Monetizing SaaS: Episode 13 with Corey Bodzin, CPO of Eclypsium

It's great to be with you. So thank you for joining us. And we've gotten to know each other over the last few years and worked together across a lot of different surface areas. So it's fun to be talking. Maybe you could just start off by telling us a little bit about the steps in your career that have led you to leading product at Eclipsium.

Yeah, thanks, Fynn. It's a pleasure to be here. And for everybody listening, I have a lot of books on my shelf that came courtesy of Fynn. So, you know, he's well— It was a lot of fun to chat with him and get good recommendations. I'm currently, as you mentioned, Chief Product Officer here at Eclipsium. And I've been doing product for probably, it's getting close to 20 years now. And, you know, what I started as many people did as a practitioner in cybersecurity. I worked for some financial institutions, got a chance to use a bunch of software. And at one point I made a flip over to the vendor side, largely in vulnerability management. But then, you know, always leading product teams in cybersecurity and dealing with some of the challenges of growing businesses. I had the good fortune of a couple of exits and public company launches and also had a chance to work with some more startup companies, which is what Eclipsium really is, to really prove out a market, understand exactly what we're selling and why people want to buy it. That's a lot of fun.

Maybe just diving straight into Eclipsium, what is the insight behind Eclipsium?

Yeah, so our founders, Yuri and Alex, they had been doing research at Intel and had really come to understand being at a manufacturer like that, that while there's certainly a lot to be done in cybersecurity, at the OS and at the browser level and applications, et cetera. They were dealing every day with the components and everything, you know, it's our tagline is to load the OS. But that's really true, right? Is there is a lot that is going on with stuff that you don't traditionally think of when you hear software, but, you know, firmware is just effectively software that's down at a lower level. And as we are seeing, right, we're recording this April 15th, then There's another big issue with infrastructure in Palo Alto. A lot of these things that don't have a traditional operating system like Windows and an application on top of it, but either infrastructure like network devices or even getting down to chip and component levels. It's where a lot of the action is in cybersecurity. And so that was kind of the insight was people are doing a good job of defending everything on the top, but it doesn't mean a lot when the foundation is insecure. And that's where we come in.

That's awesome. What are the problems that Eclipsium is solving for its customers today?

So there are a couple. Again, for some of our more advanced customers, they have really locked down with really great tools like, you know, Tenable or CrowdStrike. They really have the OS and above locked down and they are looking at this attack surface on their infrastructure, on their firmware, on their UEFI, things like that. UEFI, depends on how you want to pronounce it. But they're saying, look, this is another area that we really need to pay attention to because it's where emerging threats are coming from. So that's for really sophisticated customers. And we're seeing that grow. There's also been awareness in just the world in general, that infrastructure is where things are starting to get a little hotter in cybersecurity. CISA has a known exploited vulnerabilities list. And in 2023, I think almost 3/4 of the items on that list dealt with infrastructure, not software and OS vulnerabilities. So security practitioners just across the globe are saying, maybe there's a thing here I need to pay attention to. And then thirdly, we are seeing some increased attention on the infrastructure supply chain. And just like how there's software supply chain, there's also interest in securing firmware in the supply chain. We're seeing regulatory drivers for that, things like the Criminal Justice Information Systems. They have some security policies that really mandate that law enforcement agencies and such be looking at the firmware of their devices. And as I mentioned at the start, right, that's something our founders thought about years ago. And so people are starting to look to us and say, hey, maybe you can help me.

Insights for company formation are always directly tied to major inflections in markets. With your product leadership hat on, if you were talking to other product leaders at general SaaS companies. What do you think you would describe are the major inflections in leading and operating a SaaS company today? Gosh.

So there are a bunch of macro trends that have been going on for a while. You know, we, everybody uses cloud anymore, right? I've been in the industry long enough. Actually, that was one of the most interesting inflection points I saw. I joined Qualys in 2010. And I remember it was January 2010. And we would often go into enterprise companies who would say, look, we are never going to use cloud for security. We just don't trust it. We need this stuff on-prem. And even 2 years later, 2012, we were winning those businesses over. So you saw this massive shift to cloud. And then over the last couple of years, you've seen a massive shift into public cloud providers, right? It's hard to find a company anymore that isn't using Amazon or GCP or Azure. It's a major backbone. And so with that, and it's taken cybersecurity a little bit to catch up, but the way that you buy, the way that you try, the way that you buy and the way that you use those products are pretty radically different, right? There's a lot of on-demand pricing. There's a lot of opportunity to try things for free and get a sense of, hey, do I want to use this? And, you know, as you find products that work really well, there's a lot of exploration of the vendors now of, okay, well, they solved this problem for me. What other problems can they solve? And so this is really In the last couple of years especially, I've really seen this, that people have that expectation for SaaS vendors across the board. Give me a way to try your product, see how it works. Give me an ability to tailor my spending according to my needs right now, but also in 6 months. And then give me an opportunity if I like what you're doing to, to do more with you and really deepen that partnership in a way that You know, maybe 15 years ago it was really solid to say, look, we do one thing and we just do it well. I'm still a huge believer in that to start. But as a company, as a SaaS provider, people want to know, okay, now that you've done this thing well, what's the next thing you're going to do well?

Totally agree with all of that. And maybe a good segue later when we get into pricing and packaging and how you're thinking about that at Eclipsium. But before we go there, I'm curious about the role that AI has in your life as an operator.

Yeah, that's really interesting. So I'm going to go back, I'm going to go back about 5 years, right? I actually was head of product at a company called Extrahop. And Extrahop was really interesting to me. I had previously been at Tenable. We had hired a lot of really smart data scientists and were trying to figure out how to do more with our data. And then I joined Extrahop and they had this practice that had been in place for years where they had some really sophisticated ML models and were able to do things with data we had never seen before. And one of the most formative examples for me was We made a model that was to identify your most critical assets. And we tried running it on our own data first. We said, just give us our 15 most critical assets. And 14 of them made sense, right? Our domain controllers and our databases and this and that. And then there was one just janky laptop. And we said, well, you know, it's not bad. 14 out of 15. Let's go see what went wrong with the model there and tune it. To do some investigation. And that laptop, which was literally the laptop tucked under a developer's desk, it was uploading our virtual images for sale to all the cloud providers. It was probably our most important asset. And the model had gotten it right. We never would have known. And that for me was the kind of aha of— we said ML back then, but it's really more AI today. AI can do things. That and help us as humans get insights we wouldn't have gotten. And so at the companies I've been at since, we've really taken a heavy focus on, hey, let's structure our data, let's arrange our data so that we can apply some of these tools and let's see what emerges. We're doing that today here at Eclipsium as a good example. LLMs are really well tuned for some types of jobs we do. Around looking for suspicious code when we decompile binaries, for helping us understand patterns in data we grab from third parties and such. So that's what I am seeing. And I do it personally as well, right? I've started using AI coding assistants for my little rocketry projects and stuff. They give me capabilities to do things I wouldn't have been able to do before. And we're really early days still, so it's exciting to see where this is going to lead.

Very exciting. Very cool. What a story. Okay. I want to talk to you about what it means to operate really well. When you think about sort of abstractions like this idea of operational excellence, I'm curious what comes to mind. How have you seen operational excellence play out at different companies that you've been a part of?

That is a great question. I will admit, I think my thinking's evolved on this through the past 10, 15 years. There was a point, and I still think this is a major component, right? Operational excellence is, as my friend Dave Cole, who loves working out, would always say, it's about just doing the reps, right? Get in the gym and do the reps. And there is something really true about that. I've worked at companies of varying sizes. They have different needs for process, but there's always a need for at least consistency and building that muscle memory. I'm going to torture this metaphor a little and really put in the reps because that's how you start to get good at doing certain things. And then you realize, oh, what I'm looking at is just a variation of something I already know how to do. Rather than reinventing a whole new way or scrambling to figure it out, you apply those muscles you've already built. I still think that's a huge part of operational excellence. The last few years, and this maybe goes back to the earlier question about what like SaaS and AI have unlocked, I've started to realize, or at least think that Operational excellence is also about being able to be really nimble, using data to really highlight, hey, what is actually happening rather than what do I intuit or what do I want to happen? What's really happening? And the ability to leverage that information and quickly make decisions. And sometimes that means quickly abandoning earlier decisions you made. But being open to being flexible and not being totally tightly bound by, look, I know how to do this one thing really well, so that's what I'm going to do. But also seeing, well, but the data's telling me it's time to learn a new skill here. I think that's become much, much more important to me over the last few years. As I look at companies that really execute well, I see that nimbleness and flexibility as well as just superb mastery when they, uh, when they get into something they know how to do.

I think that's such an interesting point. And I remember, um, in the past when we've been working together, we often used to talk about this idea that competitiveness was a function of iteration pace. Um, and I think maybe this is the right segue from your earlier comment about SaaS trends, but this idea that the customer is very empowered wants to be able to buy and try and pay for software in a variety of ways gets right to the heart of how companies go to market, how companies iterate, how companies build product. And one thing that is often not talked about super early on but becomes very important over time is a pricing and packaging practice. Willingness to pay is so central to product market fit. Can you talk a little bit about how you think about building a pricing and packaging practice at Eclipsium?

Yeah, and Eclipsium, we are really at an interesting point. As I mentioned, we, we have historically, we've been really compelling for larger enterprises or organizations that are pretty well locked in. And so as a result, the way that our pricing and packaging works, there's a lot of consideration for scale, right? And a lot of things that make sense because we're assuming that there are, you know, there are going to be a lot of different types of endpoints or servers, or we need to handle vast amount of component data. But what we're seeing now, especially with some of the compliance drivers, the CGIS, the Center for or criminal justice information systems, that starts to impact like sheriff's departments that are not massive scale. They have, you know, a handful of officers, a handful of devices on the fingerprint database or what have you. And so our expectations of, oh, hey, here's how you deploy and here's some time we spend, etc., they don't necessarily fit. And especially how we price and package. Eclipsium can do so many really cool things to help you understand your infrastructure. But for this particular group, they just need to be able to say, yeah, we've addressed this, we've covered our firmware needs. It's a very straight compliance play at much smaller scales. And everything about how we do business, how our sellers and our SEs engage, how we have SKUs, how we have pricing, what our expectations are for our customer success team. They all have to be different for that different type of buyer. And that's something that, as you know well at Schematic, it's something that our current systems maybe weren't envisioned to give us those kind of knobs and levers to say, hey, we need something that's lower cost, faster, but is really targeted on a specific set of functionality that will grow, um, but, um, maybe in a very different way than we've traditionally done it.

If you were talking to other product leaders at startups, scale-ups, and they wanted to understand from you what are the operational constraints they need to be aware of as it relates to evolving pricing and packaging to support different customer types across different segments, How might you describe those constraints, the constraints that you have seen play the most acute role on limiting a business's agility?

Yeah, there are a couple of key constraints that I've seen. First and foremost is like quoting and pricing, right? And as I mentioned, one of the things that's really changed in recent years is people don't— it used to be, okay, I look up, I talk to somebody, I understand the price, and then I figure out where it fits in my budget, et cetera. And there was a whole process to that. Whereas today, people want to, hey, I want to get started. Get me started and let me see how it goes. And so we've found a lot of constraints around how do you make a trial license available for somebody, but actually see whether they're using it or not and decide As a seller, when is it time to start saying, look, it's time to wrap this versus when is it time to let them really start running well and see, wow, it's amazing all this stuff that can be done. Traditionally, your licensing and delivery systems have not been designed to allow that level of fine control on a customer-by-customer basis. The same is true with constraints around simple counting, right? One of the things before I joined the vendor side, when I was on the customer side of cybersecurity, one of my key tasks was figuring out just how to count how many assets I have. It's a running joke I make. In 25 years, we still don't seem to have figured that out as an industry, how to give reliable counts. But that is a central part of the selling process. And it becomes a really horrible constraint is, you know, if you have to ask somebody, well, tell me how many assets you think you're going to need this for, and they go, well, I have no idea. That can really run you into a ditch with the system that says, well, the first thing I need is how much are we talking about so I can apply volume discounts or whatever. And those kinds of constraints, what they always really come into and are especially relevant for a startup or a smaller company is, you know, we are establishing a market. We're still rounding out product market fit. And so there's, you know, we are not playing a symphony. We're doing jazz here every day. We're improvising. And the systems are designed not to play jazz so much, but to, you know, expect, oh, we know what's coming next. And That's just a huge constraint. That's a real challenge at this size and scale.

As a jazz fan, I love that metaphor. We've talked about trends, we've talked about pricing and packaging, we've talked about AI, we've talked about operating. One question I did want to dig in with you on is building product and having worked with you, you're such an impressive storyteller. I think you drive for the idea of building insanely great products. Can you talk a little bit about what you have found to be really effective procedures or techniques to drive alignment between product and engineering and go-to-market in the pursuit of great product development?

Yeah, that's a great question. I'm going to give two shoutouts here. Number one is gentleman Bill Olson, who I worked with at both Qualys and Tenable. He's the one who taught me the value of storytelling. Everyone in product, in sales, in engineering. So I tried to emulate his enthusiasm and his ability to spin a yarn. And then I worked with a gentleman, Elliot, years ago in UX, and he was the first one to really get me to think of it can't just be a product manager, even a product manager and an engineer who are hearing from customers. You actually need the UX team. The marketers should be listening in and the best way to do this is to tell a story, right? That everyone wants to read. And so that is a technique I've used at a bunch of companies, right? I try to bring the customer stories front and center through a variety of mechanisms. We have things called customer sponsor programs where, you know, when you're building features, you make sure to have customers embedded into the beginning. Of the development process. They should be reviewing wireframes and user stories. We have programs I usually call Voice of the Customer, which is getting customers just in front of and showing a day in the life, sometimes not even of your product, just of what their life is like to the development teams. And, you know, we'll let the marketing teams in as well to really understand, oh, I didn't realize people used our product in this way, or I see why this request is always coming up because this is the third time I've heard, oh, you know, I do this and then I export to CSV and I go massage it over here. So those sorts of pulling customer voices in, they're really just a way of telling a story that is deeply personal to the customer. But if, especially if you've really honed in on the market and you're paying attention to what problem are we trying to solve, those stories start to sound very similar. And then everyone gets it in their head. This is the person that I am building for. This is the job they're trying to do. And magic happens. Marketing knows how to talk about it. Engineering understands what they're building and how it's going to be used. Product understands if we need to tighten scope, here are the things that we can reduce or tighten up without actually losing our ability to be an awesome, lovable product. So storytelling is just fantastic top and down. And, you know, it also plays to my bias of loving to talk. This is one of my favorite movies.

But also loving to listen to customers talk, voice of the customer being so pivotal there.

That's absolutely right.

This has been so much fun. Thank you for doing it. Where can people learn more about Eclipsium?

Yeah, thanks, Fynn Glover. Obviously, they can come to the website eclipsium.com. We will be out at RSA booth 226. So come visit us. We're going to be showing off some cool stuff, like some AI stuff, but also the CGS reports, etc. And of course, I tried to do a monthly or bimonthly every other month, product webinar, which we invite both customers and prospects. So if you want to see what we're thinking about and where we're headed, it's a great time to join. Right on our website, you can sign up.

That's great. And I'll link to all that in the show notes. Thank you again, Corey. Thank you, Fynn.

It's a pleasure as always.