3 Secrets that will Supercharge Your Sales Cycle and Close Deals Faster with Aptible CEO Chas Bellew

Your competition in the competitive landscape as well. So I want to talk about. We're going to introduce three things. Three lessons learned today from companies. Successful SaaS, companies that have sort of grown and adopted and gone into market that you can use today to speed up deals and to close deals faster. So the first thing you can do today is. Here we go. Secret number one. The first thing that we see larger companies doing consistently is moving up the conversation around security and starting it earlier and earlier and earlier.

Chaz, I think you might still be on your title slide.

Am I still. Where am I? Is this the title? Can you. What can you see?

I can see your face with the title of the presentation.

Okay, so if I put it into. Can you see this?

Nope.

Is this showing? Yes.

Yeah, I think maybe we'll just do that because it's probably easier.

Okay. So as I apologize for the. For not not being able to show you, the, the progression and the increased demands for data protection and security are a direct result of the proliferation of this model of, of using cloud services and using cloud vendors for all sorts of functions and purposes. A lot of companies, and increasingly. I saw Mary Meeker's last.

Did you.

You know, Mary Meeker's Internet trends, and I believe this was the 2019 report. Cloud is still like 22% of all enterprise workloads and is increasing rapidly. And what this has meant is of course like growing adoption of SaaS and growing sort of market for SAS companies. But at the same time, security and compliance are these existential issues. They're becoming like oxygen in the atmosphere. You need them to grow. So going to the things that you can do today. Lessons learned from companies that have ridden the growth, you know, and availability in these markets. The first one is being able to proactively in the sales cycle, go in and set the stage for your customer around, around security and compliance and basically getting them to be able to trust you as a vendor. The, the old, I mean, 20 years ago there were a lot of companies that still did security reviews after closing. So you would close the deal and be in basically implementation and post sales and they would do security. Today, it's become very, very standard to have it as part of the approval process and procurement, even to get approved. But if you leave it up to a customer, they will often, you know, it's inconsistent. Sometimes they'll ask early, sometimes they'll wait until the end. And a lot of times what we see in what larger companies and more scaled companies have seen is that that can blow up deals. You can't get visibility or repeatability until you start this process and see how you match up with the customer's expectations. So we see very consistently apologies, very consistently, companies moving with what some people call moving left. This is Stephen Nguyen, the director of GRC at segment talks about this, about moving the security conversation earlier and earlier in the sales process and getting it started ultimately much sooner. The way Steven talks about it is. Let me see. I'm gonna get the. I see Zoom had my microphone turned down. Is this better too? Can you hear me? Thanks. This is a quote from Stephen. Thanks for the heads up. This is a quote from Steven around. You know how they think about what Eagle's moving left in the sales process, right. We try to start security conversations up front and then they, you know, they invest in sales enablement tools effectively using compliance as sales enablement, investing in front loading that see. So again when in segment in the sales process, as soon as they've basically like started qualifying a customer, they're prepared to, you know, multi thread within that account, start the vendor security and procurement process and then going and be able to start showcasing some of their investments here. So anybody, you do not have to be a scaled company or a late stage organization to be able to do this and as part of your sales process and part of your sales methodology to begin introducing, especially if you're in B2B SaaS, especially if your customers, you know that they're going to ask for this anyways and you can get a surprising amount of benefit by being proactive about those. That brings us to sort of the next, the next question. So if this is if overall you're starting the security conversation earlier in the sales process, right further up the funnel, there's still a second question of how long does it take you to have the security conversation and what does that mean ultimately the security conversation, that phrase just means building trust with your customer and letting them essentially you're looking to create the result that they can, you're approved to do business with them, that they can for whatever trust means to them. For some of them it may mean, you know, oh, you have a security page on your website. For others, if you do business with banks, for example, it means audits and questionnaires and evidence production and a lot more intense of a process. So this can vary. But the second secret that we see here, the second thing I want to leave you with that you can start doing today, is not only moving security further left in the sales methodology, but actually shortening the amount of time it takes to have that security conversation. You can do this by making it faster and faster and ultimately even more self serve to you and in basically trust building documents. And we'll talk if anybody's curious about what are various sort of artifacts that you can use to build trust here. But what we see from again from scaled companies, from companies taking a few other examples from companies that are further along, Slack is a good example. You see a lot of these compliance and security pages and when you what they're doing is making this self service that's on the marketing site, being able to go in and download the certificates, at least the ones that have publicly accessible information. Slack does this. Some of this stuff you ultimately do have to request. Like you can see over here on the HIPAA one, you need to be able to file a request with them. But having this up front really helps. Datadog another good example, you do the same thing putting these documents. Now you may be looking at this and saying well what about yeah, I don't, I don't have certifications right necessarily. What can I, what can I lead with? What can I put up front? And there are some evidence Q and A on that. There's some really good answers and there's some very effective, effective tools that you can invest in and use or pre populated or standardized questionnaires for example that you can get started with today. But this is what we see from large companies is that they do, they put this, they make these investments in making these packages. Stephen described them and just like Steven said, compliance can ultimately speed up a deal. At the same time we hear from scaled companies, companies that are growing from 100 to 500 to 1,000 people, that at some point the growth of the company becomes dependent on the ability of the security department to turn around vendor security questionnaires, packages, answers, things like that and that often the bottleneck is that the security team to work on any one of these projects or deals is going to need to be involved. There was a really good. I'm actually going to answer one of the Q and A questions that popped up here because it's right on this point. When do you think security should be done by a sales member or another person? And how do you do, you know between demo, like sales engineers, sales reps, security. Do you have like security engineers? How does security get involved in the sales cycle? And one thing I will say I'm happy to give my opinion later but one thing I'll say from what we see with our customers who are 100 to 1,000 person companies is that the security team ultimately gets the approval for whatever the final answer is going to be. And those things if the company, depending on the company's domain. Some companies figure that out the hard way and they make promises, security promises to, to customers. Because the sales team just like does whatever and they make promises and then they find out later, sometimes through an incident or sometimes just through a change in management, that they've made a bunch of promises that are not true and they need to go clean that up. Most companies on the other hand, understand that they don't want to give a customer a bad answer and they make security an improver on these processes. And security does end up, the security team function does end up bottlenecking, especially if there's a big rush at the end of the period or an end of a deal to get deals through. You know, this is a 400 person company that's growing to 800 this year and they have to tell the growth of the company, you know, gets constrained if somebody comes in the last two weeks and says we need to go through, you know, security assessment in two weeks to help this. And part of the reason why this takes a while sometimes it's actually just getting the, you know, getting the answers. A lot of times you see stuff like this and this is a, this is an example like a typical workflow from a, you know, hundred to one thousand person company. For, as a, as a sales prospect, how do I get access to like a SOC2 report or a pen test report or something that's not like he can't put it exactly on the website. Right. You don't want to make it like downloadable. At one of our, one of our customers we mapped out, we did like a customer journey like workflow mapping with product and they had 18 different steps that were required just to get somebody like a confidential security document. And this is pretty common. I would say increasingly what we see and what we use at Apptimal is like a data room type tool. So this is, we sort of built our own solution for this. And today the thing that really helps is as soon as you've invited a customer to give them access, you've pre cleared them for access, they can start consuming the security documentation and getting in and using it instantly. And so the amount of time it takes instead of the problem is that this often these, whether it's eight steps or 18 steps here, each of these steps has some variability that ends up taking 24 hours or two days or three days. And you get this inflation ultimately of your sales cycle. Where you are waiting on, you know, legal, you're waiting on somebody else in order to just like. And the customer is just not doing anything during that time. So speeding this up and getting to. Getting to yes helps. There's a question around how much I missed the context for that. But if you want to re. Ask again, I'm happy to answer. I think it was a question maybe about time or expense or something like that. Okay, so the last thing that I want to leave you with is, and this is still accessible to you today, no matter what company size you are, there is information out there that you can use today to improve your growth, to sell bigger deals, to sell faster deals and to close more predictable revenue. The means to it are, I don't know, you can. There. There are various ways of sort of gathering this data and getting this data. One of the things that we see really common. And I'm going to go back to these other slides. One of the things we see really commonly is using the. Using like, I don't know, like Zendesk or like a help desk, a ticketing system to file requests or have people make requests. And then there's a separate flow for the NDA and then there's a separate workflow to get the actual secure document. Sometimes you have like a zip package that the security team will put together and then the sales team can use it. And the question is like, are things current? Is it complete? But what happens almost always is that the way that the documentation or the way the package is communicated back to the customer, you lose visibility. It's over email or it's, you know, it's really in like a data room or something like that. So you don't know. And this is really common. You don't know who is actually opening the stuff. Are they actually reading it? The sorts of things that you'd want to. You want insight. Like we're doing all this work, putting all this work into security and compliance. Does it actually matter? You can imagine like the, like a mock up like here of like a data room type tool where you have like artifacts and you ultimately want to know who you know metrics on whose actions, joining and leaving. And you can instrument your distribution process or build your distribution process in a way where you can actually see who it within a specific deal. Like has my security and compliance contact actually opened, you know, my, you know, questionnaire or have they looked at the SOC T report? Is this deal likely to close, you know, at the end of September if they haven't touched the package that we sent you can find out within an account not just like is one person engaged, but has their boss engaged with it? Has the improver engaged with that? Do we have a potential threat to the deal at the account and are they engaged with your security package? And the last is something that we hear really commonly, which is how do I know if I sent the customer five different documents? Which ones are they actually, which ones do they actually care about? Ultimately you can wire sort of, you can wire stuff up. The best solution that's not a data room solution that I've heard is putting everything in Salesforce and then using like yes, where or some other like tracking tool to be able to sort of embed your package and email and use click tracking and email to do that. Like I said, we built our own tool for this. But these are the types of contributions to predictability of revenue and predictability of closing deals that if you're not gathering metrics on how your customers are actually engaging with your security and compliance stocks, you may be leaving money on the table. I'm happy to answer more or talk more about how to do this. So again, wrapping up here, if there are three things I want to leave you with, there are three opportunities. No matter whether you're a two person company or a 2,000 person company, the likelihood if you're a 2,000 person company that you're already doing some of this stuff is increasingly high. But if you're not, you can get there faster by talking about and starting the conversation around security earlier in your sales cycle. Equip your sales team to, to upfront, showcase your security and compliance posture. Set the tone for our customers. Build the contacts that you're gonna need to get approval. Get introduced to vendor management, vendor risk within your customer earlier rather than later. It'll make the wholesale cycle more predictable and faster. Second is once you give the customer access to, or wanna give them access to your docs and give them as much as you can and really try to shorten the amount of time it takes them to understand that they can trust you. And I'm going to talk, I got a couple questions in the Q and A about like what can we do? How can we make these processes more efficient? I'm looking forward to getting to those. And the last one is again, if you're flying blind with how your investments in compliance or security, whether it's a questionnaire like a cake light or a sig light or something that like, like that, all the way up to a program like Datadog or Slack where you're, you're doing multiple audits and investing, you know, maybe millions in terms of headcount and budget across the year. If you don't know how engaged your prospects and customers are, you are, you're. Yeah. Likely leaving growth on the table. So with that I'm going to wrap here, thank you all and start answering questions. I'll stop the screen share here and just go into questions. Rebecca, do you want to begin some of these questions?

Yep. So one person asked. We're currently building a library of questions and answers based on security reviews that we've completed in the past. When it's time to complete a security review, the staff can then use that library to answer the questions. Do we have a tool or a recommendation for how to make that more efficient?

Yeah, that's a good question. There is a entire pretty much any RFP tool like Lupio, Rfpio, Scout, RFP are all this kind of like class of software or tooling to be able to sort of take pre approved answers or a knowledge base of statements that are true about the company and then be able to match novel questions like novel security questionnaires or novel RFP questionnaires with those statements. So any of those tools in that category now depending on and I'm happy to answer follow ups or expand on this depending on your budget and size. I think in general like RFP tools like that start around 10k or more. There may be cheaper options. There may be ways to do that. A lot of the, you know, the hard part comes not by picking a technology tool and populating it with the initial set of answers, but a lot of what we see. Our customers are 100 to 1000 plus person companies that have almost always hired like a director of compliance, a director of security. And the thing that we see that breaks is keeping those answers up to date. And that takes a lot of time and work and there's not really a good solution. We talk to customers who are like I need to hire three people and I would, one of them would just go update Lake Lupio for me. We have like 3000 answers in Lupio and 1500 of them are correct and 1500 are wrong and I don't know which is which and neither does the sales. Same to your stuff like that. The recommendations for how to make that more efficient vary as you scale. So if you're completely just starting from scratch in the beginning, you know the, an RFP tool might help. That might be a good investment if you have the budget for it over time you're going to have to also budget in investing and keeping it up to date. All right, happy to answer or follow up on that or happy to keep going.

I think we've got about one minute left, so we'll try to fit one last question in. But feel free to visit the Apptable booth in the Sastor or console and we'll have people on hand to answer some of these questions. The last question is just get your thoughts, Chaz, on how smaller companies can demonstrate confidence in security for things like caiq Lite.

Yeah, a smaller company, if you're a small shop, one of the things that you can do, and I like the preface of the question, is invest in at least answering or filling out a standardized security assessment questionnaire. There's one by the Cloud Security alliance called the Consensus Assessments Initiative Questionnaire, which is just like a standardization initiative. You can access the, we call it the CAKE CAIQ questionnaire. And that's something where you can go through and see. You may not, if you're a smaller company, you may not really know like what do I put for like physical security or like network security. We're on Heroku. What does that mean? Those are common questions for smaller teams. But what a standardized questionnaire like that gives you is a, is a framework that the assessors at your vendors who are likely to be professional compliance and security professionals that they will have seen, they've, they know, everybody knows insecurity. Like what the CSA CAKE form is another good one. Another one that's very commonly asked for, especially in like in fintech and in other sort of areas would be the, what's called the SIG or the SIG Light. I think it's like Stanford Standard Information Gathering. You can just, if you Google like SIG SIG Security Questionnaire. That's another good one. I know that there's also a group called the Vendor Security Alliance. It's, you know, has a standardized questionnaire that is less commonly accepted, although maybe more relevant if you're a cloud, pure cloud play vendor. A lot of the questionnaires in that, questions in that questionnaire are specific to cloud and you may have less kind of WTF moments when you're going through versus something like a SIG or a CAKE form that will have sections, entire sections on physical security and other security controls that you may, you may just be like, what do I do? I'm not sure. But those are, those are three great places to start the CSA CAKE caiq, if you Google it, the SIG questionnaire and the Vendor Security alliance all right. Does that bring us to time? Any other questions?

Those were all the questions that came in from Q and A from the audience. So, Tammy, I don't know if you need to close us out or anything, but.

Yes, I can. Thank you so much for joining. It was such a pleasure having you, Chas. Thank you, Rebecca, for moderating. All these slides will be be available and in recordings after the event. Thank you so much for joining us and have a wonderful day.