392: DoControl: A Founder's Lessons on Validating & Selling Your SaaS - with Adam Gavish

Adam welcome to the show hi thank you for having me my pleasure do you have a favorite quote something that inspires or motivates you that you can share with us there's one by Kobe B uh actually by Kobe B and Shaq where uh Shaq tell him uh there's no mean theme uh but Kobe tell him yeah but is I I love that so tell us about d control what does the product do who's it for and what's the main problem that helping to solve yes absolutely um so do control is a s security uh solution

helping security teams uh understand protect sensitive data stored in SAS applications such as Microsoft SharePoint or Google drive or flag Zoom J GitHub uh and so on so forth uh we begin to help by just discovering how much J do you have who owns it how it expose what how sensitive is it and then you know helping you eliminate those holes and exposures uh to uh reduce what we call attx surface and then by that we significantly reduce the risks that know organization take in as a company uh I know that now I have a

lot less data exposed to the wrong person any given time and moving forward we have to build automation or workflows around all different uh business logic to either enable or restrict Access Data based on you know the business context got it okay uh give us a sense of the size of the business where where you in terms of Revenue customers size of team so we in the early early few millions of R are across a couple of dozens of customers primarily from the US that were are IDE customer profile is got it and I think

you've raised 43 million yeah we we rais C A and B between 2020 to 2023 yeah so far so good and and how big is the team uh we are group of 50 people in the US and Israel Okay cool so let let's kind of talk about like where the idea for this business came from it was founded in uh 2020 so where did the idea come from what were you doing at the time yeah so I I I was a product manager at a company called Google uh where I was in charge of one

of the uh very um sensitive projects in launching uh a go Cloud solution for the federal Market um and of course as a product manager I had to collaborate with third party Partners uh you know research agencies marketing PR and all of that and of course I shared information with them over Google drive because you know trying to work um and every couple of weeks information security would just reach out to me via ticket and say hey remove that permission they're not employees I know they not employees I'm trying to work with them but uh

after several times I want went to the eighth floor I got a bag of cookie we had good cookies at Google and I asked them why are you doing it and they told me it's not you it's me you know we have over 100,000 employees we can't possibly know the business context of why people are doing what they're doing but one thing for sure we can't have company information share to the wrong person forever which totally makes sense but to me I thought maybe there's a better way to do that uh with minimal frustration and

more productivity okay so so many people kind of come across these types of problems and then they just go back to work right they just go back to their day job right so what one what was it about this problem that felt you know kind of made you want to go out and solve it and what did you do like how long did it take before you said okay I'm I'm actually G to I'm serious about this I'm going to go and actually do something so I actually didn't want to open a startup I had

a good life but uh uh my partner is very uh persuasive and very smart person and you know we decided to just test the water just talk to a bunch of security people here in New York where I live um and really validate the problem um you know it's one thing to experience the problem uh but it's another thing to validate that with the actual Persona you you could potentially sell a solution to and we talked over the course of about three months we talked with over 50 Security Professionals from various companies large public super

small startups and they all mention there is a problem in the space right in different variations but there is a problem there is a pain um and that may be understand okay there might be something there I'm still like I'm I'm convinced I'm I'm in but of course to kick it off you got to have funding the technology is so complex you can't possibly put boost upop it right and that's what we did uh we flew to Israel for a week book 22 meeting with v everybody said no but one what they only need is

one wow so wait so let's go back to the the validation so you say you spoke to about 50 Security Professionals were were these people all in your network or were they like strangers that you got time with so what we did is we reached out to all of our friends in the area that are uh kind of Executives or even the leaders of companies and we just asked them to connect to the security guide oh go um and then when we met those people we asked them hey do you have other sec2 people I

can talk to in the city uh and that's how you build a momentum you build a database of just friendly um innovator security people who just love to give back to the community none of them were people who we actually know I couldn't reach out to my customers at Google of course so so basically it sounds like you you kind of tapped into your network to get those initial meetings to people that you know either they were in the security space or they knew somebody and then you use that that good old who else do

you know who else should I talk to question which many of us don't use but it can work very well if you're if you're good at it and you do it consistently so that got you more doors open and more conversation started what were you asking them because at that point I guess you don't really know what problem you're solving no um I had some experience in doing some product research and I knew that the one thing I should never do is ask very specific question because that limited limits the way of thinking instead you

just ask open-ended question and let them talk and let the conversation flow um so we were asking things about hey you know how do you know how much dat you have in size applications and how is it exposed on a high level and then we let them speak and you got to pay attention to the tone of voice and body language and how they talk about those things and wherever you feel like there is some slight frustration you double down on that and dive deeper to better understand why did they react this way when we

talked about for example managing permissions for third party vendors why is it so annoying you and then you do it again and again and again it's like a muscle right okay cool so where did you land after those 50 conversations like you you mentioned okay we flew out to Israel and we had those VC meetings booked but what problem did you what was your pitch yeah of course so after consolidating all the feedback we got from those 50 people looking at the market looking at existing players looking at technology advanced uh all those stuff we

landed on on the idea that to solve for S security you have to understand s applications and existing Solutions try to solve that by um you know leveraging your network traffic or your endpoint traffic and things that are really great but they're not your actual s application API where you can truly fetch the information cross reference different pie of data from SAS application and understand why the data is exposed and how can I fix it and things like that that was the you know very unpolished first pitch and then the pitch of course evolved from

every meeting to another of course based on the feedback we got uh so I think we had like maybe 22 different version of the deck within a week okay you you've you've sort of narrowed down the problem that you're going to solve you've got deeper insights because you've you've had all these conversations with Security Professionals you have your own experience from having worked at Google and seen firsthand some of these kind of security issues and risks and so on but you didn't have a product nope nothing so so in some sense it's not that surprising

that most of the VC said no because they said okay you got an idea but you don't have a product you don't have customers you don't have any traction so why was it that that one VC saw this differently I think when you raise a the round the majority of the decision is around the team and the potential and and how big is the market and who else is in the market in terms of you know validating the market less about what do they have today um again spefic I'm talking specifically for the market I'm

operating in cyber security right because they know in cyber security for the most part it's not about building a quick and dirty plg St solution that you can ship right it's not that this is pretty cool by the way but it's not that it's building an Enterprise Focus solution with a bunch of Enterprise ready features that have nothing to do with your product but you have to get them done it takes time it takes people it takes money and they get that so I think at the beginning they're trying to understand okay do we have

the right team in place do we have the right Market in place is there a potential there um and then they bet it's a big bet it's out stage yeah and I'm curious like this VC that that said yes was that one of the earlier meetings you had or one of the last meetings that you had good question I was say something in the middle I don't quite remember but definitely not the early definitely not the late something in the middle so your pitch was getting better and better from each time you go and talk

to people even within the proess with them we got much better from the first pit to the you know Advanced due diligence okay great so how much did you raise and then what did you go do with that money so we ra uh today sounds nothing we ra a humble round of $3 million and so the first thing we did is of course putting together like a small SWAT team people we work with people we started with you know close friends people who trust right um the second thing is we went back to those 50

cisos 50 security Executives and asked them hey we're kicking things off we would love to partner with you on building the right solution no commitment no nothing all we need is like maybe weekly by-weekly 30 minutes call with your team to make sure we are doing the right thing and then I think we found maybe two two of them said yes two or three or something like that you know it's very very it's super hard right um and then you talk to them and they tell you okay this we need H first we need to

understand how much data do we have okay then you go back to your team and say okay let's connect to those app and the first Fisher will be okay give me all the data they have in let's say Google Drive show it on the screen then you go back to them and then then they go and the feedback will be like okay we need analytics we need to understand from our aggregation perspective how it looks like and then the next one will be okay then we need to break it down by Department because we need

to solid business unit by business unit and so on and so forth you get more and more and more and more feedback and feature request and they build accordingly until you get to a point where you find a flow a user story a use case they can work with it could be very small but it's something that provide value that's the goal at the beginning right just showed them the value somehow and I think it took us about three months to get there to a point where one of them really got like nice value like

we uncovered information he didn't know about before which is great then the next question is okay how much value is it for them to pay you know and that's so hard because then you're moving away from okay we have one flow it works it provide value to what is the minimal set of flows providing value that this customer is willing to pay for I don't care how much I don't even care how much they pay because for them to pay it means they need to go to procurement to legal to finance they need to pitch

it internally it requ re work if they are willing to do that it means they really get the value otherwise we're wasting their time right and so and that's what we wanted we wanted a paying customer and I think they paid like $2,000 which is it's like an iPhone and a half right it's nothing in Enterprise sale what two $2,000 a month no a year a year a year so it's like it's literally nothing but again it validate the fact that there is value so much value he went to in legal Finance to get to

get the contract done that's what we wanted and then you build it from there then okay 2,000 it's ridiculous we building an Enterprise business how do we make them pay 20 50 100 and that's where you really start to build the business so there you said there were like two or three customers that were working with you so presumably it was one of these that you know started paying you where did the next few come from like you had to find other people right you had to be on these initial two or three so that

was an interesting uh part in the journey because I officially became an SDR a sales development representative I didn't have any experience with sale like I'm a part guy I'm a software engineer I didn't know how to sell like sell code call but that's what it takes because this is a numbers game there's hundreds of thousands of companies in the US right so many different people on LinkedIn it's a numbers game at the end of the day somebody will answer somebody will reply somebody will be willing to go on a call and give it some

feedback so effectively we build like a small pitch um and we sent it to so many security people we we we hit the weekly limit in LinkedIn every single week by definition so what so what were you doing you you you you were building a list of finding people on LinkedIn and then sending them sending them a message or a connection request with a message yeah you send them a message again something super simple around hey I'm not selling to you anything I'm trying to build a relationship I'm working on an idea that I I

discovered at Google would love to get a feedback and then you know let's say 5% of those really go on a call and then 5% of the 5% maybe start to work with you as a design partner those are the numbers it's like super hard but the market is so huge that you hit it it's okay just takes time and consistency and it don't just me it mean my Partners so we're too it's good how many messages or LinkedIn connection requests you need to send to hit the limit on LinkedIn like what was what what

are we talking about here I think I mean when I started the journey I had maybe 3,000 friend friend Connection on LinkedIn today I have 177,000 so and and but that's what it takes again it's about getting the market awareness Market presence getting to know people people you got to be likable you got to really care about those people you got to get really become interested in those people who are they what their background what are they doing for living you know and you build a relationship and this is a valuable skill later on when

you really try to close the deal right so yeah so so we discovered more potential design partners and from three it became 10 and then from one painting customer it it became five from $2,000 I think we 12 and then 16 and then I will never forget the first cut we hit in like 25k a year to me that what becoming like a serious amount right 25k is a serious amount but it give you the confidence to keep keep pushing like you know the only reason they pay because they get value so were you were

you selling them on the same use case as that first customer or did you have to like as you started talking to these additional customers the requirements just got like you had a long list of things that they wanted to solve or you know I'm I'm kind of curious about how how close were you with that first Cur customer versus what everybody else wanted the next you know nine or 10 yeah so it's a it's a delicate dance between what the customer want to what we think is best for overall customer base and what's aligned

with our vision and so that's where you know luckily I was experienced as a product manager so it wasn't new to me um it was new in terms of the pace it's much faster on a startup versus Google where I worked um but here you kind of lead the customer gently to your road map and to what makes sense to other customers and you try to understand if it makes sense for them as well because they might not they might not think about that angle that the other customers thought about to cross reference between the

feedback um and you try to get to the minimal common denominator of fishal request that customers want and then they ship it and see how they react and and on in terms of pricing like going from 2,000 a year to 25,000 a year that's great right you're you're kind of closer in the ballpark of where you want to be and selling these Enterprise type deals but how what were you doing with the pricing were you were you trying to like each sale you know incrementally kind of increase the price and test it or uh did

you just say okay the 2,000 thing was just the initial validation we're now going to charge everybody 25k like how did you get to that point of charging them that much generally speaking it it comes down to the kind of value the customer get because the first customer got certain value and then then the 10th customer got a whole different product whole different package so it only makes sense to increase the price uh but that's where a lot of Founders are really scared you know but I what I've learned in the US is that ship

is doesn't perceive as good it's the opposite when you charge more you kind of make a perception that your product is worth it it's expensive for a reason because it solve a meaningful problem that it's super hard to solve on your own or with scripts or with other product and I I I think it works um and and today 25 is for us you know it used to be insane back then but today again the product evolved so much which Char hundred of thousand if not a million but you got to be determined to to

to char that amount it it sounds like you know getting those initial customers and and and getting to that first million in AR was largely through outbound sales and with you being the the SDR on the team you told me earlier that it's like you know you you I mean you mentioned you hadn't done that before you didn't have a sales background but you've really enjoyed doing that role just can you can you walk us through like how how did you learn those skills what were some of the things that you think are most important

like you know if somebody's listening to this they're in a position where you know they're a founder and maybe they're in that position where they have to go out and start selling and they don't really know how to do that well or or you know maybe they don't even know what an SDR is right so what what advice would you give them or give yourself back then in terms of here's here's a good way to go about it and learning some of those skills that you need I think that for me specifically for a Founder

I'm not a self executive for me selling is having a conversation with a customer where he doesn't think I'm sending right I'm not talking about pricing let POV I'm not pushing for doing something to get none of that instead the opposite hey I'm not sending anything don't worry about it I have a sales team for that you know um and it get a job down because it kind of lower down the pressure like because this this this is what we call buying fatigue the market where they don't have time to talk to so many vendors

all the time but when somebody approach him and tell them hey I only need your feedback I only I I need to know to build it meanss a lot I can change the the industry they feel like they be kind of becoming part of History like I work with that vendor when they were so young I helped them shape the product it kind of it it bring them pride in in a way and and and to me the beauty in this story is you know it comes down to understanding people what people want people want

to to learn new things people want to feel like they're part of something bigger people want to uh stay on top of the latest technology specifically in our space and that's what I deliver them for them in the call give give me an example of that so I would talk with sales executive that you know maybe there were earlier in their career um and they wanted to know more vendors and more people and more VCS and more whatever and I would just tell them hey you know I would love to have you as part of

our journey to help us build the best product possible did you hear me saying I would like to sell you no right I would love to you know work with you on the product it's a different way than telling you hey it cost 24K and here the terms fine here it's different you know but it is selling for sure so one is that mindset in terms of what you're describing there just like hey I don't think of it as selling I think of this as having a conversation and and and I'm looking for feedback and

and I'm just trying to you know add some value for them as well I think that's a that's a great way to to think about it what what else did you have to do or learn to be able to cuz you You' got to you got to get that you got to find those people first you got to figure out what kind of message to send them and get their attention to they actually you need to get to the point where they'll actually listen to the first word or the first sentence right so how did

you learn to do that by failing a lot most of the messages you sent at the beginning they they don't work nobody reply so you change you change you do a lot of Abit until something works then you're like okay I got that and then the second thing is when you actually doing a call with them I failed many many time the pitch wasn't right they didn't understand me I didn't hit on the right problem I I might sometime I was too fast sometime I didn't care about them enough I didn't try to build a

relationship like there's a lot of moving pieces uh that I had to learn and it just takes time and consistency the more you do it the better you are at it um and and there's no magic formula every single founder has to find it for their own Journey right they're not two pites equal you know yeah yeah totally totally the other thing I think I want to try and understand is like with this with with a product like due control and uh the security space number one it's a pretty crowded market and I know when

you and I were chatting earlier you said hey you know getting really uh having a very specific problem that we're solving and being having super clear messaging is so important can you any help us understand like what was the process you you went through to get to a point where you felt happy that maybe you didn't have the perfect messaging but you were you had the messaging that that got people's attention like how how did you how did you get there I don't think you ever get there because the market is changing all the time

right uh it's up and down all the time when people are not buying they or they start buying and so I think the main thing you have to do is to really kind of suspect your messaging all the time and test it all the time in test it in different uh mediums you need to test it in your nural campaigns in your emails you need to test it in how you follow up with prospects via email in how you approach code calling via LinkedIn in how you interact with prospect on a call you take all

of that feedback from the different mediums and you just review it every once in a while every few weeks to nail down okay what worked and what didn't work um and and and and I feel like if you pay attention to details like body language don't voice tone on a call you understand when people really understand you and what people lose you you have to disting distinguish between the two um we reviewed a lot of recording of our calls you know we record our calls and we reviewed them after the call to again to investigate

and understand what works better we have a lot of metrics on all the emails open rate click through rate to understand what works better right same goes for the website and you always test it on the go a successful messaging can only be measured by how quickly customers are willing to talk to you right if they don't understand or they could might maybe don't understand the problem maybe don't understand how you solve the problem and and then they they're going to be hesitant they might not want to talk to you but if they're talking to

you they're going to call on a call and going to work with you it means that they understand right it doesn't have to be perfect it need to be understandable right right yeah I I I spoke to a Founder recently who who told me that they they really struggle with their messaging and they would spend they would get on a customer meeting so there was something they said that would get them in the meeting but then they were having to spend 80% of that time explaining what the product did right and then that's when you

know that there's a problem because you know it's like your customer should kind of have known that at a Bas at least a basic level before they get to the meeting not theity because those are different things the first goal is how do I lure them in for a meeting that one type of messaging the second thing is okay how do I get them excited within the meeting that's a different thing then when they become the customer they come to renew how do we what AI messaging do I use to help them renew those are

very different messaging Frameworks that you have to put in place right um I don't think that you know the fact they understand you what you do and come to a meeting right away means they're going to understand the prodct right away it's not those are two different things yeah yeah no that's fair point I I and I think that um the the same goes for like if you have a if you have messaging which gets people's attention and interest doesn't necessarily mean that's the messaging that gets you to close the sale it just got them

to click the link on the website or whatever right so You' so you've got you've got two problems here right as far as I can see but probably Lots maybe lots of other problems but the the two that I'm seeing here one is you've got to figure out that messaging and you've got to get the meeting with the customer and and you know persuade them that you know you can solve these problems that they have the second problem that you have is you are a startup in an industry with a lots of established incumbent players

who've been around for a long time who probably have more you know branded equity and and Trust because of the time they've been around so you've you've also got to persuade these people probably you know not that they're going to maybe not use you know some of those products in in place of yours yeah you got to be very careful there because if you going to talk trash on your on your competitors you know customers don't like that right it just sign sign of weakness in my opinion instead uh I would just talk about identify

what kind of Gap they have from their current Solution that's a very legit qualifying question it's one of the first questions actually what doesn't work for you why are you here on a call with me right and and then they tell you uh this doesn't work or this or that and you use that to establish your differentiation points a critical component of the messaging is how am I differentiated why me why is it better um is it do I have a faster product do I have a more reliable product is it easier to maintain is

it easier to roll out there are many many things you can say um and the faster you find those differentiation points especially from the larger uh vendors uh the better you are position in a call with a prospect uh because they smell that they smell whether you understand or don't understand in the space um and and when you have a very clear differentiation point it give the the prospect of confidence that you know what you're doing you here for a reason let's go test it out so you let's say you're talking to a prospect today

what what's what what's your differentiation point it's like they say you know I'm going to tell them that hey do control is event driven which means that whenever users perform any kind of activity on thatth application that thatth application push that event activity to to do control in near real time so that we can really monitor for us Behavior Uh with very low latency versus larger companies that pull those event every couple of hours and then you have blind spots that's just an example right another example is larger vendors they tend to scan your data

for pii PCI Phi like sensitive data right which is excellent but it's just one signal if somebody is sharing pii externally it could be totally legit but it it could also be very dangerous to distinguish between the two our differentiation point that we also connect to your HR software to understand the employment status if the person is leaving it's a higher risk situation we connect to Identity provider to understand what group the person is coming from whether or not it should be dealing with sensitive data we scan the actual data for for for for the

classification of course and we also reach out to the end user to ask for the input and that way you bring something fresh something new something they not haven't heard about get them excited get them to wanting to try it out you touch on the pain with a new technology that can solve a gap they acknowledge just Pro yeah yeah no I like that yeah I think I think it's sometimes we think that there's one differentiation point and the example you just gave is there can be multiple ways that you're you're you're different there have

to be multiple ways because again the more you grow the business the more you know differentiation point you have to find in order to really justify for larger deals with the larger customers and no I'm asking them to leave a very legit product behind and come to me so it's better worth for them yeah and um typically what what does your sales cycle look like like how long does it take for you to close these types of deals because you know this is this is like this is kind of one of those places where it's

like I heard this quote where somebody said to me or somebody said like hey if I do my job right like nobody cares but if I screw up I get fired or something right and it kind of hits me like that kind of the security space is a little bit like that where these people are are doing these jobs and trying to keep the organization safe and and if they're doing their jobs it's like nobody cares right but to make a big decision like this and Sh change something out and then to have to go

and get the decisions made internally and like you talked about like how to how to get the the funds and the budget and the authorization it sounds like it's it's not an overnight thing I think it used to be like that for security people but a little bit less today because today they they're really business enablers not just security the guardian uh of your you know Crown jeel today they really enable the business in a secure manner right I'm enabling you to use I don't know chat GPT but without the you know sensitive data exposed

to chpt but I'm enabling you to use that right I'm enabling you to collaborate via slack but whenever there is sens sensitive data involved I'm going to intervent uh gently to make things right but it's always about an enablement today it's different uh I think a little bit different um in going back to the question for sale cycle uh anywhere between um two three months to 6 to eight months depending on the company side we're working on fion 500 deal now takes forever uh but we close deals within the same quarter uh with smaller account

you know uh, 1500 people organization uh those are much easier to work with are you still doing sales today of course every single day you have to you really do love it I mean to me sales is people and I like people you know getting to know new people every single day you know laughing about thing laughing about the Cowboys losing again you know whatever it is it's fun but that's my job I have to support my Sal team because they bring me at the you know strategic EX itive to kind of provide FaceTime to

their customers to make them feel super important because the CEO is in the C it the dynamic right so I'm not like I'm not calling cold calling customers anymore because I have a great team doing that today but I am definitely uh handson helping them to shap the S Playbook uh making sure that you know product and sales are aligned on you know what our value proposition and how the RO look like so you really yeah it's it's funny it's like you you've kind of hadn't done any sales before and and now you've realized that

you actually really enjoy it and I think a lot of Founders maybe if they put the same mindset as you in terms of you know it's a it's an opportunity to connect with people and meet people and and just have conversations where you're learning and maybe you can help maybe you can't it's it kind of takes a lot of the stigma away about sales I think I think a Founder doing sales is very different from a sales person doing sales because a sales person by definition is measured by you know new money attainment quota whatever

a Founder is expected to fail at sales all the time like for sure like but your job is not to really do sales your job is to do what it takes for the sales team to do sales right to be there and understand the right context from the pect to ship the playbook for the sales team for them to do sale so very different from classic Fai guy uh maybe that's why I like [Laughter] it all right uh we should wrap up let's um going to go on to the lightning round I've got seven quick

fire questions for you what's one of the best pieces of business advice you've received one of the best business advises I received is that always hire people who are better than better than you in a certain domain always what book would you recommend to our audience and why uh 0 to one by Peter it's amazing what's one attribute or characteristic in your mind of a successful founder optimistic what's your favorite personal productivity tool or habit I'm the king of reminders so I don't need remember anything because I'm utilizing Gmail snooze slack reminders all of that

good stuff so every Monday 8: a.m. I have probably 30 or 40 different emails coming back to me to make sure I'm staying on top of everything love it king of reminders what's a new or crazy business idea you'd love to pursue if you had the time o I would love I just talk about it this week with our uh Chief of Staff I would love to build a product where you input question and answers representing your sales Playbook and that product will use generative AI to Output an amazing sales Playbook diagram a couple of

slides and then also take recordings that can autocorrect your Sal people against the question and answers provided earlier to me that's amazing there you go uh what's an interesting or fun fact about you that most people don't know I'm still a gamer I'm playing Counter Strike every every week I love it it like to meet my uh you know my meditation meditation and finally what's one of your most important Passions outside of your work other than gaming uh outside of work um you know I love my family I love my kids they're the the world

to me I love growing them I love laughing with them besides that I really love uh playing basketball skiing and playing poker poker love it cool Adam thank you so much for joining me it's been a pleasure chatting and uh unpacking the story of of do control if people want to check out the product they can go to do control. IO and if folks want to get in touch with you what's the best way for them to do that LinkedIn LinkedIn of course we'll include a link to your profile in the show notes so thanks

so much it's been a pleasure wish you and the team the the best of success thank you so much appreciate it cheers