At StartupSac’s Cybersecurity and IoT virtual event in October, a panel of cybersecurity experts offered an abundance of great advice for aspiring cybersecurity startups. The panel was moderated by Carmen Marsh and featuring cybersecurity experts Malcolm Harkins, Matthew Rosenquist, and George Usi.
Advice for Aspiring Cybersecurity Entrepreneurs
After earlier establishing that Sacramento is a great breeding ground for technologies like cybersecurity, the panel explored advice for people interested starting a cybersecurity company like this in Sacramento area.
CISO and Cybersecurity Strategist Matthew Rosenquist weighed in first saying, “Part of it is taking that first step and really reaching out to your community, the technologies that you know and love or want to use or the frustrations that you have. I’m a firm believer that innovation is really drawn from frustration, with the things that you’re going to do. If it frustrates you, chances are it frustrates somebody else. So the first step is really reaching out to those other people and insights within the community and seeing what are those opportunities, what are those things that need to get fixed. Find that squeaky wheel.”
George Usi, CEO of cybersecurity startup Omnistruct, shared his approach, “Having the right, what we call, mindset is so important because it really is important that you understand that owning a business and starting a business is a combination—and pardon the expression—in cybersecurity it’s a combination of an air war and the ground war. So you have mindset and footprint, and both have to be balanced. Mindset comes first—what are you passionate about? Then you have to understand research. Is there a need for my product? And you have people in this community, a lot of us with gray hair, who have significant contacts and relationships not just in Sacramento but throughout the globe. So try to find where those people are.”
Chief Security & Trust Officer Malcolm Harkins has run security in both big and small organizations for over 20 years and offered his perspective for startups entering the cybersecurity space. “I’ve spent a ton of money on security solutions and products and services and what I would tell people is they need to deliver a real business outcome. Don’t sell me a feature because you think it’s cool. Don’t give me a tool that doesn’t do what it says it’s going to do. Don’t make it complex for me.”
Harkins went on to outline the three business outcomes that he looks for when buying a cybersecurity product or services. “The three business outcomes I’ve always looked for when I’ve bought a service or a capability are on three vectors. One is risk. A good security product creates a demonstrable and sustainable bend in the curve of risk. If it doesn’t do that, it ain’t a good product. The second thing is, a great security product will lower the risk but allow me to long-term lower my total cost of controls. Me spending money on security in an organization doesn’t add to that organization’s net income and so a great product will lower risk and lower cost. And then the third one is, there’s not many security solutions out there that users in business say help them perform their job. So there’s a notion that I call friction. If you can reduce the friction on the business velocity and reduce the friction on the customer journey then you have a hero product. When you do all three of those, for me I will always buy something that does all three of them. I’ll be semi interested in doing something that solves two of the problems. And by and large if it just solves one of them, I don’t want it.”
The Importance of Building Trust and Credibility
Rosenquist built on the Harkins’ three business outcomes and emphasized the importance of building trust and credibility. “It really kind of depends on building up a good social network and and having good credibility… When you’re able to solve risk, and cost, and usability or reduce friction, you know you’ve got a huge winner. But if nobody knows about you or nobody trusts you, it’s really tough to get in the front door. So building your credibility and your trust really from day one.”
Rosenquist also explained that there are things that entrepreneurs should avoid. “One of the things that is a huge pet peeve of myself and all my colleagues is the the bad marketing or salesmanship. “I want to solve your security problems. I’m going to make these outlandish claims just to get your attention or to claim something that you’re really not going to deliver.” Once you burn those bridges, because we’re in security, trust matters, to us you’re never going to get our ear again. So even before you get to that point you better start building your reputation you better make sure that you know what you’re saying and what you can really deliver.”
George Usi has worked in both the public and private sectors for 15 years and offered his advice. He suggests the approach of being a helper.
“Generally the answer, especially in this area, has been be a helper—be willing to give away a little bit in order to see a long-term return. You need those references, so if you’re truly in at the ground level trying to build up those customers, you will have to help people, and that is part of building credibility. The other thing is that to be successful as a helper you have to tell good stories because even offering something for free doesn’t mean Malcolm is going to say yes or Matt’s going to say yes. I think Malcolm said it very well—you need outcomes and you need to to smack down two or three objectives. I’ve been in situations where I’ve seen entrepreneurs build the ‘Field of Dreams,’ pardon the expression to Kevin Costner in his movie, but it’s true—you do have to make sure that you know that field of dreams function really requires good storytelling around how your products solve those solutions.”
Harkins suggested adding experienced advisors to your team. “Getting advisors, people who actually have sat in the seat of a Chief Security Officer, Chief Information Security Officer, that will add credibility. It’ll add reach.”
Rosenquist added, “Most people in the industry are willing to share with you. I look at least two, sometimes three times a week at new different technologies and investment groups and so on and so forth and we give feedback. Whatever you develop may not be perfect, but you’re gonna start getting the feedback. If you’ve got a good reputation people will spend the time and take that feedback on and see how it can help you change, modify, or improve whatever you’re offering to better align with the current and the future needs of your intended audience.”
Harkins agreed with Usi on the importance of clarity in explaining a product “I think George said it perfectly on storytelling. In every field, a confused buyer, a confused mind never buys. So if you’re confusing people in your messages, and it’s not clear, they’re never going to buy. So you’re going to have to always have in what I’d say in your hip pocket, what I call a 30-3-30. What’s your 30 second sound bite? What’s your three minute elevator pitch, and what’s your 30 minute deep dive. All of those things need to build on each other in a way that doesn’t confuse the mind of the potential buyer.”
Rosenquist agreed on the importance of advisors mentioned by Harkins. “Advisory boards, even for small startups, are hugely important. There probably are not one or two founders out there that know it all, get it all and have all the right contacts. So forming an advisory board and getting people on those that can fill those gaps and provide those insights, and even behind closed doors give that critical feedback, that constructive feedback. Good advisors will help you with your 30-3-30 right. They will help you with the communication. They will show you the nuances of not only the terminology, but how you need to approach, what are your strengths and weaknesses, and everything else. Good advisors are tremendously valuable,” said Rosenquist.
The Importance of Connecting to Your Community
All panelists felt strongly about the power of connecting with the local community. According to Rosenquist, “There are communities out there and there’s resources that have already gone down this path. So don’t try and forge the trail by yourself. Leverage what other people and other experts have done.” He went on to add, “The most important resources you have as a startup is your time and you can’t be making a lot of mistakes, and you shouldn’t be falling into the pitfalls that other people have already put signposts around. So again, it’s a matter of working with your community understanding for the technology or the services that you’re developing and working within that community, as well and making those steps forward, getting organized, having your goals and pursuing them relentlessly. Again, the community will sometimes give you that emotional and mental push. Everybody has a bad day. Everybody wants to give up. When you surround yourself with other entrepreneurs and other people and you get to see the successes of the people before you, that keeps that internal spirit going.”
Harkins reiterated the importance of connecting with a community that can support an entrepreneur on his or her journey, saying, “You might be a technologist and you don’t have the business acumen. You you might need some of that rounding out of skills. I would look to go figure out how to get into a community that’s helping entrepreneurs round out their skill sets so they can be successful.”
These are but a few snippets of advice for cybersecurity startups from the panel of experts. For more, check out the video of this panel discussion.
