3 Secrets that will Supercharge Your Sales Cycle and Close Deals Faster with Aptible CEO Chas Bellew

your competition and competitive landscape as well. So I want to talk about, I'm going to introduce 3 things, 3 lessons learned today from companies, successful SaaS companies that have sort of grown and adopted and gone to market that you can use today to speed up deals and to close deals faster. So the first thing you can do today is— here we go, secret number 1. The first thing that we see larger companies doing consistently is moving up the conversation around security and starting it earlier and earlier and earlier.

Chaz, I think you might still be on your title slide.

Am I still? Where am I? Is this the title? Can you— what can you see?

I can see your face with the title of the presentation.

Okay, so if I put it into— can you see this?

Nope.

Is this showing?

Yes. Yeah, I think maybe we'll just do that because it's probably easier.

Okay, so as I apologize for the, uh, for not, not being able to show you the, the progression and the increased demands for data protection and security are a direct result of the proliferation of this model of, you using cloud services and using cloud vendors for all sorts of functions and purposes. A lot of companies and increasingly, I saw Mary Meeker's last, did you see Mary Meeker's Internet Trends? And I believe this was the 2019 report. Cloud is still like 22% of all enterprise workloads and is increasing. Rapidly. And what this has meant is, of course, like growing adoption of SaaS and growing sort of market for SaaS companies. But at the same time, security and compliance are these existential issues. They're becoming like oxygen in the atmosphere. You need them to grow. So going to the, the things that you can do today, lessons learned from companies that have ridden the growth, you know, and availability in these markets. The first one is being able to proactively in the sales cycle go in and set the stage for your customer around security and compliance and basically getting them to be able to trust you as a vendor. The old, I mean, 20 years ago, there were a lot of companies that still did security reviews after closing. So you would close the deal and be in basically implementation and post-sales, and they would do security. Today it's become very, very standard to have it as part of the approval process and procurement, even to get approved. But if you leave it up to a customer, they will often You know, it's inconsistent. Sometimes they'll ask early, sometimes they'll wait until the end. And a lot of times what we see in what larger companies and more skilled companies have seen is that that can blow up deals. You can't get visibility or repeatability until you start this process and see how you match up with the customer's expectations. So we see very consistently apologies, very consistently companies moving what some people call moving left. This is Stephen Wynne, the Director of GRC at Segment, talks about this, about moving the security conversation earlier and earlier in the sales process and getting it started ultimately much sooner. The way Stephen talks about it, is, let me see, I'm gonna get the, uh, I see Zoom had my microphone turned down. Is this better too? Can you hear me? Thanks. This is a quote from Steven. Thanks for the heads up. This is a quote from Steven around, um, you know, how they think about what he calls moving left in the sales process, right? We try to start security conversations up front, and then they, you know, they invest in sales enablement tools effectively using compliance as sales enablement, investing in front-loading that. See, so again, when in its segment in the sales process, as soon as they've basically like started qualifying a customer, they're prepared to, you know, multi-thread within that account, start the vendor security and procurement process, going and be able to start showcasing some of their investments here. So anybody, you do not have to be a scaled company or a late-stage organization to be able to do this. And as part of your sales process and part of your sales methodology to begin introducing, especially if you're in B2B SaaS, especially if your customers, you know that they're going to ask for this anyways, and you can get a surprising amount of benefit by being proactive about those. That brings us to sort of the next, the next question. So if this is, if overall you're starting the security conversation earlier in the sales process, right, further up the funnel, there's still a second question of how long does it take you to have the security conversation, and what does that mean? Ultimately, the security conversation That phrase just means building trust with your customer and letting them— essentially, you're looking to create the result that they can— you're approved to do business with them, that they can, for whatever trust means to them. For some of them, it may mean, you know, oh, you have a security page on your website. For others, if you do business with banks, for example, it means audits and questionnaires and evidence production and a lot more intense of a process. So this can vary, but the second, the second secret that we see here, the second thing I want to leave you with that you can start doing today is not only moving security further left in the sales methodology, but actually shortening the amount of time it takes to have that security conversation. You can do this by making it faster and faster and ultimately even more self-serve to invest in basically trust-building documents. And we'll talk, if anybody's curious, about what are various sort of artifacts that you can use to build trust here. But what we see from, again, from scaled companies, from companies, you know, taking a few other examples from companies that are further along, Um, Slack is a good example. You see a lot of these, these like compliance and security pages, and what they're doing is making this self-service that's on the marketing site, being able to go in and download the certificates, at least the ones that have publicly accessible information. Slack does this. Some of this stuff you ultimately do have to request, like you can see over here on the HIPAA One, you need to be able to file a request with them, but having this up front really helps. Datadog, another good example, you do the same thing, putting these documents. Now you may be looking at this and saying, well, what about, yeah, I don't have certifications, right, necessarily. What can I lead with? What can I put? Up front. And there are some— I'm happy to take Q&A on that. There's some really good answers and there's some very effective tools that you can invest in and use, or pre-populated or standardized questionnaires, for example, that you can get started with today. But this is what we see from large companies is that they do— they put this— they make these investments in making these packages. Steven described them. And just like Stephen said, like, you know, compliance can ultimately speed up a deal. At the same time, we hear from scaled companies, companies that are growing from 100 to 500 to 1,000 people, that at some point the growth of the company becomes dependent on the ability of the security department to turn around vendor security questionnaires. Packages, answers, things like that. And that often the bottleneck is that the security team to work on any one of these projects or deals is going to need to be involved. There's a really good— I'm actually going to answer one of the Q&A questions that popped up here because it's right on this point. When do you think security should be done by a sales member or another person, and how do you do, you know, between demo, like sales engineers, sales reps, security, you know, do you have like security engineers? How does security get involved in the sales cycle? And one thing I will say, I will, I'm happy to give my opinion later, but one thing I'll say from what we see with our customers who are 100 to 1,000 person companies is that the security team ultimately gets the approval for whatever the final answer is gonna be. And those things, if the company, depending on the company's domain, some companies figure that out the hard way and they make promises, security promises to customers 'cause the sales team just like says whatever and they make promises and then they find out later, sometimes through an incident or sometimes just through a change in management, that they've made a bunch of promises that are not true and they need to go clean that up. Most companies, on the other hand, understand that they don't want to give a customer a bad answer, and they make security an approver on these processes. And security does end up— the security team and function does end up bottlenecking, especially if there's a big rush at the end of the period or an end of a deal to get deals through. You know, this is a 400-person company that's growing. To 800 this year, and they have to tell— the growth of the company, you know, gets constrained if somebody comes in the last 2 weeks and says we need to go through, you know, security assessment in 2 weeks. To help this, and part of the reason why this takes a while, sometimes it's actually just getting the, you know, getting the answers. A lot of times you see stuff like this. And this is an example, like a typical workflow from a, you know, 100 to 1,000 person company for— as a sales prospect, how do I get access to like a SOC 2 report or a pen test report or something that's not like— he can't put it exactly on the website, right? You don't want to make it like downloadable. At one of our customers, we mapped out, we did like a customer journey, like workflow mapping with product, and they had 18 different steps that were required just to get somebody like a confidential security doc. And this is pretty common, I would say. Increasingly what we see and what we, you know, use at Aptible is like a data room type tool. So this is, We sort of built our own solution for this, and today, you know, the thing that really helps is as soon as you've invited a customer to give them access, you've pre-cleared them for access, they can start consuming the security documentation and getting in and using it instantly. And so the amount of time it takes instead of— the problem is that this often these, whether it's 8 steps or 18 15 steps here, each of these steps has some variability that ends up taking 24 hours or 2 days or 3 days, and you get this inflation ultimately of your sales cycle where you are waiting on, you know, legal, you're waiting on somebody else in order to just like— and the customer's just not doing anything during that time. So speeding this up and getting to yes helps. There's a question around how much. I missed the context for that, but if you want to re-ask again, I'm happy to answer. I think it was a question maybe about time or expense or something like that. Okay, so the last thing that I want to leave you with is, and this is still accessible to you today no matter what company size you are, there is information out there that you can use today to improve your growth, to sell bigger deals, to sell faster deals, and to close more predictable revenue. The means to it are, I don't know, there are various ways of sort of gathering this data and getting this data. One of the things that we see really common, and I'm gonna go back to these other slides, One of the things we see really commonly is using the, using like, I don't know, like Zendesk or like a help desk ticketing system to file requests or have people make requests, and then there's a separate flow for the NDA, and then there's a separate workflow to get the actual secure document. Sometimes you'll have like a zip package that the security team will put together, and then the sales team can use it, and the question is like, Are things current? Is it complete? But what happens almost always is that the way that the documentation or the way the package is communicated back to the customer, you lose visibility. It's over email or it's, you know, it's really in like a data room or something like that. So you don't know, and this is really common, you don't know who is actually opening the stuff. Are they actually reading it? The sorts of things that you'd want insight, like we're doing all this work, putting all this work into security and compliance. Does it actually matter? You can imagine like the, like a mock-up like here of like a data room type tool where you have like artifacts and you ultimately want to know who, you know, metrics on who's actually joining and leaving, and you can instrument your distribution process or build your distribution process in a way where you can actually see who it— within a specific deal, like, has my security and compliance contact actually opened, you know, my, you know, questionnaire, or have they looked at the SOC 2 report? Is this deal likely to close, you know, at the end of September if they haven't touched the package that we sent? You can find out within an account, not just like, is one person engaged, but has their boss engaged with it? Has the improver engaged with it? Do we have a potential threat to the deal at the account, and are they engaged with your security package? And the last is something that we hear really commonly, which is, how do I know if I sent the customer 5 different documents, which ones are they actually— which ones do they actually care about ultimately? You can wire sort of, you can wire stuff up. The best solution that's not a data room solution that I've heard is putting everything in Salesforce and then using like Yesware or some other like tracking tool to be able to sort of embed your package in email and use click tracking in email to do that. Like I said, we built our own tool for this, but these, these are the types of contributions to predictability of revenue and predictability of closing deals that if you're not gathering metrics on how your customers are actually engaging with your security and compliance docs, you may be leaving money on the table. I'm happy to answer more or talk more about how to do this. So again, wrapping up here, if there are 3 things I want to leave you with, there are 3 opportunities, no matter whether you're a 2-person company or a 2,000-person company, The likelihood, if you're a 2,000-person company, that you're already doing some of this stuff is increasingly high. But if you're not, you can get there faster by talking about and starting the conversation around security earlier in your sales cycle. Equip your sales team to upfront showcase your security and compliance posture. Set the tone for customers. Build the contacts that you're going to need to get approval, get introduced to vendor management, vendor risk within your customer. Earlier rather than later. It'll make the whole sales cycle more predictable and faster. Second is once you give the customer access to, or want to give them access to your docs, give them as much as you can and really try to shorten the amount of time it takes them to understand that they can trust you. And I'm going to talk, I got a couple questions in the Q&A about like what can we do, how can we make these processes more efficient. I'm looking forward to getting to those. And the last one is, again, if you're flying blind with how your investments in compliance or security, whether it's a questionnaire like a CakeLight or a SigLight or something like that, all the way up to a program like Datadog or Slack where you're, you're doing multiple audits and investing, you know, maybe millions in terms of headcount and budget across the year, if you don't know how engaged your prospects and customers are, you are, yeah, likely leaving growth on the table. So with that, I'm going to wrap here. Thank you all, and start answering questions. I'll stop the screen share here and just go into questions. Rebecca, do you want to begin some of these questions?

Yep. So one person asked, we're currently building a library of questions and answers based on security reviews that we've completed in the past. When it's time to complete a security review, the staff can then use that library to answer the questions. Do we have a tool or a recommendation for how to make that more efficient?

Yeah, that's a good question. There is an entire— pretty much any RFP tool like Loopio, RFP.io, Scout RFP are all this kind of like class of software or tooling. To be able to sort of take pre-approved answers or a knowledge base of statements that are true about the company and then be able to match novel questions, like novel security questionnaires or novel RFP questionnaires with those statements. So any of those tools in that category. Now, depending on, And I'm happy to answer follow-ups or expand on this. Depending on your budget and size, I think in general, like, RFP tools like that start around $10K or more. There may be cheaper options. There may be ways to do that. A lot of the, you know, the hard part comes not by picking a technology tool and populating it with the initial set of answers, but a lot of what we see our customers are 100 to 1,000+ person companies that have almost always hired like a director of compliance, a director of security. And the thing that we see that breaks is keeping those answers up to date. And that takes a lot of time and work. And there's not really a good solution. We talked to customers who are like, I need to hire 3 people. And I would— one of them would just go update like Loopio for me. We have like 3,000 answers in Loopio and 1,500 of them are correct and 1,500 are wrong, and I don't know which is which, and neither does the sales team. So you hear stuff like that. The recommendations for how to make that more efficient vary as you scale. So if you're completely just starting from scratch in the beginning, you know, the— an RFP tool might help. That might be a good investment if you have the budget for it. Over time, you're going to have to also budget in investing in keeping it up to date. All right, happy to answer a follow-up on that, or happy to keep going.

I think we've got about 1 minute left, so we'll try to fit one, one last question in, but feel free to visit the APTiBLE booth in the SaaStrr console, and we'll have people on hand to answer some of these questions. The last question is just get your thoughts, Chaz, on how smaller companies can demonstrate confidence in security for things like CAIQ Lite?

Yeah, a smaller company, if you're a small shop, one of the things that you can do, and I like the preface of the question, is invest in at least answering or filling out a standardized security assessment questionnaire. There's one by the Cloud Security Alliance called the Consensus Assessments Initiative Questionnaire, which is basically like a standardization initiative, you can access the— we call it the CAIQ questionnaire, and that's something where you can go through and see— you may not, if you're a smaller company, you may not really know, like, what do I put for, like, physical security or, like, network security? We're on Heroku, what does that mean? Those are common, you know, questions for smaller teams, but what a standardized questionnaire like that gives you is a, uh, it is a framework that the assessors at your vendors, who are likely to be professional compliance and security professionals, that they will have seen. They've, they know, everybody knows in security like what the CSA CAKE form is. Another good one, another one that's very commonly asked for, especially in, uh, like in, in fintech and in other sort of areas, would be the what's called the SIG or the SIG Lite. I think it's like Stanford Standard Information Gathering. You can just— if you Google like SIG, S-I-G, security questionnaire, that's another good one. I know that there's also a group called the Vendor Security Alliance that's, you know, has a standardized questionnaire that is less commonly accepted, although maybe more relevant if you're a cloud, pure cloud Play vendor. A lot of the questionnaires in that— questions in that questionnaire are specific to cloud, and you may have less kind of WTF moments when you're going through versus something like a SIG or a CAKE form that will have sections, entire sections on physical security and other security controls that you may just be like, what do I do? I'm not sure. But those are 3 great places to start. The CSA CAIQ, if you Google it, the SIG questionnaire, and the Vendor Security Alliance. All right. Does that bring us to time? Any other questions?

Those were all the questions that came in from Q&A from the audience. So, Tammy, I don't know if you need to close us out or anything, but—

Yes, I can. Thank you so much for joining. It was such a pleasure having you, Chas. Thank you, Rebecca, moderating. Um, all these slides will be available and in recordings, um, after the event. Thank you so much for joining us and have a wonderful day.