Slavik Markovich: Building Descope & Demisto—brewing coffee and connections in the US-Israel tech scene

Welcome to Inside the Network. I'm Sid Trivedi.

I'm Ross Haliluk.

And I am Mahendra Ramaswamy.

We've spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators and investors building the future of cyber.

Today we are joined by Slavik Marković, CEO and co-founder of DSCO, an identity and authentication startup that launched with a $53 million seed round. Slavik is a seasoned cybersecurity founder with a passion for tackling complex challenges. With two decades of experience, dScope is his third startup. Most recently, he was the co-founder and CEO of Demisto, a leader in the security orchestration and automation space. Within 4 years of its launch, Palo Alto Networks acquired Demisto for $560 million. Prior to Demisto, Slavic co-founded Centrigo, a database security startup that was acquired by McAfee. In our conversation today, Slavic shares some practical advice on building products, raising capital, and managing globally distributed teams. In this episode, you will hear some interesting stories about bold pivots. For example, Demisto started off as an endpoint security company but then ended up as a leader in the security orchestration space. How did that happen? What is the importance of engaging with prospective customers? And most importantly, how did the team draw insights from evolving technologies like Slack? Slavik also shares the importance of a good game of poker and how that is helpful in raising capital. And of course, good coffee and how that might help you to land a great co-founder. Today at dScope, Slavik and his co-founders are on to the next challenge: identity and authentication. dScope solves the password problem while focusing on developers and engineering teams. It sells with a bottoms-up, self-serve adoption motion. Now, this is very different from Demisto, which focused on cybersecurity teams and sold top-down. Here you will find out how Slavic and his co-founders continue to challenge themselves and grow and evolve as markets and technologies change. Get ready for an episode packed with insights, wisdom, and practical advice from a proven founder who is embarking on his third and potentially the largest opportunity. Let's dive in.

Welcome to Inside the Network, Slavik.

Thank you for having me. Happy to be here.

We will split today's episode into 4 parts. We will start by discussing your background. Then we will cover achieving product-market fit, raising capital, and finally, what all founders want to hear about, getting to an exit. Let's kick things off with your origin story. What got you intrigued about cybersecurity?

I think like a lot of folks my age, at least, we all started by trying to hack games to remove like protections from the games. So I think a lot of folks basically started there with your early, you know, Commodores and then like the 86 instruction set. And I think I got introduced to this whole thing by playing games on my compatible IBM 86 instruction set and learning the assembly there and just hacking away by patching the game and removing stuff and so on. So it was all kind of a BBS systems and like-minded people that just spent nights on that while, you know, going to school, I guess. So yeah, that was the start, but I think the official kind of cyber journey started in the Israeli Defense Forces where, you know, you had to emphasize cybersecurity and it was part of kind of your job there, I guess.

So IDF was sort of a training ground for you, Slavic. And then over the past two decades, you've built three separate startups. The first one was Centrigo, database security. The second one was Demisto. SOAR, or Security Orchestration Automation Remediation. And now the third one is DSCOPE. So you've been doing this for 20 years. How is it different this time?

I guess, first of all, I guess I'm a very boring person. That's what I know to do. So I don't even try to do anything else, trying to create something in cyber and so on. I think generally I always went to ideas that interested me and were a bit of a challenge from a technological perspective or from a process perspective and so on. And the early days of database security, that was like super interesting to me because at the time there were no good products that protected database activity. So that was interesting. Then talking about SOAR, Security Orchestration Automation and Response, it was basically about the process and how there was not enough where manpower and the automation aspect of it, but also the chat ops and so on. And this scope, I think, is probably our largest TAM in the sense that this is like the identity space is so important. And it also touches each and every one of us because everybody hates passwords. Everybody hates doing like these whole challenges of security and multifactor and so on. And so if you can make it as secure but less frictionless and help companies build that like that, I think that is an interesting challenge. So generally, each of my startups was something that I was interested in. And the scope is slightly different in the sense that it doesn't even sell to cyber people. We actually sell a lot to the engineering folks, to the CTOs, VP engineers, and so on. So It's slightly different, but it's still, you know, the challenge is what kind of got me started here.

Your first startup, Slavik, you talked a little bit about it. It was called Centrigo and it was a database security company. What problems were you solving and how did McAfee, which ended up acquiring the business, how did they hear about you?

The reason I think it's kind of a lesson for a lot of founders is try to solve things that, you know, you understand are painful for you. And so I did some consulting to Sony PlayStation at the time here in Foster City. And we implemented the bidding system, the first online gaming system for PlayStation, which was actually pretty interesting. And one of my bragging rights is I have my name on a lot of the games that were out in the credit roll at the time. I'm talking 2003, 2004, and so on. So that's my bragging right. But beyond that, what really surprised me was that I, as a consultant, could access the database of all Sony customers with like billing information. And it wasn't encrypted and it wasn't protected against administrators, basically. And so I said, oh, that can't be right. And how can we protect it in a way that is as close to the database as possible, but not being controlled by the database administrators. And so this is— Centrigo was actually a very challenging technology because what we did, we reverse engineered all the relational databases like Oracle, Sybase, DB2, SQL, SQL Server, and so on. And we attach directly to the memory of the database. To derive the activity. So I was, for like 3, 4 years, I was basically dreaming in assembly, like seeing memory structures, living inside IDA Pro and all of that. So it was very technologically challenging. But the problem that we solved is still super interesting. How do you monitor database activity, especially for privileged access? And so if your DBA looks at your salaries, or there's a SQL injection hack and then your application account suddenly does things that they shouldn't do. You know, it's still very relevant. So that's how we kind of started. And we actually approached McAfee because they had like a server security kind of unit and databases were like a lot of the data center were like one of the crown jewels, the most important ones. And we kind of went and sold together to a bunch of companies. And this is where I met my co-founder Rishi. And the business was like very successful. And then it's just naturally progressed to the next stage, I guess.

Yeah, as you've mentioned, the acquisition sponsor at McAfee, Rishi, and you became friends and eventually co-founders of Demisto. Demisto was not a normal Silicon Valley cybersecurity startup. 4 of the co-founders were spread across different continents coming together. What are the main challenges in building a company culture under such circumstances?

Yeah, so it's kind of funny because 2 of us were here in the Bay Area, 2 of us were in Israel. And I think it works or it can only work if you have full trust between the founders. And in my case, I worked with the Israeli founders. In one case since 1997 and in the other case since 2006. And so I knew them really, really well and we would just work together. The other aspect is that there is sacrifice here, right? You get to go on calls at like midnight and they get to go on calls at midnight. So it only works Everybody's just putting in and working together. And the third I would say is that we had full trust because we, from the get-go said, we're not gonna worry about how we split the pie and everything. We'll be equal in everything throughout this entire journey. And so that was like, there was no thinking, oh, he gets more shares than me or he gets more salary than me. It was all very kind of completely open and, and very collaborative. And yeah, Rishi and I, I like to think that I seduced him away from McAfee just by getting him hooked on good coffee. So my office had like a decent coffee machine in the office because the McAfee coffee was shit. So I had a private machine in my office and his office was next to mine. And I would say, hey, come on, let's drink coffee in the morning and so on. And we started chatting and this is how we kind of I, you know, created this strong connection and we continued to start something together. But yeah, it was pretty funny because prior to McAfee, I didn't know Rishi.

And to this day, Slavic, you know, I remember the first meeting we had, you, Rishi, and me, and I asked you, so how did you guys meet? And you both look at each other and at the same time say, I guess because we love good coffee.

So it's actually a bidirectional process, right? Because I got him to appreciate like good coffee and he slowly trains me to eat more spicy food. So I, you know, Indian food is somewhat spicy and I didn't eat spicy at all. And slowly I'm kind of getting there. I'm still a wuss, but I'm getting there.

Any advice for the founders on coffee machines? That you'd recommend?

I think generally invest in that. You know, coffee makes the startup fair work. We have a Breville here, which is pretty decent. I think it, you know, it tamps, it does the grinding, the milk, frothing, everything. But, you know, find your right beans, find the right coffee machine and invest in it because that's important.

Well, you know, let's move on from your background to talking a little bit about achieving product market fit. And, you know, Demisto aspired initially to focus on endpoints and endpoint security and then pivoted into security orchestration. Walk us through that lightbulb moment when you realized, hey, we're not going to look at endpoints anymore, no more endpoints, and how you found the groove for an integrated SOAR platform.

Yeah, so we initially started, I guess, because we were at McAfee. McAfee is somewhat famous for being an endpoint company. We initially said, you know, endpoints are kind of interesting and the EDR markets just started, you know, going and there were like some really cool companies out there and some of them actually had like peer-to-peer databases like Carbon Black was there and they had a challenge with performance and like we said,, you know, we can probably solve it better from a technology perspective. And so this was the thing that we started with and we created like a really cool peer-to-peer database distributed queries, like super smart. We were very happy about it. And then RSA of 2015, we kind of said, okay, let's schedule a bunch of meetings with CISOs. And we had probably, I think, like 35 meetings with the different CISOs. Where we presented the idea and the overwhelming response was another endpoint, no thank you. And we were like, oh shit, that's not good. So during those meetings, we actually started pivoting and asking them, okay, so what are the big problems that you're facing and what's challenging you, what's keeping you awake at night? And they all talked about like this, huge amount of alerts, not enough manpower, and they need to do something smart about that. And we looked at each other. I remember Rishi and I kind of looking at each other and saying, wow, that's actually a pretty good idea. Let's, you know, invest in that. And so we started with this idea of playbooks and automation and the connectors to various security tools. And we did a lot of our ideation at the time Slack basically started like getting traction. And we did a lot of ideation with Slack, a team that we created. And, you know, during one of those ideations, we looked at Slack and we said, oh, you know what, this interface actually is amazing. Let's bring it into this space as well. And so we kind of invented the whole ChatOps for security in the source space. And it almost all came up via accidents, right? A lot of feedback from CISOs, like just inspiration as we went and ideated. And this is how it started. And I think that we basically convinced both Gartner and the customers that it's not only about automation, it's the whole incident management, it's automation, it's ChatOps, it's the war room and the integration together. And we basically kind of led the charge where all the other players kind of copied us. And so we were really happy, like, oh my God, they're copying us. That's good. We're like, we're leading. So this is how it started.

Slavic, you mentioned kind of talking to those 35 CISOs and getting their feedback and them helping you kind of move from endpoint to Soar. Any advice for founders who don't have those, you know, CISO connections on how they should get that type of feedback? Because that was very much critical. You know, you, you may have gone down the endpoint road and then competed with CrowdStrike and Silence and Cyber Reason, all of whom were kind of built a few years before you.

Yeah.

So it would have been, you know, you'd be trying to catch up, and that advice was very helpful.

Yeah, I think, uh, it's super important to get feedback. Like, one of the early things And I have an amazing story about that in the army. One of the most amazing things that we learned is always to get out into the field and ask the practitioners like the real questions. So in the army, we had like this huge distributed system that did something. It doesn't matter what, but we saw one army base where every morning at 8 AM, the system would reset. And we didn't understand what's going on. We went, we did like log analysis, we tried to do remote debugging, we just couldn't understand. And then we said, you know what, we just don't know what's happening. Let's go and visit that army base, which was up north. And we went there and we're looking at the system, like we're sitting in front of it, it's like old boxes. We're sitting in front of it and like we're waiting for something to happen. And then this older gentleman, like one of the commanders there, just comes in, says good morning to us. We say good morning to him. And he goes to the coffee machine, then unplugs our system, plugs in the coffee machine, and then makes coffee for himself. And apparently that was his routine. Like every morning, he would unplug the system and plug the coffee machine. And that kind of I still remember it because it kind of landed this whole thing that unless you actually visit and go to the field, you just cannot understand what's really going on. And so even if you don't have the right connections, even like there's ways to get to those would-be customers. VCs can help, you know, other founders will be happy to help you. There's like multiple routes to get those opinions. And in fact, what I saw is that a lot of the CISOs actually are happy to talk with you. They're happy to talk with founders because you actually eventually solve their problem. So I would recommend never to build something like inside your own like office and just build something without talking with your prospect.

100%. Like having done product for quite some time, yeah, I've learned it very early in my career that you have to get out, you have to get real feedback, understand how people people in the trenches are using different products, like what problems they're facing, and so on and so forth. Because it's so tempting, especially now in the age of social media, it's just so tempting to listen what people say, you know, publicly, and then assume that those are the real problems. But the reality is very different. Like there is so much noise. And the vast majority of the people who are sharing about their problems are not really talking about the real problems, but talking about the problems that impact probably 0.1% of the market. Anyway, let's go back to the product management. Tell us more How did the team prioritize on early features and navigate the trade-offs and navigate also the customer feedback? In particular, the one piece that would be quite interesting to hear about is how did you navigate the conflicting feedback? Because yes, as you're right, right, talking to CISOs is important, but you talk to 10 people and you will get 10 different opinions. How did you, how did you make sense of all of that?

Yeah, it's a, it's a pretty funny— there's obviously a lot of your own experience and your own opinions that you have to take into account. And sometimes you need to dive deep into the feedback to understand the core of the feedback. But we actually simplified it a lot and we basically prioritized our first customers. So we would do a POC and the feedback would be, okay, you need to do X, Y, and Z and you have to have those connectors. So we actually prioritized based on those POCs, early customers, and we were really like rabid, crazy about that first engagement to make it successful. And so I still remember like me and Rishi would used to sit at the, you know, at the sock of the customer, just see what they're doing and just go back with homework and just implement and run from there. So it's like the first enthusiasts, early adopters, customers, I think are really important. And then as like, if you got conflicting feedback, you basically just, I think, use some of your experience here to say, I don't know if there's like a silver bullet here to just, you know, how, you know, a rule of thumb that says, oh, you take this feedback and not that feedback.

That does make sense. And I'm curious. Sort of taking it, taking a step further, how did you know that the feedback you're building upon is going to have a broad applicability to the market versus you would be building like a very niche product for a very small segment of customers, which does happen so often in cybersecurity? Like, it's just so common to see founders identify an angle, go out, get some feedback, and it sounds like they're on the right track until they learn that maybe 2 years later, that there is only 15 companies on the planet that actually have that problem.

Yeah, yeah. I think it's a, you know, I'd love to take a lot of credit for, you know, what we did. A lot of it is just luck because what we did was very applicable very widely because all companies need automation efficiencies, you know, and they all kind of face the same things. What we did do is try to first have this North Star of where we're aiming and kind of go through the features kind of that will get us to that North Star. That's one thing. And the other, we super emphasized platform capabilities, sometimes to our, I think, disadvantage. So we try to build as generic as possible. And then if one customer wants to use it like that and the other wants to use it a different way, it still would work because the platform was super generic. So we built a generic workflow. We built a generic, like, drag-and-drop, a WYSIWYG editor that you can build the incident pages, whatever, however you want it. And we built a generic incident management platform. And so, and from there, on the one hand, we could actually solve a lot of the use cases without having to redo a bunch of things. But on the other hand, because it was so open-ended, until we learned how to be very opinionated, we went into very long POC processes because customers just said, oh, I want to do that. And said, sure, yeah, you can do that. And then, oh, I want to do the other thing. Yeah, sure, you can do that. And so you could do so many things that it just was never ending. And so until we learned to focus and be very opinionated about what we could do, it just kind of went all over the place. So I'd say have a North Star, build a generic platform, but have opinions.

Talking a little bit about, you know, category creation versus going after existing categories that are crowded. You've kind of done both with Domisto. You were helping to create the SOAR category alongside a few others like Phantom Cyber. You know, Oliver Fredericks and Saurabh Satish were building that company. We were small investors there. Paul Nguyen was building Invotas. If you remember. So there were a few players in SOAR, but it was new. It was a relatively new category, and you were helping to educate the market, and that was an uphill task. And when you compare that to dScope today, you're going after a very established market, and there's some pretty established players like Okta and Ping and Microsoft that are out there, and the market understands what's going on. And your goal is really around how do I differentiate from the market, how do I explain to the customer where I'm different. What's your advice for founders on how to pick between these two effectively necessary evils. It's kind of, you know, a no-win scenario. But how should they pick between the two?

We don't necessarily kind of thought like that, like, hey, it's a new category, or hey, it's like an established market and so on. We kind of looked at the problem. We like the problem. We like the space. And then we kind of said, can we do it better than what's existing? And obviously, if it's completely new category, then you say, oh, you know what? Yeah, we can do better because there's not a lot of things out there. And when we looked at the customer identity and access management space here in the disco, we actually saw that they're like really, I'd say, older companies like Bing and, you know, Microsoft in a sense and Meta and so on. And there is like a bunch of new startups, but the old companies are old. So in a sense, if you innovate and you can easily out-execute them and a lot of them I think are just very hard to work with and not very developer friendly. I think a lot of the new companies, they didn't have the enterprise experience and so they were like really cool kids, but they don't know anything about selling to enterprise and enterprise features and so on. And so I think we took a hard look at the market and saw that the market is huge and we can really execute much better than the others. And that was our like thinking of, hey, let's do that. This is also one of the reasons where it's a different funding, and I guess it's another section of this, uh, podcast, but it's a different funding dynamics because for an existing market, when you know exactly what you want to do, this is why we raised so much money in the beginning because we didn't want to worry about hiring more people or like getting enough breathing room to, to build the right product versus when you just building a category. It's all about experimenting. And so you don't know exactly what will work and where you're gonna go and what you'll do. And so you raise way less than that and don't overhire and so on. So from my perspective, it was mostly about, oh, this is a cool problem. And then can we build something better?

That's a very interesting segue into our funding conversation, Slavic. When you're looking at a big market, you're going after solving a mega, mega problem. And especially when the legacy innovators have not yet innovated as fast enough, especially now that you look at the world of AI and how things are changing so rapidly, it's good to be in that place. And also the logic of raising a $50 million seed round. Dscope raised a seed round that made headlines everywhere, right? Compared to the $6 million seed round that you raised with Excel that I remember being a part of that conversation when we were sitting at the table. By the way, when 3 of us met, we did not eat Indian food even though there were 2 Indians and one of you.

I think we went to a burger joint if I remember very—

I still have the picture of that burger, by the way, and the t-shirt as well as we saw, right? So the question for our founders and our audience is as follows. There is an art form and a science of raising money. The science is very simple. Everybody knows that. Hey, get your pitch deck, get the TAM, there is the team, et cetera, et cetera, right? Everybody knows the formula, but the art form is somewhat, you know, vague at times. It is dependent on market conditions. It's dependent on your background as a founder. You've already sold Centrigo in your first cycle, et cetera, et cetera. So help our audience to understand the art form of raising capital.

Yes.

Again, I don't want to claim too much credit here. I think a lot of it is just timing and luck and being at the right place at the right time. But I think it's all about like the story you tell, right? You have to have a convincing story of why, why now, why you, all of those things. And I think we had that both. In the Misto and in the Scope. So it's all about the story and then it's slightly about playing poker. So I don't know if you know, but I play poker quite a lot and I play every Thursday with a team of folks. And so there's a bit of a poker going on between you and the investors and juggling a bunch of investors and so on. And that's also a, I think a kind of an art where I'll give you an example. And, you know, Jake knows that in the beginning when we talked with Accel, so we liked Jake a lot. He was like, you know, young, did a lot of, you know, operational work. He understood what we're trying to build and so on. And so we said, oh, we would love to work with Accel. It's really good. And then internally we said, okay, what are the terms of the deal that we would want to accept if they're given where we're aiming? And what are the lowest that we will be willing to accept? And when we came to those discussions with Jake, I remember he started with our highest option, right? Which was really nice of him. But at the time, like I looked at Rishi and Rishi looked at me and I immediately kind of said, Oh, Jake, you know what? It's like very disappointing. I expected much more from Accel. I expected like, you know, and you know, I think that you really understood what we were aiming for. And so there's really poker going on. And he then raised the offer by a lot, but I also think he played poker with us. And he's, so we didn't go all the way to where he was willing to go. And so there's kind of an arc. There as well in negotiations.

And so besides coffee and playing poker, you know, making sure that you cast a wide net, you mentioned as a product journey, you talked to 35 CISOs. How many VCs were in the mix here as you were playing this game?

I think at the time were probably like 8 that we were serious with, that we kind of engaged. And honestly, we were very close with, you know, signing a different term sheet and Jake was just moving so fast and we liked the interaction with him so fast that we kind of stopped some of the other processes. But I'd say we probably were serious with like 8 of them and got to like a partner meeting with like 4 or something like that.

Very cool.

And then kind of juggled between them.

Very cool.

Very cool. You know, I want to share a story here for our audience about how there is this dynamic that VCs versus founders and somewhat the dynamic ends up being many times it ends up being somewhat negative. And the story here is as follows. So Jake calls me, Jake Flomenberg from Accel. He's now with Wing Ventures. He's a dear friend to a lot of us now. Jake calls me and says, "Hey, Mahendra, have you raised your fund yet?" So this was the time when I was raising my fund one. And I played poker with him. I said, "What's up?" I didn't give him that. So I said, "What's up?" He said, "There's a great opportunity. Accel is putting in $5.5 million. It's a $6 million round and you have one week." So I remember talking to Rishi and you that day and then driving down to Mountain View or somewhere where we met. And then on the way back, I was thinking like, "Oh, shit. I don't have the capital to invest." So I remember calling a friend in India. I said, I need some money. And my friend is bantering with me saying, hey, we are a developing country. Money comes from America to India and you're asking me for money. But he was a childhood friend, a dear friend. And so he wired me the money next day and 48 hours later the money was in your account. And so the story, the lesson here is that founders help VCs to become successful too. It's not just the one way around where, so my fund won, the best performing company is Divi Store. Thank you, Slavic Rishi. And that allowed me to raise my fund too. So, the lesson here is that we are all human beings, we're trying to solve problems. And many times founders look at VCs as like, ah, whatever money, there's a negative sentiment. But sometimes people like you and Rishi were kind to VCs like me or founders like me. It's a great dynamic. So, I want the founders to also understand that in your success lies success for investors, lies success for your customers, it lies success for the community. So think about the responsibility that you carry and work with everybody in a nice way. I mean, here you are, your next seed round was $50 million. So no wonder investors were chasing you so aggressively for your next stock.

So thank you for all that.

Yeah.

Well, we kind of had this, oh, for sure. We kind of had this rule of like, no assholes. Life is too short. Just be kind and enjoy the journey. And I think it actually reflected throughout both for employees and you know, we keep close connections with our VCs, you know, with pretty much everyone we worked with. And I think you can see it also when we started Disco, the first like 20 employees just came from their previous, you know, work that we did with the Misto. So we basically just got a lot of the old gang back together and they continued together as well. So You know, I think we're all kind of, well, maybe some of us are like too old to, you know, to not enjoy the journey.

Let's talk about the Series A, Slavic. You raised the Series A at Domisto just a year after that seed round that you raised from Jake and Accel. And you bought in $20 million in that Series A round. What milestones had you accomplished? Was it something that you were planning to raise or were you preempted? And how did those milestones differ from your initial projections?

Yeah, I think it was like almost a mistake. So when we, when we kind of started eventually going to market, it was Q4 of 2016. And we actually got amazing traction. And we did have sales guys, like it's just me and Rishi selling. And, you know, Sysos wanted to talk with us. And we closed a decent amount of business just by ourselves. And so we said, oh, you know what? We actually have product market fit. It's all amazing. And I think we closed the quarter like at like $640K ARR, which is an amazing first quarter for any company. And then we said, that's it. Like we found the product market fit. Let's go raise money. And so we actually started a process and we raised $20 million towards the end of Q4. And we brought in at the time Clear Sky. And also a funny story because I was visiting the Israeli office, going up the elevator, and I had a backpack of Silence for some reason. And this guy approaches me and says, oh, Silence, I know this guy, I'm an investor in them. And we kind of got talking and this was Alex from ClearSky and this is how we got basically to know each other. So it's completely coincidence. But anyways, we brought the money and we immediately said, oh, we have the $20 million. Let's hire a bunch of sales guys and just let them run. And guess what? We actually failed completely. So Q1 of 2017, We closed a single deal, $100K. That was, you know, so we went from $640K to $100K because we didn't understand it's a completely different story where you have founders selling who fully understand the problem and the product and CISOs are happy to talk with. And it's a completely different dynamic where you have sales guys going and selling. And so it was really funny, the first board meeting that I have with now the new investors with Clear Sky, and we're saying, we're sitting there and saying, you know what, none of our theories and none of our projections actually worked out. It was terrible. So from that perspective, we actually raised before we found the repeatability in our go-to-market, which was pretty fun and stressful. And I have to say that our investors were super patient with us. They were super like guiding and understanding and so on. So I, it could have been a very different discussion, but it was actually a very good discussion because they still believed in the vision, believed in the North Star. And then, you know, then it was just execution. And we actually finished that first year with $4.4 million of ARR. So first year of selling was actually amazing for us. But it started very badly.

So knowing what you know now, what would you have done differently if you were to go back to that time?

I mean, generally, you know, it worked out really well for us. It didn't work out badly, but I would actually say that you need to find the repeatability. You need to move away from founder-led to like process-led. Where you find some, like a real go-to, you know, product market fit. And then you can actually raise without having this huge dip in the middle. So first deals, we all know that first like 10 deals, the 10 customers, they're all closed by the founders, right? The founders have to hustle, do whatever needs to happen and just close those deals. But that doesn't say anything about the scalability and the repeatability of the business. And then starting that engine, I think is important before you pour more money into it, which we didn't, right? We poured a lot of money and then we saw the engine doesn't work. We need to kind of backtrack and kind of build the engine from the ground up. And so that I think is an interesting lesson to learn. But again, because the timing for our product was really good, we could afford making a lot of those mistakes because the trajectory was just going up anyways. So those mistakes were kind of fixed on the fly while, you know, while running and, you know, it worked pretty well.

Interesting. Yeah. So going back, going to the Series B, 2 years into the Mistos journey, you have already raised a $40 million Series B round led by Greylock. Did you feel at the time that the company was overvalued? And how did this funding round change your company's trajectory?

So it was really funny. That was one of the most, I think, competitive rounds because we were chased by everybody. And honestly, like even looking back, I think we were undervalued, not overvalued. Like when we raised this $40, $43 million, we actually had like really good visibility into like 15 million of ARR. And eventually we ended the year at 21. So the growth and like the trajectory was the hockey stick. And so, you know, I think it was, first of all, everybody was chasing us in terms of business, but we really loved the interaction with Greylock, you know, Sarah and Hashim. They were like really smart, did a lot of their homework without bothering us. And like the interaction with them was great. And so we decided to take money from them, even though we had higher valuations and higher term sheets in our hands. And unfortunately, we didn't have a lot of time to enjoy interacting with them because 3 months after, we already had the conversation with the Palo Alto Networks and were acquired. So I think we closed the round in like October of 2018 and like in January of 2019, we already had like handshake with Palo Alto Networks. So we had all the money in the bank still and we made the, and for them, I think the return on investment was pretty nice because we tripled their money in like 4 months. So they invested like 31, I think, of the round and they got like 93 of them. Around in like few months.

You talked a little bit about Palo. So let's, let's talk about exits. And Demisto was acquired by Palo Alto Networks for $560 million. And that was about 4 years from, from when you originally founded the company. Give us the inside scoop on those negotiations, why you made the decision to sell, what were the challenging parts, what were the exciting parts. It's not obvious, you know, when you describe all the numbers, being at $20 million of ARR, growing the company at the rate that you were, having raised $43 million more, that you should go and sell. So I'm very curious to hear a little bit about what was going on between the four of you and the board as you were trying to go through that process of deciding.

Great question.

Honestly, I think, you know, hindsight, we probably made a mistake. You know, we shouldn't have sold it. Now the business is huge with Palo Alto Networks. They're like, I think that probably they're one of their best acquisitions for sure. At the time, we didn't even envision selling, right? So when Nikesh approached us and said, hey, let's meet for like, we want to learn about your business and so on. Again, I didn't even think about acquisition at this point. And in my head, Palo Alto Networks was always like a firewall, like next-gen firewall company. So, okay, sure, yeah. The best, I thought, hey, maybe we can actually do some work together and maybe go to market together and co-sell or do something like that. And that was the best. So I didn't even prepare for that meeting. I came to the meeting and I'm going into this huge boardroom of Palo Alto Networks. And I see a lot of people. Like I thought I'm meeting Nikesh, but apparently there were like 6 people in the room. You know, the co-founder Nir and the VP of Corp Dev and Lee, who was the Chief Product Officer and Nikesh obviously and a bunch of folks. And I'm like, hmm, I didn't prepare anything. And we basically went Presented the regular customer presentation that we had. And right in that meeting, Nikesh is like, I'm presenting. I presented the stuff. And then Nikesh is like, would you think about doing something more strategic? And I will say, we just finished the round with Greylock. We saw like a huge trajectory for us. And so I said, no, look, talk with us in like a year where we you're like much bigger and so on. And we just left like that. And I thought, okay, that's pretty much it. And then Nikesh started like, so he sent me a WhatsApp message, the big WhatsApp pay user sends me a WhatsApp message, hey man, come to my house, let's eat breakfast, you know, let's talk and so on. And eventually, you know, he started kind of mentioning some numbers and when it went like, you throw numbers, then suddenly I have, the duty to kind of talk with the board and like discuss it internally. And it became suddenly it became serious. I didn't even expect it to be. And in our head, we as co-founders, we said, look, Palo Alto has tons of customers. With them, our product can actually reach many more. It's going to be like huge. So that was one thing. And like even the integration with all the Palo products and so on was really interesting to us. Then we also had the financial, you know, aspect. If it's internally, we said if it's above half a billion dollars, we'll contemplate it. If it's below, we're not. So that was the line in the sand for us. And at the time, look, we're talking about 2018, right? So the multipliers were not like 2021. The like having like a 25 or 30 multiplier was considered amazing, right? So that was kind of the line in the sand. And I have to say that our VCs basically didn't want us to sell. They actually pitched and told us, don't do it. Don't make a mistake. And hindsight again, they were probably right, but we as co-founders felt some pressure because it was a big financial number. So, you know, life-changing for most of us or even all of us. And the other thing that Palo Alto did really well, they said, look, if we're not going to buy you, we're going to buy your competitor. And so think about it. Our biggest competitor was acquired by Splunk, a huge company. Now the second competitor is going to be acquired by Palo Alto Networks. And you're suddenly facing those huge companies and you're like the last man standing. It's not a comfortable position to be in. And so we had some concerns and honestly also they were very generous financially, you know, both in a founder extra retention and whatnot., and also in terms of all the employees. So everybody basically landed in Palo Alto Networks and everybody found a place. And so that was really important for us as well. And so we eventually decided to actually sell, which was, you know, I don't regret it, by the way. So just to be clear, I think it was the right decision at the time. It was very hard to predict 2020 and 2021 in terms of like valuations and craziness.

I know that, you know, some of the VCs tried to stop you from that exit. I was not at that table, but I'm very glad that you sold. I mean, speaking of life-changing, you know, it has a downstream effect on many of us. So thank you again. You also did something very interesting. You know, a lot of founders after they get this whole acquisition process done, Whenever we talk to them, there is this like, I can't wait to get out. I've got my golden handcuffs and I hate this mothership, blah, blah, blah. But you consistently, even at McAfee, you spend a lot more than 6 months or 1 year and there you seduced Rishi with your good copy, but you stayed with the mothership to help them. And then even at Palo Alto, I remember several conversations I would have with Rishi, you, a post-acquisition and you would share that, no, these guys are good, they're treating us well, we are enjoying, and most importantly, we are building a fine trajectory here. What advice do you have for founders on post-acquisition dynamics? How should you see the mothership with both strategy and joy and compassion?

Yeah, I guess I had multiple experiences by being acquired and I think Palo Alto Networks actually is a really good acquirer. In the sense that for the most part, in the beginning at least, they leave you alone and they're very thoughtful in how to integrate into their like main business. So from that perspective, I think I have only like compliments to them. So that was actually a really good experience. And I think for the first probably like year and a half or maybe even beyond that, I think I found myself being like extremely busy just landing the ship, integrating, thinking about the next step of the journey within Palo Alto, and then training all the sales guys, meeting customers that I wouldn't have met otherwise because they have a huge reach. And so they really kept me busy from that perspective. Obviously, and I was very open, and I think we were all open with them, we said, This is not like a life, like we're not going to stay there forever. But we did. We stayed there for almost 3 years. Rishi actually stayed the full 3 years. And I think we generally enjoyed our time there. So if I compare it to like McAfee as an acquirer, McAfee was not doing a great job there. Like really, it was pretty terrible. And even though I felt responsible for my team and I had to stay and land everything and so on, I couldn't wait to just move on. Here in Palo, I think the experience was much better. And you can feel that they are still very hungry to win and to go out there and just grow the company and continue just winning. So the hunger aspect was there. Having said that, You know, I think my skill set is much better utilized in a startup versus a larger company. I like to make decisions fast and move faster than even like Palo Alto will move. If you have a large ship, just changing direction or adding more stuff just takes a long time. In a startup, you can make a decision and tomorrow it happens. In Palo Alto Networks, you make a decision and like 6 months down the road, it actually happens. Which, uh, which is fine. I mean, it's— this is just the nature of the, of the business. But, uh, I feel I enjoy startups much more than, you know, a big— a bigger company.

You are now investing as well as serving on the boards of many startups. What is your advice to founders, and what are some observations that you have experienced in this role?

So first of all, I think As investors, we are probably pretty stupid investors. I have to say. So all I care about is that the problem actually is interesting, the technology is cool, and I want to be part of the journey. I think we're, again, we're pretty lucky in the sense that we don't invest other people's money, it's just our money. And so we can afford being stupid about like, Oh, maybe the go-to-market is not going to be that great and maybe, you know, the founder is not as experienced and so on. And we don't care because we want to be part of the journey. So from that perspective, I think we are not making the same decisions as a traditional investor or traditional VC would make. But we do, we invest quite a lot in areas that interest us. Be that like cyber, AI, enterprise software, all of those things. And I think what I really care about is seeing the passion of the founders about the problem and seeing in their eyes that they just want to devour the problem and solve it and just go about it and hustle around it and do whatever necessary just to make the problem go away. And so that is, I think, the most important thing, just having the team passionate and understanding and so on. Obviously, all the other things are super important. The TAM and like the go-to-market and so on are critical. But the first thing that we really want to see is the hunger in the founders. That's, I think, is super important. And that would be my advice, like, try to solve something that you care about, that you know that you care, that you're passionate about. Life is too short. Don't suffer through something that you don't really care about and just because you think it will make a good business. That's, that would be my, my advice.

That is good advice. And as we're moving towards the end of the episode, I'm curious if you could go back in time and give yourself one piece of advice. When starting this scope, or let's just say when starting Demisto, what would that be?

So I actually had the benefit of doing another startup before, the Centrigo that we talked a bit about. And I think I actually learned the right lessons from that startup to my future career or startups. In Centrigo, I actually did not know a lot about you know, what it means to be a founder and startup founder and so on. And I honestly burned myself out. So the first 2 years of Centrigo, I worked like probably like 18 hours a day nonstop for like 2 years straight. And then I had a complete meltdown and I just couldn't see or couldn't sit in front and like think about, you know, the business or the technology or anything like that. And I think when we started the Misto, we actually talked among us, the founders, and we said, let's try to make something different. Let's have a much better work-life balance, come home, see the family, work out a bit, things like that. And I think that completely changed how we went about both the Misto and how we go about this scope. Kind of think of it as— everybody says that, think of it as a marathon and so on, but you actually have to be conscious about it and do it. And so that is one thing that I think I learned a lot. Now, if I— again, hindsight is easy. I think if I would now have advice for my, you know, the Misto self, I would probably like I do my funding differently, as I mentioned. I might have not sold the company at the time that I sold it. All of those are decisions that you can, in hindsight, probably think differently about. But I think the most important for me was this approach of, hey, 5 PM, let's go home. Let's go work out. Let's talk with the family and so on. You can work at 10, you can go at 10 PM and go back to, you know, working, but have this window of time to actually take a breather. So I think that that's probably one of my most important advice to founders is just make sure to take care of yourself. Otherwise nobody's going to do it for you, right? So that's super important.

Yeah.

Thank you, Slavic. And I think this notion of work-life balance and founders especially caring for their own selves, if that awareness does not trigger in. You know, we've seen situations of burnout. We've seen situations of frustration and impaired decision-making as well. So that's great advice. And as we wrap up our episode, let's take a look at the crystal ball here. Your journey in IDF and going back in time to the gentleman who would unplug the machine because his coffee was more important. Was a classic insight of how staying in touch with customers is important, but that was database. Then you got into orchestration and automation. Now you looked at identity, but the world is changing. You look at the amount of capital that's flowing into cyber. You look at the geopolitical forces. You look at how regulators are paying a lot more attention. In fact, in one of our previous episodes, Sid described that RSA I know there were several people from Washington, D.C. spending time at RSA. So you have this confluence of macro, micro, and a lot of competition. If you look at the next 5 years in cybersecurity, what are some things that you see or what do you predict?

So first of all, I think that, and it's no surprise to anyone, AI is going to be more prevalent in every aspect of your life, I guess, not just of cyber. Autonomous agents that make a lot of work done for you, I think is very interesting. Identity in that case becomes very interesting as well, because then authorization and what can the agent do on your behalf is suddenly very interesting. You want to give him something, but you don't want to give him everything, not your passwords, but maybe So that becomes like super interesting. I think generally I would see a lot of, you know, in my particular area of space, I would see a lot of moving away from passwords to other means of authentication, which, you know, one of the big reasons we started this scope, I think, if you see my shirt, like, kill-9 passwords. That's what we're trying to do generally. So things like passkeys and other options, I think, would be the future. So that's another thing. And what, you know, and we all know that it's very hard to predict 5 years ahead. And the way that AI changes, like 6 months ago, things were completely different than today. And so we'll see, I think, a lot of innovation, but also a lot of like wasted, how shall I say it, a lot of burned money on thin wrappers around AI, which don't have necessarily any substance. And so I would probably advise a lot of caution here not to overinvest, burn money on things that not necessarily have the right values. But overall, I think, you know, AI is going to be prevalent across the board in many of the new innovations that are coming.

Wonderful.

On that note, Slavic, thank you again for the inspiration, the decades of work you've done as a founder, and most importantly, being so open and sharing your journey. Thank you so much.

Of course. Happy to do that and happy to be here. And thank you guys for hosting me.

Thanks, Slavic. Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email email or LinkedIn.