Series. And joining me as my co-host for this episode, you may have heard him a few times before, it’s Eddie Contreras, senior executive vice president and CISO over at Frost Bank.

Eddie, say hello to the audience. 

[Edward Contreras] Hello, audience, and David, thanks for having me back again. I think we’re on a roll here now. 

[David Spark] We are on a roll. You’re doing fantastic. Our sponsor for today’s episode, a spectacular sponsor with the CISO Series, and that is ThreatLocker, Zero Trust Endpoint Protection Platform. They’ve got a suite of products to help build out your zero trust program.

More about what ThreatLocker is doing a little bit later in the show. But first, Eddie, cybersecurity is an odd place for startups. It’s one of the few industries where new solutions are first adopted by large enterprises and then filter back to smaller organizations.

Yet, as Ross Haleliuk of Venture in Security pointed out on LinkedIn, enterprise organizations are still the most risk averse. So, how do cybersecurity startups get that first adoption and then bridge the gap between their large enterprise early adopters who often have niche-based concerns and really the rest of the whole market?

Have you seen this behavior happen? 

[Edward Contreras] I’ve seen it happen. It’s one of these areas where you could probably get a PhD if you know how to break the formula. I think those companies that really master Salesforce and understand the clients that they’re looking at may be extremely helpful.

This is where I think a lot of times pre-work really does help save months and months of potentially ending up on a dead-end street. 

[David Spark] And we’ve, by the way, talked about this in some past episodes of CISO Series Podcast, how CISOs love to work with startups because the startups are so eager to get that first big customer that they will do backflips to turn the solution into what that customer wants it to be, which is kind of a double-edged sword, which we can get into later.

All right. Joining us for this very conversation, very excited to announce this for the first time on this show, brand new reporter with the CISO Series, and a CISO herself, of which she’s been a guest multiple times on our other programs, and this one for that matter.

It’s none other than Hadas Cassorla. Hadas, thank you so much for joining us. 

[Hadas Cassorla] And the village rejoiced. [Laughter] Thank you for having me. And thank you for letting me join your bunch of reporters. I’m very excited to get started with that. It’ll be fun. 

[David Spark] It’s going to be awesome. As will this episode. 

Who are the winners and losers? 

3:51.232 

[David Spark] Patrick Garrity of VulnCheck said, “This is more reflective of market failure to build products that scale across market segments. Organizations tend to choose toward optimizing for large enterprises and big deal sizes, hence the security poverty line that’s been created due to these dynamics.

So, SMB MSP represents a huge untapped market.” And Peter Ho of Prudential Financial said, “There is a security poverty line. Most SMBs cannot afford or understand the cost of cybersecurity. In addition, the value of security is hard to quantify as it doesn’t matter until it does.

So, being the case, security products need to start with large businesses first, then scaling over time. Enterprises have the hardest environment since they are so diverse internally with complex needs and size.” So, I think both Patrick and Peter kind of set this up pretty well, Eddie, in that it is complex to enter the market with a product and find that first customer, and also it is complex for an enterprise to bring it in, and it is sort of difficult for a startup to get security.

It’s all the things happening at once, isn’t it? 

[Edward Contreras] It’s kind of like watching kids on a playground playing Double Dutch for the first time. There’s timing, there’s complexity, there’s speed, there’s a couple of bumps and bruises, but then at the end of the day, ultimately you get in.

And I think when you think about these small startup companies, it’s very similar. They have to understand, what am I looking for? When do I need to deploy it? When does security become part of the equation versus a hindrance versus you’ve built too much too early on?

There’s so many analogies to use here, and it’s just really interesting to understand that security has not only a place, but a time to be introduced. And that’s where I think when the analogy comes out around ponds and the fishes in the ponds, are you the big fish in the pond or the little fish?

That’s always true because you may not want to start with security as part of your design concept, and in that case, you may eliminate certain customers. You may want to start with security from the beginning, but then it eliminates the exact opposite set of customers.

So, you really have to understand what your initial target base is. 

[Hadas Cassorla] I really love this Double Dutch analogy because when I watch people doing Double Dutch, I’m like, “I’m a klutz. I’m just going to break my face.” And that’s what a lot of the SMBs are saying also when they see all of the varying security tooling and they’re just not sure what to get and how to spend their money.

It’s expensive. And so, they are waiting for the larger enterprise companies to make those decisions and trickle down. And so, I think that if you want to be successful to break into the market as a startup security solution, you really have to define what your product is, what it’s solving, and who your customer is, both in size and in vertical.

And I think if you can do that, you have a better story to tell, to approach the SMBs and say, “Actually, we’re going to grow to an enterprise-level solution, but really, we’re here for you. We’ve created the solution for you.” And there’s more clients in the SMB space.

So, that’s actually a smarter way to go anyway. 

[David Spark] Well, it all depends on what niche you’re filling here, Hadas. I mean, because sometimes these niches are desired first by the enterprise. And also speaking for vendors, I can think of one vendor in particular, they really early on get a huge, huge first client and that made their business because once they were able to drop that name, which they were allowed to do, the floodgates open.

[Hadas Cassorla] Sure.

[David Spark] I understand there’s a value of creating a product for the SMB market but getting that one big blue-chip client can mean everything. 

[Hadas Cassorla] 100%. If you can go viral, go viral. But if you’re trying to hit that 1 out of a 1,000, good luck. Or even 1 out of 10,000, good luck. 

[Edward Contreras] I’ll add to that as well, and this really puts a lot of weight on your executive and your CISO team. A lot of times you’re in a meeting, and people give you that bewildered look of, “Why did you ask that question?” One of the questions that I always ask is, “Who are your customers?” And you don’t have to give me the name, but if I know that your number one customer right now is in the government and you’re FedRAMP certified, I am now a small fish in that big pond.

And regardless of what engagement I have or what contracts in front of me, I’m not going to be as influential as that customer. So, I think if an SMB is trying to understand how to get value and bring in a new technology vendor, there are very specific questions you have to ask, and David, you have another show that allows this to happen where you listen to CISOs talking to vendors.

You get to catch onto some of those things that are being asked, and it’s not always because it’s a technologist diving into solution. It’s first of all, are we a good partner? Is this a good marriage? 

[Hadas Cassorla] Yeah, I do think though that really defining your space, what problem you’re trying to solve, will help with that as well because if you really understand the problem you’re trying to solve, people will want to have you solve it. 

What needs to be considered? 

9:13.827 

[David Spark] Akhilesh Dhawan of A10 Networks said, “Security solutions require very specific skillsets to deploy and manage properly. Most of the large enterprises have these skillsets in the house; however, SMBs lack IT resources that are trained in security.

They depend on service providers to address their security needs. The speed of adopting security solutions in SMBs depends on these service providers, and hence, you see slower adoption as compared to large enterprises. Not the only reason, but in my experience, one of the big reasons.” Dawn Bradley of SecurityScorecard said, “The VAR channel has changed in the last 20 years, making it difficult for smaller cyber tech companies to gain traction and leverage the growth factor by using the channel.

The big resellers own the enterprise and mid-market relationships and have a pay-to-play mentality. It wasn’t always that way.” I don’t know about that sort of last phrase of pay to play, but I’ll start with you, Hadas, in that is it the market itself, this sort of dynamic of the way the VARs are playing and how the enterprises have so much weight in that, “Well, if I do take you on as a customer, I’m not going to be able to give you as much attention as an enterprise.” Does the market itself sort of hurt the SMB buyer, if you will?

[Hadas Cassorla] I think that this comment by Akhilesh is actually really spot on. It’s not just that the market is preventing some access to itself, but it’s also whenever I consider having a security tool come into my environment, I have to consider how many headcount I need to bring in with it.

And so, it’s, I think, on the security tool startup’s shoulders to make sure that integrations, implementations, and care and feeding of their products are fairly simple or that they offer some sort of managed service with their product. We’ve gone through roller coaster in the industry of, “I can’t find any talent I’m trying to hire.

I need more talent, more people, more people,” to now I can only have the headcount I have. And so, they need to be able to do this stuff even if I add new tooling in or it needs to lower my need for headcount. And so, I think that a smart thing for the tooling people, the startups, to think about is what does this look like from the user side and how can I make it easier to adopt into an environment?

[David Spark] That’s a key thing. First, Eddie, how many times have you heard this line – our tool is so easy, it gets you up and running in 10 minutes? 

[Edward Contreras] Never heard it, not once. It’s never even part of a sales pitch. I think that you can just Google that and that just comes on, but the second bullet point on Google page number one. 

[David Spark] Right, but nobody believes that because it never actually happens. 

[Edward Contreras] It doesn’t. I was part of a company one time and when I came in, I did talk to the team and I said, “Let me do my 90-day evaluation, understand where we’re at.” And understanding the complexity of some of the tools that were in the stack already, understanding the skillset that was present within the company, I immediately understood we have to go through a divorce with a couple of these vendors.

Great, they were the top right quadrant of Gartner. Great, they were the shining star that everybody wanted. Bad, the company didn’t have the skillset to support the toolset. And so, being able to understand when you’re bringing technology in, if a company’s investing heavily in user-friendly interfaces and less on language and coding and really getting that expertise, skillset involved in the product, you’re really starting to define who your audience is.

You’re defining who your target customers are going to be. 

Because if you have a product that requires a language knowledge, a skillset, it needs to be integrated into a stack, you’re targeting enterprises. If you have a very easy drop-and-drag user interface where it can code on the backend and allow entry-level people, you’re probably targeting the SMBs.

Yes, you can find them in both markets, but typically your bread and butter is based on some of those initial investments that you’re doing. And so, you have to be wise in where you’re putting your money. Ultimately, you’d want to have it all, but out of the gate, you have to come out with a product that you know who your audience is going to be.

[Hadas Cassorla] Yeah, and I also think those SMB companies generally use managed service providers, MSPs, for their security services, and so I think that that’s another avenue to try and integrate into the market to try to open doors is have MSPs adopt your security tooling and learn how to use it.

And that can also teach you how to make it more usable. 

Sponsor – ThreatLocker 

14:04.728 

[David Spark] Before we go on any further, I do want to tell you about our spectacular sponsor, and that would be ThreatLocker. If you don’t know about them, you need to know about them. Give this a listen. In cybersecurity, we all know that seconds matter.

Precision matters. And that’s why ThreatLocker is up in the game again. The company just launched a new set of solutions built for teams who need to move fast without compromising security. It’s zero trust, but without complexity. Okay, first you got ThreatLocker Insights.

You get real-time intelligence from millions of endpoints worldwide to empower you to make the best, swift cybersecurity decision on what applications to allow and what controls to put in place in your environment. Patch management? Well, instead of chasing updates and manually approving patches at 2 a.m., ThreatLocker takes care of it for you, with the rigorous research and testing you need to stay compliant and secure.

Cloud control adds an essential layer of defense, further closing the gaps that phishing and token theft campaigns love to exploit. 

They’re also making life easier for IT and security teams with the new User Store, a smart way to give users instant access to pre-approved software while maintaining the strong security of your environment. And for web threats, well, Web Control lets you block sites you don’t trust, or users should not access from the workplace.

It blocks unapproved content by category, not URL by URL. So, of course, you still get ThreatLocker’s 24/7 US-based Cyber Hero support. It’s fantastic. No scripts, no waiting hours for answers. They deliver world-class swift support responding in about 60 seconds.

It’s kind of incredible. So, it’s no accident over 50,000 companies now trust ThreatLocker to help them harden their environments against modern threats. If you’re serious about tightening your defenses and getting a platform that doesn’t slow you down, check out threatlocker.com to learn more.

Tell them that the CISO Series sent you there. 

Is anyone happy with this solution? 

16:09.039 

[David Spark] Nikoloz K. of Mambu said, “I’d add from another angle, influential organizations like Gartner tend to focus on large vendors that can generate significant revenue and long-term partnerships. This dynamic puts startups at a disadvantage compared to large cybersecurity vendors.

As a result, innovation from startups may struggle to gain traction until bigger players catch up and potentially acquire them. Most innovative solutions can’t reach mass adoption, stifling the very progress needed to address evolving requirements and threats.

Breaking this cycle will require a concentrated effort to support and elevate promising startups.” I would stress that last line is key. I mean, there has definitely been analyst debate around the Magic Quadrant and how do startups break in. And by the way, the conversation we have with vendors all the time who are interested in sponsorship with us is, “We have this great product, nobody knows we exist.” I mean, this is a common issue.

And yes, there are going to be major players that sort of are the kingmakers like Gartner, aren’t there, Eddie? 

[Edward Contreras] There are, right? And I’m going to let a little-known secret out. So, I work in the financial industry, and the Gartner Magic Quadrant was not built for everybody, and that’s the secret. It really is something that most regulated companies can refer to and say, “This is why I chose the product or didn’t choose the product.” And it really helps with your examiners or your regulators, or those that have oversight from a governance perspective to make sure that you have the proper equipment there.

It’s less to do with a small- or medium-sized business that says, “Hey, I chose the Gartner top right quadrant so therefore I should be better off.” 

Most of the companies that are coming out of the market, whether you’re on the chart or not on the chart, you probably have a really good product, and you’re going to get some good feedback. It’s just really the marketing that really helps some of the adoption rates go farther.

But the reality is that quadrant, it’s there for a reason. There are groups that paid for that, and it’s probably not aiming at the SMB area. It really is a different area that likes to refer to that as part of their technology stack as opposed to a technologist or an innovation company saying, “Well, we chose somebody in the top right,” or some of the disruptors that are coming out.

I think it’s less of that. 

[Hadas Cassorla] I agree. I feel like a lot of CISOs, maybe we’ll look at the Magic Quadrant to just see who the players are in that area or to see what they offer in those specific solution sets, but not necessarily to choose their solution. And I think especially, again, we talked about this in the previous one, which is if you can go viral, go viral.

If you can hit an enterprise, hit it. But if you’re trying to break into the industry, SMB is the way to go anyway. And SMBs can’t, a lot of them, can’t afford [Laughter] the security solutions that are paying to participate in Gartner. Aim for the moon but be okay with reaching the clouds.

[Edward Contreras] I think this is something that a lot of companies, specifically the SMBs, have to answer themselves is understanding how your technology stack is constructed. You can have some disruptors, you can have some leading technologies, you can have some innovators, you can have a splattering of all of those.

What you don’t want is all of them in one quadrant because that’s going to be a challenge for any company, any SMB that’s out there. If you’re aiming at just one quadrant, then you may have overspread yourself in that environment. So, you do have to understand how to analyze your tech stack, how to introduce some of those disruptors, some of those innovators, and get them brought into your tech stack, but don’t be overwhelmed with them.

You do have to have some type of balance. 

What’s the next step? 

20:00.338 

[David Spark] Robi Papp of Upwind Security said, “New technologies come out to address threats/issues that the most sophisticated organizations face. Their early buyers replace their homegrown hacks, then the capabilities get commoditized over time and down market.” So, that seems like kind of a traditional way a lot of markets operate.

Bryan O’Neil of runZero said, “Enterprises will often start small for new technology to prove it out internally and expand more broadly with validation.” That seems good. “When driving a new security category or disrupting an existing market, this land-and-expand motion is critical.

SMB and mid-market can adopt across a whole organization while still keeping the implementation and rollout to a simple scope versus complex enterprise environments.” Good point. “It’s unique, but not impossible to have an offering that is a fit for this wide spectrum of markets.” So, Robi in the first comment here, Hadas, said something that kind of sounds standard for most businesses in general, but Bryan brings out the point that it’s just about showing you can do it and then you can start to expand.

What do you think? 

[Hadas Cassorla] I think that’s true, but also, I don’t think Bryan goes far enough, especially now. Agentic AI is going to replace some of these security solutions, especially as they are smaller and built for smaller environments. 

[David Spark] Just to give Bryan a little bit of coverage here, this comes from a discussion that was from a while ago. So, it’s possible that agentic AI was not really on a lot of people’s radars. 

[Hadas Cassorla] Certainly. And he’s still right. I just think that he’s not all the way there, which is, yes, you can scope out smaller. And this is what I was saying earlier about making sure you really define your vertical so that you understand their data, you understand what their issues are.

You really understand which size of customer you’re dealing with. But you also need to think about, can they build this internally for a lot cheaper without me? I actually have a scenario with one of my firms that I was a CISO for, where we got rid of a security tool that we had because we were able to, through a hackathon, build it ourselves to be sufficient for our SMB, and we saved $45,000 because of that.

So, I do think you really need to understand what you’re solving, who you’re solving it for, and whether the build-versus-buy conversation happening at that company is going to go towards buy. 

[David Spark] I throw this to you, Eddie. What’s your take? 

[Edward Contreras] There’s a rule, the 80/20 rule that a lot of people acknowledge and sometimes run their businesses by. You solve for 80% of the problem knowing you may not satisfy the other 20%. And I think some of these smaller companies may have to adjust that rule a little bit.

Maybe it’s a 60/40 rule. Maybe it’s something a little bit more custom to what they’re doing because you’re right, the complex enterprise, they may have 15 different operating systems, and a small company may not. They may have two. And so, if you understand that your product cannot support all the complexities of a larger enterprise and you just don’t aim for them right now, you should be fine to come out of the gate with a smaller product that can satisfy the SMB market without having to deal with all the complexity of the large enterprise.

So, that’s where I would give advice to maybe the sales folks is don’t oversell your product. Acknowledge what you can do but also acknowledge what it can’t do. Because the last thing you want to do is go through an RFI or an RFP, portray that your product can compete with the Microsofts or the CrowdStrikes of the world, and then when it comes down to it and they start to actually put the product against another product, they realize, “Oh, yeah.

We don’t support AIX. Oh, yeah. We don’t support mainframe. Oh, yeah. We don’t support containers.” All of that would have been just nice to know upfront and most likely, you could have won a bit had you not tried to overcomplicate the process. And so, I do think that’s a part of that scenario.

[David Spark] But I’m going to come back to something that I said at the very beginning of the show, and this is what makes a startup very attractive. If your organization is looking for a very sort of unique solution, and there is a startup that’s say 70% of the way there, you bring them in and you say, “Hey, if you can get it to this position, what we specifically want, would you do it?” Now, what we’ve heard from a lot of CISOs is, “Yeah, the startups will do backflips to get big company XYZ to do it.” So, that may shift them in a different direction, but it will get them to have a big feather in their cap, and then they can start solving all the other issues that you were addressing.

Isn’t that attractive to a CISO, Hadas? 

[Hadas Cassorla] 100%. If I can get a company to come in with a mostly fleshed-out solution and also get them to prioritize me on their roadmap? 

[David Spark] Yeah.

[Hadas Cassorla] Yes. Yes, please. 

[David Spark] That’s why I think this path is still very attractive, Eddie. Yes? 

[Edward Contreras] It is attractive, and I think it’s a part of the ecosystem. Just I caution the smaller companies, R&D’s expensive, being able to provide some type of certification on your product is timely, and if you don’t have expenses and time in your corner, then being able to bring in a customer who has a wish list or even a small company that’s solving a very unique problem that you did not plan for can be disruptive, right?

And so, that’s where you see a lot of small companies are forced to sell because they were just really catering to a single customer. They’re forced out of the market because they didn’t maintain what they came to the market for. And so, it is something where I think you do have to hold onto what you started and yes, you can be influenced by some customers, just manage the influences.

[Hadas Cassorla] For sure. If the startup is relying on my company for 90% of their income, they aren’t doing business properly. 

[David Spark] That is also true. 

[Hadas Cassorla] Right. Having said that, if they are managing me well, I’m helping them build their roadmap. I’m also probably helping them with warm handshakes to people in my scenario as well and can help them grow their business. 

Closing 

26:21.998 

[David Spark] All right. We have now come to the portion of the show where I ask both of you, which quote was your favorite and why? I will start with you, Hadas. Do you have a favorite quote and why? 

[Hadas Cassorla] Absolutely. The quote by Akhilesh Dhawan, that “Security solutions require very specific skillsets to deploy and manage properly.” That entire quote I love. One, because hat tip to Liam Neeson, right? But also, because it really brings up a very huge problem for the company you’re selling to and a reframing of security solution tooling, which is how do I make this easier for the customer to adopt?

How do I consider what integrating running looks like so that they can get off the ground? And the easier you make that transition, the easier it is for adoption. 

[David Spark] Very good point. All right, Eddie, your favorite quote and why? 

[Edward Contreras] I’m going to go with Peter and a shout out to the financial industry over at Prudential. So, shout out to him. I really liked the phrase “security poverty line.” 

[David Spark] Which by the way, tip of the hat to Wendy Nather, who coined it. 

[Edward Contreras] It’s amazing. When you can bring that into a conversation and quote that phrase, it’s phenomenal, because I think that’s one of the realisms that a lot of companies have to understand. That there is a poverty line and at some point in time, you’re going to reach it.

So, you have to manage that partnership with your vendors. No one has an endless budget. Even the largest enterprises out there, at some point, they’re going to hit that line. So, knowing your poverty line, understanding where it’s at and understanding when it’s appropriate to cross it and when it’s not.

I just love the phrase. 

[David Spark] As do I. That’s why we’ve quoted it often. Well, thank you very much, Eddie. Thank you very much, Hadas. And more importantly, I also want to thank our sponsor and that would be ThreatLocker. ThreatLocker. Remember, go to threatlocker.com.

Your zero trust solution. They have actually a suite of products that can actually help you with your zero trust effort. So, go to their website, threatlocker.com. And let them know that you were sent over there by the CISO Series. Huge thanks also to our audience, as always.

I say this often, it gets repeated, it may sound pat, but I truly mean it because technically the show does not exist without you. We greatly appreciate your contributions and for listening to Defense in Depth. 

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.