Jon Gelsey: Building Auth0, the only PLG company in cybersecurity to achieve a multi-billion dollar exit

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haliluk.

And I am Mahendra Ram Singhani.

We've spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors Building the Future of Cyber.

Our guest today is Jon Gelsy, the former CEO of Auth0 and Exnor. Jon was the first CEO of Auth0, a leading identity-as-a-service platform. Under Jon's leadership, the company grew from 5 to 300 employees during his 4 years at the helm. Auth0 was acquired by Okta for $6.5 billion, the largest ever private transaction in Seattle's history. After Auth0, Jon served as the CEO of Exnor, a computer vision and a machine learning company. This was acquired by Apple for $200 million. His previous experience includes responsibility for strategy, acquisitions, and investments at companies like Microsoft and Intel Capital. Jon started his career as a product manager for Mentor Graphics, HP, and Convex Computers. Today, we'll hear from Jon about what does it take to find product-market fit, work with the very best founders in the industry, and how to win the toughest negotiations.

Hey, Jon, welcome to Inside the Network.

Well, thank you for having me here.

We're going to talk about 4 different topics, Jon, with you today. And the first one is around finding product-market fit. This is an area you have, in my opinion, having known you now for almost 10 years, you've really perfected this art. So we have a number of questions that we want to go through with you, but the first one is when Auth0 was started back in 2013, there were already several authentication vendors in the market. There was Okta, there was Fortrock, there was OneLogin, and probably half a dozen others who had all built considerable scale by the time that you launched product. So how did you and the team figure out that you had sufficient product differentiation to start a new company in an already crowded space?

I guess the short answer of that is that we had no idea. But sort of the more useful answer is it's all a series of experiments, ideally very low-cost experiments to try and understand what resonates in the market and what doesn't. And so you're really, to me, your first step as an entrepreneur is you create those experiments. What's the absolute cheapest way I can see that somebody is likely to pay, or better yet, actually does pay at least a nickel for this? 'Cause there's like this massive step function between zero and a little bit of you've actually got a solid product that somebody's willing to pay for, as opposed to, wow, that's technically amazing, but I'm not sure I would do with it. And so, the sequence actually, Auth0 Inc. actually didn't start until I became CEO. We had a consulting, essentially a consulting business in 2013 that Eugenio and Matias had started, Auth10, I think it was called. And the concept for the Auth0 product, just sort of an amazing, amazing product, which they were able to get in a very early form, one of one customer, somebody that Matthias knew from his consulting background to intrigue with and then deployed. And so, so having actually, and I guess we'd call that these days a design partner, having design partners, not a bad thing, but what that proved that sort of the concepts were good and the technology for as far as we were able to get in those early days was well implemented because they seem to like what they, what they saw. So the first thing we did as Auth0 actually was make it available online, I'm gonna say in a low-risk way. And what that really means is that we had a free version, the free sample that people could try out, and then we had paid versions. I think it was like $19 a month, $99 a month, $4.99 a month is what we put in place. It was like mid-January, so like a couple weeks into the existence of Auth0 Incorporated. And the, the goal there was to see how many free— are we getting free users and what are they saying about us? And are they free users because they're playing with us or because this is actually valuable? And so one of the reasons for the paid versions was to see if somebody found it valuable enough so that it's like, well, you know, if you convert to paid, you'll get better support. And eventually we added things like, you know, you know, you can have, you know, corporate SSO with the paid version, but you know, you don't get that with the free version other than I think initially it was like with a small number of users and then eventually clearly was like, no, you need to pay if it's going to be for, you know, clearly corporate use. Our general philosophy with this in terms of pricing was, hey, we don't get paid until you get paid. Find it useful and find it useful in production, not for, you know, you're just playing around, you know, then pay us something. Otherwise, have a good time. Now, the dynamics of the product were awesome for allowing this because our COGS was very low, or our marginal cost, COGS I can say, you know, once we're set up on, on Azure or AWS, which we, we actually did both, uh, in the— this was like the first year and a half or so in order to have, be able to instantly fall back from one cloud to another when they had problems, which certainly back in those days they had a lot. Our sort of marginal cost, if you signed up as a free user and you're going to have, I think those days it's like maybe less than 10 corporate users, like with a corporate single sign-on or less than 100 consumers, something in that order. Our cost was low because transaction costs were low. We had, and maybe this is another secret to this, is we had awesome documentation, really great quick starts, and really clearly written. Eugenio's background, just before he started the LLC consulting business, in effect, with Matthias, was patterns and practices at Microsoft, i.e., here are the right ways to implement code efficiently, or excuse me, implement a concept efficiently. And so, part of that is being able to explain it really well. So, he wrote a lot of the documentation, and sort of set the tone for that. So, you could come in as a big buyer at a top 4 US accounting consulting firm and look at our free sample, go through a quick start that sort of in 5 minutes would be, wow, I just set up authentication with my corporate credentials and, you know, Google and Facebook and a custom database, simultaneous, all of those working simultaneously. And I did this in like about 5 minutes for this like hello world application. And, node or a job or whatever. You looked just by following the recipe for the quick start, and then you like looked at the documentation and you saw things like our extensibility through Auth0 rules. Wow, this looks like it actually could work in my multi-billion dollar enterprise with millions of users. Let me see. And that allowed a completely automated customer evaluation and hence customer, or I should say, SQL, sales qualified lead acquisition. And so our marginal cost for acquiring a customer was like pennies because, hey, we're keeping the servers going and like we're trying to maintain the documentation and, you know, we gotta have, you know, work on that and such. But it was really cheap. And so we could allow really thousands of people to come in and that didn't really cost us anything. Didn't cost us anything. You know, it was low cost and a reasonable percentage, a single-digit percentage, it's always small, it's like, hey, this looks really good, but look, hey, I need a number to call if things go to hell, because this is going to be in production use. You know, it's like, hey, I need to be able to show my boss that you guys are actually a credible partner and not like some tiny little startup in Seattle, which of course we were. This was sort of the secret to the early days of success for finding product-market fit. You have a cheap enough way to reach a large enough number of actual serious users who are then giving you feedback on your comments on your, maybe a blog post or in your forums, or we get, we actually for quite a while had the, this documentation is wrong, you know, click here to help us edit the documentation. So we had, in addition to that super low cost customer acquisition path for these dynamics, we also had a super low-cost product management path. We had the amazing instincts for sort of just the right level of abstraction that we needed to give to ordinary developers so they could be essentially authentication experts, i.e., get it up and running in sort of minutes for something simple or sort of days or a week for something super complex. Okay, we had those instincts accentuated by sort of the comments we were getting 'cause we had a broad base of effectively design partners. You know, really smart people. And, you know, especially when it's online and it's the anonymous person posting online, they're going to be super honest. This is really shitty. Although this stuff over here is pretty good. You know, like, oh, cool. You know, you get some honest feedback. That, to me, this was cheap. I mean, very low cost. Our initial funding, Matias and I, and Eugenio had come up with for, uh, funding development of the sort of the MVP that we could like show to the first customer and, you know, try others. It was $20,000, $20,000 for a company that eventually exited for $6.5 billion to get the MVP to market. You know, then we, you know, after I came in, all of us sort of raised our hands and sort of, we had some friends and family people come in for, you know, some reasonable, reasonable additional funds, still 6-digit. It wasn't the, the giant 7-digit pre-seed funds you're seeing, seeing funding. So you're seeing these days, you know, and then use that to bring on a few more engineers to, you know, further refine some, some, products. This is sort of, to me, is the ideal way to do product market fit. Now, it depended on the dynamics of how the product works that we were able to do that. And I've got a sort of a different prescription for something like Exonore where these dynamics didn't work as well. But this is, if you've got an enterprise infrastructure product that is at bottom line sort of a low cost to run, this is an awesome way to, to do it, to find a product market fit.

And I think from the competitive angle, what you found different, Jon, here was the ease of use that Auth0 provided versus an Okta or a OneLogin or a Fortrock was second to none. Is that fair to say? The ease of use for developers to embed authentication in using Auth0 was different?

Yes, that's absolutely the right thing to say. And there's a sort of a, sort of detailing that a little bit more. There were competitors, you know, on the early days, but I think, like AWS Cognito came out in, I'm gonna say 2016 or something like that. And it's like, here's, you've already got an AWS account, so it's really easy to like check the box and just get another service and probably you don't have to like argue with your boss. And there were other folks who were trying to sort of approach, approach that use. The what, and I give sort of Matthias and Eugenio the, you know, full credit for they came at this as not, we are building a security product for security engineers to implement better authentication. They instead came at it as, we are helping ordinary developers become heroes. So, you're an ordinary developer and you understand authentication, but authentication is, uh, one of our customers, you know, authentication is a tarball covered with razor blades. Every time you touch it, your fingers get bloody. And it's there's asymmetric risks involved with authentication. You know, you do it wrong, everything gets compromised and your company goes out of business. And so you really, really want to get it right. Okay? So we made it really easy for the ordinary developer to get it right and get it right very quickly. And so that, in fact, there's another customer who described, he said, hey, I've done, this was a CTO. He says, I've done 6 digital transformations in my career. You know, and I'm here at this company. This was actually AGL, the largest utility in, in Australia. I can't remember the gentleman's name, but really smart guy. He's visiting and he says, I've done 6 of these. This is my 7th. The previous 6, we are where we were in year 2 of all of those previous 6 in month 2 with you guys because you made the authentication issues, which are so key to a successful digital transformation, so easy to, to deal with. So one, it was the abstraction layer. You know, you have this portal of, you know, you want to do this and oh, look here, we're going to help you connect to your 16 Active Directory silos and your crazy custom database over here. And we had a second massive advantage that I don't understand why other people aren't doing, because it's so advantageous. We had this great extensibility capability called Auth0 rules, now called Auth0 actions. We would allow you in the portal, you could write code which you could interrupt the authentication flow to do whatever. It's like, hey, I want to, I wanna do an additional factor of checking on, you know, geo IP, only people in the Washington DC area, or only people within this firewall can do it. Or actually it was arbitrary 'cause the way you would write these, it was ordinary. It was a, we invented, effectively invented Amazon Lambda before there was Lambda. It was a serverless function, just an ordinary language, but Everybody used JavaScript. It's like, hey, I'm going to do a JavaScript check to see what the phase of the moon is and the last 3 things Taylor Swift said. Cool. We could do that because, you know, there's an easy call to third-party APIs. You can look this up, you can make decisions, you can do processing. So that would be like an additional factor check, or I could do, we could do metadata enrichment or modification. It's like, hey, you know, uh, John@gmail.com just logged in. I'm not getting much out of the Google metadata about this guy or user. You never know if it's a dog on the internet. And so, but I'm going to reach out to Sixth Sense or Rappli for somebody like that. And I'm going to do a bunch of enrichment. And I was like, oh, it's actually this 35-year-old guy. You know, he's got an income of $130,000 a year. And it's like, oh, I'm going to use that. Well, one, to be able to feed back to marketing. It's like, hey, by the way, here's what this user looks like. I could be able to dynamically decide what landing page to send this guy to. I could send him to the, oh, here's the upsell product, which is great. And not the, here's the really cheap entry level that you'd send the student from Germany to or something like that. We could do that in literally tens of milliseconds. And that was super valuable because our users didn't have any other way of doing that. We never envisioned things like you want to integrate your authentication solution with your marketing automation tools to dynamically select landing pages. That never occurred to us because we had Auth0 rules. We could see a new form of usage of our product. And now again, that's the automated product management. It's like, oh, look, you know, here's this. Do we want to like strengthen that? Do we want to make checkboxes in the portal as opposed to making them write, you know, 20 lines of JavaScript? That was another like super powerful way to, to enhance the product as we learned over time.

That is a very interesting observation, Jon, how a new form of usage for Auth0 started to open new avenues. Using these flow checks, if you could tie in authentication with marketing, that clearly would lead to more developer delight, adoption, and of course, rapid scaling. My brain is still stuck at that point where you talked about $20,000 to get from initial concept to early product market fit. And I think that's a great lesson right there for our audience. Try to achieve early product-market fit with frugality, great documentation, identify customer evaluation and qualified leads. Those are very fundamental building blocks in achieving product-market fit, but at the same time improving the product where the notion of enrichment, the notion of rules allows for opening new doors. Let us talk about competition and especially the go-to-market motion now. When all of your competitors were going top-down pitching to CISOs, Auth0 decided to go bottom-up. Talk to us a little bit more about how that go-to-market journey played out.

Oh, I'm sorry, you actually brought up that competitive point earlier and I, I only addressed it, uh, tangentially, so let me address it heads on. So we looked at the traditional marketing of the ForgeRocks or Ping or StormPath or other how shall we put it, less successful products like that, and said, well, number one, our focus is on making developers happier by making them, allowing them to integrate into the authentication environment they've got in their, their enterprise already. And that's actually a pretty easy sell. Developers don't have any money, but on the other hand, developers have enormous influence. You know, there's no better friend and no worse enemy than your developer for, for your solution. So we wanted to make them really happy. And so that was sort of the Trojan. It's like, hey, here's an authentication product, a security product you'd normally go to CISO with, and we're instead going to go to developers and have the developers use it and like it and actually incorporate it into their products. And then when they move to production, say to the CISO or CFO or whatever, it's like, hey, you need to send $100,000 to Auth0. But after they were, we were sort of already integrated because it was all like really low friction point. Or way, path to integrate us in without asking for permission from the, the corporate bureaucracy. And it was only when you were ready to generate revenue that you need to ask permission to pay us. And of course nobody's gonna get in the way of revenue. So it was fairly easy to get paid in that respect, which not much selling was required there. Okay. So that was, but again, we started with, we're going to make developers really happy. I think it's fair to say that all of the traditional products at that time thought that they had to sell top-down because of course it was the CISO making the decision, or at least highly influential, on security products to acquire.

Okay.

And so this was a grand experiment on our part. You know, for all we knew, it was going to fail miserably. In fact, one of the things, to tell you the truth, when I came in, when I was first like looking at, looking at Auth0, I was like, I think the way we're going to get to $100 million of revenue, sell to a million developers who are using us because it's sort of easier to get past this point and eventually we'll get displaced Active Directory or whatever for $100 a year each.

Okay.

We were going to do the make developers happy. And, and very quickly, like our first 6-digit annual subscription was in month 7 or 6. Our first order getting close to a million dollar annual subscription came in the door month 7. And I think we closed that month 10 of Auth0's, Auth0 Incorporated's existence.

Okay.

So what we found, I thought, well, we're going to be making a bunch of money in small dollar segment transactions for the credit card swipes. That very quickly we found that because we built a product that was so appealing to developers, that was so well architected by Matthias, that it could scale to millions of users and handle all of these corporate uses, that very quickly the awareness we generated amongst these Tens of thousands of developers, because we, we were getting a lot of usage very, very quickly, very early on, translated to large enterprise subscriptions. It was awesome. Okay. ForgeRock, Stormpath, uh, Ping, um, who else is out there? Uh, Gigya, all those other guys back then. They all kept like pounding the door and having these like super long and painful sales cycles with the, the CISO and the CTO and the VP of engineering and such. It was rare that we had to talk to those guys because we spent a lot of time making developers really happy, generating that army of, you know, 30 developers who've tried you and say, this is great, we have to have this, and telling their management, who tells the CISO, we have to have this. Having the dynamic, we're incorporated into our product, so they try and switch, they're interrupting revenue because they can't sell the product. Having the online reputation through our marketing tactics of extensive content marketing that generated very positive online sentiment. Like when you would Google for, you know, authenticate Active Directory Google custom database, we'd always show up as number 1 or number 2, you know, and certainly the half, top half of the page. Those were all the dynamics that allowed us to have a very different and much less expensive and much faster customer acquisition cost and sales cycle than the traditional guys like Ping, et cetera. All that being said, because we were selling to— our initial thought on day one was, when I first signed the paperwork creating Auth0 Incorporated, it was, well, we're selling developers, you know, and that's a different approach. So that'll give us a niche that Ting can't approach because they have a hell of a lot of difficulty just convincing the developer just to try them out.

So let's double-click on the content side. So as you've just mentioned, you have built an extensive content rollout plan to essentially help drive inbound interest to the product. What were your top 1 or 2 insights for how cybersecurity startups can leverage content to use it as fuel for their growth? And can they even do it if they're not selling to the engineering persona, for example?

Sure.

I'll talk about how to generate what kind of content. And then if you're not selling to the engineering persona, it becomes a lot harder because you need someone who is self-confident enough to say, well, let me just try this out.

Oh, wow.

Look, this works pretty well. And if you're selling to the, um, if you're selling to the business analyst, you can do that because they'll try that if it's cheap and easy. If you're selling, if you have a really complex product, you know, that takes sort of 30 days to set up and such, you're from this perspective, you're screwed. Go having to go down the ordinary, ordinary enterprise sales path of, you know, cultivating senior management and the POCs and the budgeting cycles. And it's 18 months before you see your first dollar. So Let's see, the kinds of content we started with our kinds of content being, well, blog posts, of course. Very early on, we stumbled across tools as an awesome way of content to your, your ICP, your ideal customer profile, or at least your ideal influencer profile. We had created, Matthias's team had created for themselves a webpage or web application that would allow you to translate a JSON Web Token the encrypted bag of bits it is to plaintext, sending it the right, uh, token to decrypt it. And it was like on one side was plaintext on one side and the other side was encrypted. And, you know, you could play with either and the other side would change. And this was, I think, like a day or two of effort on their part. It was pretty simple, you know, and Matthias was one of the, um, sort of active members on the committee that actually created the original JWT spec. And so, you know, he knew it really well. So, you know, this wasn't very hard for us, for him and his team. And, you know, pretty early on, like within, again, a few weeks of Osteria Incorporated being in existence, an actual SaaS company instead of a consulting company, it was— Mafioso was like, hey, you know, maybe we should just like put this out because it costs us sort of nothing to run. And so, you know, see if this is useful to folks. I was like, cool. Because our thinking at the time with our blog posts and other content we were generating, like the quick starts in our documentation, and of course all of our documentation is on the other side of the outside of the firewall, so it's easily indexable. By Google and such. That's another form of content. It was like, hey, this is going to be useful to developers and we want to have this, cultivate this corporate persona that we're the developer's best friend. We're trying to do the, try to help them out in whichever way we can. That thing was a friggin' workhorse. People would use it for 6 months before realizing, noticing at that time it was sort of on the bottom, kind of subtle, you know, hey, brought to you with love by Auth0, that it was actually sponsored site. And then they'd like click on the Auth0 logo and like come through to our site and, you know, see what we were doing. That thing still generated, like the time I left the company about 4 years later, you know, 300 employees, it was generating 8% of our total web traffic. I mean, at least to the Auth0.com, you know, public website. It was awesome. So, so yeah, so tools are great if you have a tool that's sort of useful and can be made into everyday use because it's generating trust and cultivating positive sentiment and a positive reputation. It's also generating better SEO, which is your, your top metric of how well your content marketing is working. Because people would tell other folks on discussion forums or on Twitter or whatever, it's like, hey, use JWT.io. That's a really easy way to go back and forth. It'll help you with your debugging process. We of course tried the conference presentations as a form of content and content conference attendance. And I guess I'll stop here and say. One of the smartest and luckiest things I ever did was not appoint a marketing person to marketing. Well, okay, I did initially, but then that quickly changed. I appointed an engineer who actually understood what our product well. Okay. And it was an engineer, Martin Gontovnikas, brilliant guy. And he, he had a good sort of instinct for what plays well for engineers because he is one. In fact, he originally interviewed for the engineering team and then came to me and said, hey, you know, I find I like sort of I enjoy talking to people, talking in front of crowds and such. And I could be the developer evangelist. I'm like, yeah, sure. I don't know if we need a developer evangelist, but I mean, I'll try it. Let's see what happens. Keep, collect the data of what leads you're generating. See who's attending, try and do something. You know, we did like early days, one of our fun things was like having Bitcoins, a couple of Satoshis, or I forgot what, you know, cost us nothing. Of course those cards were probably worth $1,000 each today. But anyway, you know, we do that, you know, do, do stuff so that people would engage and we'd have some mechanism of doing attribution as to whether the prospects that came to see Martin or read Martin's blog post or whatever, his developer evangelist work was generating actual MQLs, marketing qualified leads. I.e., they came to our website, you know, then, you know, they engaged or asked that. And so, once as a placeholder when I needed a new head of marketing, I said, hey, Mark, why don't you become head of new head of marketing as a placeholder? And we'll, we'll have a real professional in a few months after I finish my search. And after a, I don't know, it was only after a month or 6 weeks. It's like, Kanto's kicking ass. Why would I ever replace him? This is great. So let's see. So blog posts. So then he shepherded so that we wouldn't have to be distracting the engineers to write blog posts because you have to have engineers writing posts for other engineers for it to be credible. Believe me, I tried and mine wasn't credible, so I stopped doing that. Blog posts, tools like jwt.io. We also did something called samltool.io that wasn't as, wasn't as, um, as effective, but we tried it. Did conferences. We found that attending conferences was a— and our figure of merit was leads generated per dollar spent. Wasn't a good use of, of our dollars. We were doing much better with our online stuff. Oh, we were curating social media. All developers, I think even today it's fair to say all developers talk to each other on Twitter. And so we made sure that we were being, watching on Twitter and making sure that we were authentically engaging as it made sense to engage. We found that when we would try to sort of pitch, you know, yeah, we're the best authentication solution, that would perform poorly. So instead we'd do things like, um, like on the blog post, you know, it's like, here's the Crystal programming language, you know, here's the 1,000 words or whatever on, you know, this new thing. It was, you know, new, whatever it was 10 years ago. That would perform really well because we were again informing developers and making them, helping them become better at their jobs as opposed to doing something that was an obvious advertisement. Of course, we could work in, it's like, hey, by the way, we have an authentication product, but there's other things. We sponsored Jared Hansen's Passport, was it passport.com, Passport JS anyway, his, his website, because Passport was the, the most popular, one of the most popular, I think it was the most popular NPM module. And it was authentication for, for, for Node application. We're like, hey, you know, open source, cool. We'll sponsor the open source project. We'll give you money. We've got a bunch of designers and I'm going to get to that as a content in a moment, a bunch of designers, they can help make the website look better, shape it up. This is not going to be an advertising. All we ask for is that you mentioned that we're sponsoring you. And that you are a free alternative. You're welcome to say you're a free alternative off zero and you have absolutely no need for us. And he would say that, but then he would also say, but of course, you know, that's for Node. And if you want sort of a more universal solution or there's other things, other limitations that I have. And so he was, was a very sort of honest, honest and transparent form of, of sponsorship as opposed to sort of an ad, just a, just brilliant ad. We found actually if we did technical presentations at conferences, they started to become more economical or excuse me, more higher yield in terms of the dollar. Returns for leads that would generate. So we actually ended up sort of stopping going to conferences other than we had an opportunity to do technical presentations. So those are the kinds of things we would do for content to apply to developers. But because of all this, now it's like, what do I do to, again, to go after accountants? It's like, I don't know, where do accountants hang out online? You know, I don't know, maybe I could do like the accounting education site for, you know, erudite accounting things, something like that. But it's, It's a, it's something that sort of differs for every market segment you have in terms of the messages you're sending in your content, although maybe not the forms of content.

We've talked pretty extensively now about product market fit, go-to-market, and creating inbound demand using content. Let us now switch gears to the next section, founding teams. Jon, prior to joining Auth0, you were working at Microsoft in corporate development and strategy. It would have been a pretty cushy job, I might add, a nice opportunity to continue building your career. But you decided to leave Microsoft and join this 5-person startup at Auth0. The fact that you built it from 5 people to 300 people and from a pre-seed stage company to a $6.5 billion exit is a testimonial to not just you as a CEO, but also how well you worked with the founding team. Eugenio and others had already started to build Auth0 when you joined them. Similarly, at Exnor, you came in worked with two technical co-founders and helped them to get a $200 million exit to Apple. Please share some of your criteria in picking and working with teams. They are clearly best in their own categories, but how do you engage with them? How do you build trust? And more importantly, how do you lead them to success?

I think sort of the first thing to say is that we're bringing in that outside CEO. It's like selling your company. You can't sell your company. You have to be bought. And so I actually, for both of those companies, when the idea of, you know, me becoming CEO was originally brought up, I said, no, I have zero interest. Thanks. With Auth0, you know, I sort of this cushy corp dev M&A strategy job with Microsoft. It was like, you know, a lot of fun, you know, it's Microsoft. So you can go do a billion dollar deal and that's like just not a big deal because there's only a billion dollars. And, you know, so there's, and, you know, Microsoft is a great place to work. You know, you, you're always learning there. For the founding team members, I guess more than anything else, you look at their reputations, what they've, what they've done before, and importantly, what other people think of them. Okay. And then you do as much as you can, sort of that gut feel, because I would say sort of the most important thing for your co-founders is that they are honest and earnest, you know, as well as of course being, you know, highly technically competent in their, their field. You know, like Eugenio, like, you know, he published a book on authentication, you know, but Matthias has spent years and years in the, in the area and, you know, had a great industry reputation from that as well as an online reputation from his contributions to open source projects or participation in things like the JSON Web Token, you know, standard. So it's like these are just good people and they'd be fun to work with. Number one, you know, number two, clearly top players in their field. And so I don't know. And then sort of my sort of thought process is like, you never know because it's always a crapshoot because you never know how things are going to evolve., but it's like, this feels pretty good. So bottom line there, it was a gut feel. I mean, data-informed, but a gut feel. With Exonera, it was sort of the, kind of the same thing, you know, there I was just sort of, I had been playing around a lot just as a hobbyist, you know, a super naive hobbyist. Cause my background is, is in, as a computer engineer with, uh, doing ML, playing with ML training and sort of learning, coming up to speed on it. I was, I didn't, hadn't had time to ever get involved with it since the, The big breakthroughs happened in 2012 or so for object recognition. And that catalyzed an introduction by one of the investors in Xnor, Matt McElwain of Medtronic, into Xnor. It's like, you know, look, they're academics. They're great. They'd love some help because they're not like sort of, they don't really sort of enjoy the general management. They enjoy the invention and the engineering management and such. You know, maybe you can help. And I'm like, well, I'll talk to them. And I got myself sort of looped into a, I said, fine, I'll do some consulting to help sort of set you on the right way. I said, I'll do 3 months of consulting, half-time, which of course immediately turned into full-time, not being paid. I just worked full-time because it was so fascinating. And you know, then they were like, well, you should be, you should reconsider the CEO thing. And I'm like, oh, okay. 3 months later. And it was because it was fun. And Ali and Mohammed are forces of nature and have amazing reputations in the ML world. Now, the technology that they had developed materially advanced AI research, and I think it's fair to say still are doing that. You know, Ali right now is the CEO of AI2, which is one of the preeminent artificial intelligence research organizations in, in the entire world. That's here in Seattle, as well as of course maintaining his professorship at University of Washington, which is also I think it's fair to say the premier, if not, you know, one of the very, very most top, topmost premier AI research organizations. You know, Mohamed El Ghanouli invented the, with co-inventors like Joseph Redmond, one of the, even today, standards for multi-object recognition, a model called YOLO, You Only Look Once, that was the very first multi-object recognition model and still the, one of the absolute very best models that are out there. I actually spoke with an entrepreneur. Very successful retired entrepreneur, or not retired, but, you know, able to sort of mess around on his own. I'm like, hey, what's the current, you know, state-of-the-art multi-object recognition? So I want to, you know, play with it. I'm going to be playing with it for a concept that I have. It's just, oh, it's, you know, definitely want to use YOLO. It's the best. Like, you know, I don't know if you've heard of it. I'm like, yeah, somewhat familiar with it. Mohammed had invented a technique called binarization within When was it? 2018?

Yeah.

Which is the technique— DNNs, deep learning neural networks, are basically, you know, it's a bunch of math. A lot of it's just multiply and adds. And traditionally you had to use multi— multi-precision, 16-bit, 32-bit floating-point operations, which is why GPUs are so useful. So, Muhammad invented a technique so you could do binary operations, single-bit precision. So essentially you're making a decision Hey, is the answer on the left or the right side of the number line here? And that meant you could run and get good results, you know, very accurate, very fast, which means you could run on like really dumb, cheap, simple CPUs, like an embedded processor, as opposed to having to have expensive GPUs. And so it was great for AI at the edge. Okay. You know, that was, you know, that's sort of seminal research. Nobody, people had tried it before and nobody ever got good results. And he was the first. First one to be able to actually get great, great results. And then I only worked with him on, on, on that invention. So those are the kinds of people I saw in addition to, well, this is just a lot of fun. I mean, it's brilliant people. Ali Mohamed had attracted an amazing team. There's some way that Matthias was able to attract an amazing team of engineers around him because of their reputations. It's like, you know, this is, it's gonna be fun working with these really smart people. Let me, let me just try that. But all of this comes down to, you know, like, how do you find like the best people? It's like there's all these elements, but it then ends up to serendipity. You know, you get lucky, you happen to make the connection to the person who's like the most amazing in that area in the world. And you're like, wow, let's, maybe we can work together. Or, you know, if I would be able to be helpful, I would, I'd be happy to work with you. I think that's what a typical entrepreneur, the path to be able to follow to have the same level of luck. Because, you know, there were discount luck in, uh, that I had with companies like like Exnor and Opszero.

How does the go-to-market strategy impact the kind of people startups should bring on board? Like, what are the kinds of skill sets founders should make sure that they have on the team?

Let's see. So the way to answer that, because, uh, or answer that in an actionable way, the foundation of any successful company is product. So I think your, your number one goal before you do anything else is find really amazing product people, excuse me, and engineers who can build product. I, the and also have sort of a bit of a product management sensibility so they're building the right features as well. You know, product, great product solves all everything else. And so number one is technology. Okay. So if your co-founder considering has no product development expertise and, you know, has product development expertise, but sort of no, no relationship to what you're doing now, if they're purely software and zero hardware experience, I would tend to be cautious because it's, it's kind of hard to, come up to speed on stuff like that quickly enough for the startup to do well with the limited funding that startups always have. Your next element, to say the truth, I think is your go-to-market, your marketing. And there, I think what you want is somebody with either a track record or, you know, a clear capability and intent to experiment. And experiment means, you know, marketing in general. Because, you know, you've got a product and now it's like, hey, I want to find the first 10 customers. How do I go find this? That's what marketing is. Well, my experiment, it's so many marketing executives today tend to be, well, here's the 6 programs I did at the last company I was at, and we're implementing those here. You know, here's the conferences we attended and, you know, here's the ads we created and here's the proof of concepts that we put in place to convince them. And the thing is, you don't know if those techniques are going to be particularly well suited for your new startup. So instead of the marketing person who says, you know, look at all the things that I've done before, therefore I'm going to do it for you. Instead say, what are the experiments you're going to run to figure out what are the right messages? Hey, buy my product because of X. And what is the right channels, media? You know, it was like, hey, can I just like tweet this out or do I have to do an ad or can I do a, I don't know, you know, flyers under windshield wipers, which of course is a stupid idea until you experiment with it and then maybe it turns out not to be a stupid idea. Not that I've ever seen it work for a tech company, but you know, it's just for illustration saying that. So the, the marketer who's a good experimenter, the, the second thing you want to that marketer is someone who can speak in an authentic voice and therefore be respected by your ICP, by your, the people you're selling to. And again, so many marketers, I've seen so many marketers that don't have enough of a tech background, which doesn't mean you have an engineering degree. It means that, you know, you've been able to hang around and learn enough so that you can, and talk to those people. And so they sort of spout buzzwords or have sort of warm, fuzzy text that doesn't actually tell me anything about why I should, as a buyer, why I should, you know, spend, invest the time to look more closely at this. And so finding a marketing, a head of marketing like that is actually really difficult. That's a hard job, but I think that's your critical next hire that you really need. And in the absence of finding that perfect candidate, because they are really, really rare. I mean, I think every board I sit on right now, the complaint is, you know, how hard it is to find effective marketing people. I would just find an engineer, find one of those extra set of engineers who are actually extroverts and say, hey, the marketing stuff's easy to learn. Why don't you try this to expand your horizons? Because it's a hell of a lot easier to teach somebody how to do marketing blocking and tackling than it is to, for them to go through the technical training that's necessary to actually being able to speak in an authentic voice to the ICP for your complex technology product. You know, if you're, you're putting together a, I don't know, a new online marketplace, yeah, that's actually fairly easy because there's a lot of people who could talk authentically to other buyers of stuff online. You know, if you're selling an authentication product or, you know, a new laser or fusion reactor or something like that, Now, the ordinary marketing people, quote, ordinary, i.e., they don't understand the tech, but they understand all the marketing techniques. Those are, you need those people, but after you've hired this head of marketing who's setting the direction and sort of vetting the messaging and the media to reach the ICP, because, you know, again, they know a lot of the blocking and tackling to make it easier. And so those are all staff. Those can be staff members of your head of marketing to be able to more effectively convey the effective messages through the effective channels that you've your head of marketing through his or her experiments have come up with.

Jon, let's move on from, you know, talking about working with people to talking a little bit about what we define as the art of dealmaking. And at Auth0, you raised over $60 million across 4 different rounds of funding from the seed all the way to the Series C, and you raised it from some of the best investors out there, funds like Bessemer Venture Partners and Meritech. And I was involved in two of those rounds. I remember the process and I thought you ran an amazing process. You kept things competitive, but at the same time, you were very fair in terms of what you wanted and you ended up with the best outcome for the company. What advice do you have for founders on running an effective fundraising process?

Thanks for your kind words there. I certainly didn't feel particularly confident as I was going through those processes, which, by the way, is something to point out to all the entrepreneurs. It's a tremendous burden, lifts a tremendous burden off your back when you finally realize that everybody else is just as stupid as you are. You know, nobody sort of knows the quote right way. It's all instinct and such. And you know, you just do your best and you'll be fine. All that being said, the first thing I wanted to do, let's step back. When you're talking to VCs, it's important to understand the psychology of VCs. And of course, please raise your hand as I misstate the psychology of VCs. But to be, to be very cynical, but is it a good framing, is they're greedy sharks that are trying to improve their return as much as possible. Cool. And that doesn't mean they're bad people. It's just, that's their job. That's what they were hired to do. You know, just like a corp dev guy at a big company, you know, they're going to get the best deal.

Okay.

What does that mean to a VC? Well, he wants to make sure that he's got as low risk as possible and then be able to put in enough so that he has a meaningful impact on his fund. If he's right that, you know, the risks are low and therefore he gets his 10 or 100x or whatever it is. We, we did have a fairly healthy 3-digit x return for the early investors in Allseero. And so really what you're doing is conveying the information transparently and honestly to the VCs about, first off, what are you doing? You know, sort of convey why you're different and such. But then secondly, why the risks are well mitigated and that they're going to be investing in. Okay. So often I've seen VC pitches from companies where it's like, oh, we have a black box to make detecting security anomalies, you know, amazing. So you can prevent all ransomware attacks. It's like, cool. Everybody says that. What exactly are you doing? Here, here, have a succinct pitch, which says, hey, we're doing this. We've, you know, trained an LLM over the last 2 years and it does this amazing thing. I'm just making this up. Probably, I'm sure somebody's doing this out there. That therefore has, you know, very high success rate detecting anomalies, and that's why we can do, think we can do a better job. We've got these people with a background in enterprise and let's see, building technical organizations. That's a risk. Can you actually do it? You're not just like a lone engineer who, you know, will fail as a manager. We understand how to market and sell to my buyer. In this case, it would be to the technical organizations.. And even specifically, it's with this, I, I don't have the ability to go to some sort of lower level. So it's used by a little group. I know how to sell to CISOs, like, like one company, um, I have a friend who's got a company and he just has, among other things, this amazing CISO Rolodex. He like knew all the CISOs and I was like, I'm going to go on all these CISOs. And in fact, I've gone to a dozen of them and I've explained the concept and I've said, I'll, I'll give you more details exactly how we're doing it later. But you know, What do you think of this? And they're like, man, I would buy that on 30 days. So now, now you go to the VCs with all of the quickly, I, here's what I'm doing and here's, here's how I've mitigated all of the risks. And now you're having a really easy conversation. And now when you go in with the not a clear description of what you're doing, it takes a long time to get to the point of, you know, oh, we're doing this ransomware attack, you know, prevention. You know, without a clear explanation of how you've mitigated all the risks that you're seeing, then you're going to have a hard time. And then you finally, to your point of competitive, you really want to, you're doing yourself a disservice. And in fact, I'll dare say you're violating your fiduciary responsibility to your shareholders, i.e., your employees initially, and you know, and soon your other investors if you don't have a competitive process, you know. Go to, go find, in fact, your, your, your first investors will be very helpful in finding your, your next investors. You know, go have them sort of guide you on like, ah, here's 3 or 4 likely candidates you could go to, you know, go, go pitch to them, see what happens and get multiple term sheets. 'Cause you really don't know what your company is worth. You'd love to say, it's like, well, look at all these comps. I'm worth, you know, $50 million in the series, series seed with, you know, 2 guys and a dog in a garage. Ah, what does the market say? You know, sometimes the market says you're right, but you know, more likely the market says no, you're worth, you know, $12 million or whatever. And so that, those are sort of the processes is try to think about what the VC's real problems are. You know, you want to give him the ammunition, him or her the ammunition. So when they stand up in front of their partnership, that they're not embarrassed by what they're saying. And instead it's like, look at this awesome deal I found. You want to make them a hero. In parallel, your company product should make your buyer, the person who championed you within the company, a hero.

Wow.

I was able to get authentication done in a, you know, a week instead of the 3 months it took with, you know, one of them when I, we tried to use Ping or Microsoft. Wow. He's a hero. You want to make that VC a hero the same, same way. So think about, to try and think like a VC and try and think of what information you need to give them to make, make them heroes. And that'll make your fundraising process really, really easy. But again, it all depends on you actually having a pretty compelling product. So focus on that first.

So you were on the M&A and strategy team at Microsoft from 2007 to 2014, where you led several acquisitions for the company. What did you learn on the buy side of the business? And also, how did this help you in negotiating the acquisition deal as a CEO of several companies?

Oh, you know, the very first thing that I found was a On the buy side that surprised me, you know, I came here after I was a VC, an investor with Intel Capital, you know, which is one of the biggest VCs in the world. You know, I did lots of deals, but you know, by its nature, VC is a lot of gut feel. It's like, wow, you know, these are two guys and a dog out of garage. They got a great concept and they got the track record and it's a giant market and yeah, sure, what the hell, let's go for it. I was astounded how equally or similarly emotional the an acquisition process can be, even at an extremely well-run corp dev, you know, organization like Microsoft. It's like, hey, I'm the vice president of X and I want to go buy this because I want to expand and it's a new product line I want to expand into, or it'll, it'll create a new product line and it's going to be amazing and I really want to, want to do this. And it's like, well, yeah, but do we have any like actual evidence that our customers really want to buy this? It's like, oh, you know, we're absolutely confident of it. It's like, not, yes, but do you have any evidence? And so you have a lot of emotion that can go into that buying process at an acquirer. And so as a seller, that's important to understand is that, you know, hey, is there a real business justification? The, the best kind of acquisitions for a big company are the ones where I'm going to buy you because I could add you as a new feature to this product that's already generating billions of dollars a year. And that new feature is like a quick checkbox. It's easy for us to sell, for the big company to sell. It doesn't take much explanation because it's, you know, it's clearly a useful feature. Those are the best ones because you have the most compelling, the easiest to realize value for that big company who's buying you. And therefore the deal is going to go through with the least resistance. So that would be a start, I would say, for advice if you're getting acquired and sort of things that I learned.

Let's go to the last section. And talking about advising startups, you've now spent most of your time since the sale to Apple, the Exnor sale to Apple, advising startups and serving on boards. And you now work with over a dozen different teams. And what's the one advice that you keep finding yourself sharing with each of these founders? Is there one advice that keeps popping up again and again?

I would say one of the things that early-stage startups, especially ones that are starting to show some traction and generating some awareness in the market, is they get acquisition reach-outs fairly early on. And, and of course, if I'm a CEO with no, no transaction, no corp dev experience, it's like, oh my God, what's going to happen? Hey, I just got this reach-out from Company X, you know, the multibillion-dollar company. It's like, wow, what should I do here? There's always a process that a big company goes through on making an acquisition, you know, which includes essentially a formal committee meeting where, you know, all the stakeholders, you know, it could be, you know, usually it's the CEO. Sometimes it has to include the board. If it's a really large company, maybe it's just a divisional president or SVP. But there's a formal decision-making process of, yeah, this concept makes sense. Go ahead and engage. There are Corp Dev people, inquirers that will ask you for a bunch of information actually before they've gone through the process. And of course that's enormous distraction for a startup, which is, you know, to put together all these historical financials and answer these questions, or maybe even let's share copies of contracts and such. And so I find over and over again, you know, all of the CEOs like, oh my God, we had a reach out, reach out and, you know, they're just asking for this and, you know, This is amazing. And I say, wait, wait, let's go back and ask specifically, have you gone through the formal process? And they've said yes. You know, so the CEO has agreed that this is worth looking at. Or if not, well, what's the minimum? Hey, I believe you. I trust you that, you know, you're seriously looking at us. What's the minimum I can give you to sort of answer the question of whether we're worth continuing to look at? In fact, what I really want, and your figure of merit is as a CEO is, you know, what price range would you consider? And when they say, oh, you know, difficult, we need this and we need that, it's like, you guys are experts. You've looked at the field, you know what the general range would be based on the number of employees we have. Or maybe I told you my revenue projection for this year, next year, something like that. Give me a range. I'm not going to hold you to it, you know, and just need to know if this is going to be worth my while. A lot of times that makes them go away. I encountered, I remember early on a, an offer, I don't know, in the first year and a half, 2 years at Ossiro, you know, an offer of pretty substantial, pretty robust 9-digit number. And I'm like, this is great. And this is clearly a board decision. And so is the board, have you discussed this with the board? Is the board fully signed up? And he's like, well, that's, that's what you and I are going to be working on together. And I'm like, no, no, no, we're not. I don't have, why would I have credibility with your board? You know, go, go talk to them and see if they want to talk, have the conversations. Cause I don't want to be sharing all this information with you. Because it's an enormous distraction from us building the company if we're busy answering your requests. That's one thing that sort of surprised me, is how often those, you know, acquisition outreaches happen. It's— I don't know, it's bad form on the part of the big companies, in my opinion. They shouldn't ask unless they're serious.

So many of the founders you work with come from technical backgrounds and haven't been CEOs before. What advice do you share to help them on their journey?

I think sort of The first one is that don't worry, your instinct of how to react to that is to X, whatever X is, is probably pretty good. You know, don't second-guess yourself or don't do things because people tell you or you believe this is the way to do things. Think about the situation and then sort of think about what you think is a sort of a reasonable response. Again, you can test that. And in fact, a lot of the work I do with CEOs is they'll say, hey, you know, I'm thinking about this and I think this is the right way. But I'm not really sure. And so I was like, here, let me frame it up. Your way is actually a great way. There's like these two other approaches. Here's the pros and cons of, of all three. I'm giving you additional information or additional food for thought for you to make your, your eventual call. But your instincts are right. You know, I kind of agree with you that option one was probably the best, but don't forget there's always option two or three if you want to consider it. So that would be one is sort of don't second guess yourself for, for CEOs. The second thing I, it's important, especially for deeply technical CEOs. Or some CEOs is don't confuse your technical wizardry with market excitement. You want as early as possible to try and figure out some way of, of determining whether the product that you've built so far or contemplating of building is actually going to resonate in the market and somebody's going to pay you a dollar for it. Okay. So how will you do that? Is there an MVP that's yes, from your perspective, It's a piece of crap because it's really 10% of what you really want to do. Can you get somebody to pay you for that or make some other form of sort of proxy to revenue of, you know, design partner or an LOI or this, you know, something that really convinces you the right path? Because I've seen a lot of developers who go down a long way down a path, you know, and say, look at this amazing thing and nobody wants it because it turns out to be, I don't know, like massively difficult to install. Properly, or, you know, it's got a bunch of confusing features that for, if for the giant company, the founders worked out, made a lot of sense. It makes no sense to sort of their initial, you know, mid-market, you know, 10 to 300 person companies, things like that.

So very last question to end the podcast. What's next for John Gelsi? Are you going to continue the advisory path that you're doing, or are we going to expect to see John back in the CEO seat again?

Oh, the problem with that question is, uh, so Yogi Berra, you know, it's really hard to make predictions, especially about the future. You know, I'm enjoying what I'm doing now with being an advisor, sitting on boards, working with VCs and, you know, a formal and informal capacity because I get to see a lot of things and it kind of, it's emotionally satisfying to, or I get to see a lot of things which satisfies my, as an engineer, it's like, wow, look at this cool thing that this person's, you know, this company's doing and how they're doing it and wow. And it's always fun to work with smart people. The, you know, that being said, it's, I guess I wouldn't fully rule out another CEO role, but I'm not really sure that that's what would make the most sense. You know, especially because of the sort of the emotional satisfaction I get again for the learning, but also sort of from the paying it forward, helping CEOs work through friction points that I had to essentially work through on my own as a first-time CEO, you know, help them get through those friction points a lot more more quickly and hopefully in a way that preserves more value for themselves and for the company over the long run. So, so we'll, we'll see. But, uh, right now I'm pretty happy with, uh, with not being a, uh, a CEO.

Well, thank you so much, Jon, for joining us on Inside the Network. And, and thank you for all those years of spending time with me personally as you look through two rounds of companies, as well as the several boards that, that we've been involved in, both on an advisory and a formal capacity in your case.

Well, you're welcome. Thanks again for inviting me.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.