Jay Kaplan: In Hackers We Trust

Getting over the you're crazy moment, right? When we first walked into some of our early customer prospects, they basically said, you guys are nuts. I mean, come on, you're like, who are you? What is this company? You're two random dudes from Washington D.C. and you're asking me to basically employ hackers and they're going to go hack my stuff and they're going to tell me what the problems are. How do I trust them? How do I trust you? Who are you? Well, it turns out actually coming from the nsa, it gives you a lot of credibility. And they start to listen. And what we found was really talking about our experience at the NSA and telling them that this actually aligns to a lot of NSA's methodologies. Right? NSA employs massive amounts of data. They use that data to largely drive a lot of their intelligence missions. They have really, really smart, motivated individuals. Those individuals are, they're not paid that well, but the mission is so exciting that they're willing to come in even at two in the morning and work on these projects. And so that analogy resonated with our early customers and they said, all right, maybe we'll give this a shot. Certainly we're not the first ones to say, trust us, we're from the nsa. Right? There are a lot of companies doing that. This was a Forbes article where they did a whole spread on ex NSA and ex Israeli intelligence folks that started companies. It was kind of cool. They put on a trench coat, by the way, I stood in front of a blue screen and then they photoshopped that together. So it's not as cool as it looks. But anyway, so we started to mature. We started to go from that's crazy to wow, this might actually work. Right? And the way we convinced customers to try it was say, we'll do a proof of concept or a proof of value with you just come in. We'll work for a seven day period. We'll launch our cadre of security experts at you. We'll tell you some of the problems over that seven day period and we'll show you there's massive gaps in what you're doing today and what we're able to do for you. The problem we didn't anticipate, and this happened with one of our very early customers, was that some of their environments are so bad that it actually scared them. So there is one pretty large company. We basically found over 100 vulnerabilities within seven hours. And that customer was like, holy crap, this is my job. It's to protect this application. And clearly, I'm doing a pretty crappy job, right? So for them, they actually went silent. Like, we emailed them, we called them. They're like, they wouldn't answer our phone calls, and we're like, what's going on? We thought we did a great thing here, but the reality is they were so scared that they refused to talk to us because they were scared of losing their job. At the end of the day, we figured out other people in the company to go to and everything was okay. We remediated the problems, and we ended up taking more of a low and slow approach. We kind of scoped out the work so that we would do a small piece at a time, and they're still a great customer of ours today, so it's a great success story. But it was a little bit scary, right? And we freaked out. We're like, oh, my God, did we do something wrong? Are they going to sue us? A lot of crazy things happen in the early days of a company.