Ben CTO of Obsidian Security

(Joel Beasley at 00:00:00) Today, we are talking to Ben Johnson, the CTO of Obsidian Security, and we discuss the Equifax and Target data breaches, the art of picking a cofounder, and how Ben sells the company's vision as the CTO. All of this right here, right now on the Modern CTO podcast.

(Ben Johnson at 00:00:20) Here we go.

(Joel Beasley at 00:00:21) This is the Modern CTO podcast. How you doing, man? It's early. Where are you at?

(Ben Johnson at 00:00:33) Yeah, it's great. We're in Southern California, Newport Beach, and it's 9:02.

(Joel Beasley at 00:00:39) I've been checking you out, reading your writing. Dude, you're brilliant. You write like a beast.

(Ben Johnson at 00:00:46) Well, thanks. I don't know if I'd go that far, but yeah, it's trying to produce a lot of content, get a lot of ideas out there, and hopefully get some good feedback.

(Joel Beasley at 00:00:54) I really like the branding. I like your writing and your style. Super knowledgeable. And honestly, I don't have that many security conversations, so I'm extra pumped about talking with you.

(Ben Johnson at 00:01:07) Awesome. Yeah, it sounds great.

(Joel Beasley at 00:01:09) I'm curious. The big breach that the average consumer knows, or at least that I'm aware of most recently, is the Equifax breach.

(Ben Johnson at 00:01:18) Yep.

(Joel Beasley at 00:01:19) Did you pay attention to that?

(Ben Johnson at 00:01:21) Yeah. I mean, you know, it's hard to keep up these days, but yeah, there's a lot of activity, a lot of writing, a lot of reporting around that. So yeah, I can talk to that if we want to get into it.

(Joel Beasley at 00:01:33) Yeah. Because I don't know what happened, but here's what I do know. I wrote some software for the largest law firm on Earth, and they're actually handling the lawsuit. And they're using the software, and the Equifax lawsuit is the first lawsuit that they're using it with. So I'm like, oh, sweet.

(Joel Beasley at 00:01:49) So I was just curious about—I was like, what are they going to be doing on there?

(Ben Johnson at 00:01:52) Yeah. Yep.

(Joel Beasley at 00:01:54) So what happened?

(Ben Johnson at 00:01:55) So really, you know, what happened is the open source project called Apache Struts had a vulnerability, and with most organizations, it's really hard to keep up with what you've deployed and what you're using either in software or hardware. And so they really just didn't get ahead of the patching cycle. And so this vulnerable piece of software was internet-facing. The attackers were able to get in. And there's lots of details, and probably this whole episode could be about it, and that might bore people.

(Ben Johnson at 00:02:28) But, you know, people, the adversaries got in, and then there were other instances where there were default admin passwords and things like that. And really, it was just kind of a mess internally in terms of once they got in, there wasn't a whole lot of that defense-in-depth type of methodology. Just a lot of outdated systems or systems that weren't functioning properly and that kind of thing from a security perspective. And then it's pretty quick to get to the databases. Right? And one thing we always talk about in the security community is anything that makes the lives easier of the IT team also makes the lives easier of the attackers.

(Ben Johnson at 00:03:08) Right? And if—you know, most people probably remember the Target breach from a few years back. But basically, what happened there is once the adversaries got in, they actually used the system management software, the system to push software to all the point-of-sale systems to actually push their malware to all the point-of-sale systems, which would then scrape memory for credit cards and then FTP it out. Right? So they actually didn't use a whole lot of sophisticated tools.

(Ben Johnson at 00:03:34) They just used your built-in tools for inventory, for software management, for that kind of thing. So yeah, anything that makes the IT team's lives easier also makes the attackers' lives easier.

(Joel Beasley at 00:03:45) So are you—what are you doing at Obsidian? Are you playing Batman and saving the world or—

(Ben Johnson at 00:03:51) I think some people think that. We're still pretty stealth, so I'll be a little bit vague here.

(Joel Beasley at 00:03:57) Oh, very cool.

(Ben Johnson at 00:03:58) We've been around since really just last spring. We went out and raised money from Greylock. So happy to talk about fundraising or any of that stuff. But really, we came together and we wanted to build another enterprise security product. So Glenn and Matt came from Cylance, which is an enterprise endpoint security company, you know, so they build essentially next-generation antivirus software.

(Ben Johnson at 00:04:22) I came from Carbon Black, which is also a next-generation antivirus provider. We were actually competitors. And we said, you know what? We focused on laptops and desktops and providing this protection to defend against malware and ransomware and things like that. We want to do something different.

(Ben Johnson at 00:04:40) So we're taking a little bit different look at how companies are using maybe some cloud-based systems, maybe still some on-premise systems, and ultimately trying to detect suspicious activity. Right? I mean, that's the key. Can we detect when bad things are happening either from an outsider or from an insider? And obviously, it's really hard when you see breaches in the headlines every week.

(Joel Beasley at 00:05:01) So is it safe to say that the goal of what you're doing at Obsidian is you're going to be detecting breaches, something like that around there?

(Ben Johnson at 00:05:09) Yeah. I mean, once you start getting into the details, I mean, there's a thousand—

(Joel Beasley at 00:05:13) Oh, I don't even know the details. So if I could just say, okay, Obsidian, they're going to detect—they're going to pay attention to what's happening in your network or your world, and they're going to be like, hey, bro, you've got an issue. Is that the gist of it?

(Ben Johnson at 00:05:28) Sure. Yeah. I mean, you know, ultimately, the teams need someone to say, hey, this looks bad. Go investigate.

(Joel Beasley at 00:05:33) Right. You're going to knock it out of the park. Look at this team. I'm looking at your team right now on your site. You guys got some talented, beautiful, amazing people.

(Ben Johnson at 00:05:42) Yeah. I mean, you know, I know it's been a topic on some of your podcasts around hiring and stuff, but yeah. I mean, we've really tried to find great teammates. And, you know, one of the really hard things that I tell people is when you start a company and you try to scale very quickly from the beginning, it's like a sports team that's an expansion team. Right?

(Ben Johnson at 00:06:02) It's not like you're coming into an established culture or established team and we're hiring for a very specific skill. It's basically we're bringing together all these players basically from free agency that have never played together before and trying to build a good team, and then while the game is going on, figure out if we need more of a particular skill set or whatever. So it's actually quite a challenge to try to figure out what we have to hire for. And so ultimately, we come back to versatility, the right mentality, you know, passion and are they really excited about this? Do they really want to work here?

(Ben Johnson at 00:06:36) Or are they just looking for a job, kind of thing? But yeah, I mean, we've been very fortunate and we're continuing to grow. We're hiring like crazy.

(Joel Beasley at 00:06:44) Yeah. I read your article about, you know, hire for passion, train for skill, coach for performance, and I was like, man, I'm going to get along with Ben.

(Ben Johnson at 00:06:54) Yeah. I mean, you know, it's all about that. Right? And I mean, those are very subjective measures. So it is a little bit vague when we talk about that, and we are thinking about ways of doing a more objective test for coding or for other things.

(Ben Johnson at 00:07:10) But a lot of times it's, you know, is this person going to be great to work with? Are they going to fit into the team? Are they going to roll up their sleeves when they need to or step back when they need to? Have they shown capacity before? Right?

(Ben Johnson at 00:07:20) Have they shown that they can do very interesting things? Even if it's in a different programming language or using different technologies, it's still not easy. Right? I mean, it's a lot of kind of gut going in terms of the hiring process. But yeah, it's all about finding the good people.

(Ben Johnson at 00:07:35) Right? If we find great people, then we should have no problem.

(Joel Beasley at 00:07:39) And then you fire quickly. Right?

(Ben Johnson at 00:07:41) Yeah.

(Joel Beasley at 00:07:41) Yeah. Yeah. Good. I used to be shy at the very beginning of my career with letting people go, because you know, within the first week or two. You know.

(Joel Beasley at 00:07:51) And then you just wait seven months to fire them.

(Ben Johnson at 00:07:54) Yeah. I mean, we've been really lucky here, but your point is valid. People need to adopt the right mindset, and we hired people so quickly that we didn't even have requirements. Right? We're still trying to figure out exactly what product-market fit is and what our feature set is and things like that, even to this day.

(Ben Johnson at 00:08:13) Right? And because we're early and we're building an enterprise product, which means just a lot of discovery and exploration. And so, you know, we can start building different components and writing different code and things like that, but ultimately, people need to know that, hey, we might adjust course a little bit. We're not going to completely shift over and do a consumer product or something, but we need a little bit of vagueness still because we don't want to build something that isn't the right thing.

(Joel Beasley at 00:08:39) Do you know Elias Torres? Do you know him? He's the CTO over at Drift?

(Ben Johnson at 00:08:43) No, I don't.

(Joel Beasley at 00:08:45) So he was in charge and ran with HubSpot and grew their engineering, and then him and his partner went over and started Drift. They're, I think, Intercom's biggest competitor. Really smart. So I was hanging out with him last night at a talk in Tampa, and he was talking about exactly—you guys have the same views on building great teams. And when I was hearing that and then when I was reading your content, I was like, oh, these guys would be friends.

(Ben Johnson at 00:09:10) Yeah. Yeah. I mean, you know, a lot of this stems from the intelligence community. So I spent a lot of time in the intelligence community, and that just led to tons of growth because you couldn't Google—you couldn't search for some of the things that you're working on. And even if you could, there would be zero hits.

(Ben Johnson at 00:09:27) Right? And so you had to learn how to adapt and how to be versatile and sort of investigate and be creative. But along those lines, we built a team from basically zero to 140 people. One of the best teams, in my humble, biased opinion though,

(Ben Johnson at 00:09:44) in the intelligence community, to about 140 people, almost exclusively through referrals. So we were referring people that we knew would thrive in the environment, and we were putting our necks out. Right? We were saying, look, I'm referring someone, and if they don't do a good job, it's going to look bad on me. So, you know, I thought that built a really good team, and then we tried to do that at Carbon Black as well, which is refer as much as we could, because it's so much better to know what someone's going to be like when you've worked with them for a year or multiple years versus a few hours in an interview.

(Ben Johnson at 00:10:15) Right? So we're still trying to adopt that mindset of, hey, can we refer people and continue to grow the team this way?

(Joel Beasley at 00:10:22) So how much interaction did you have with the—you're a cofounder there. Correct?

(Ben Johnson at 00:10:27) Yep.

(Joel Beasley at 00:10:27) And you said you cofounded it with a previous competitor. Right?

(Ben Johnson at 00:10:31) Yep.

(Joel Beasley at 00:10:31) So how much relationship building interaction did you guys have before deciding to do this? Were you friends at conferences? How did this all—how did it go down?

(Ben Johnson at 00:10:40) Yeah. So there was a lot of serendipity, but yeah. So we had actually discussed partnering several years ago. I think it was 2012 or 2013, because our products weren't really competitive yet. And so we actually spent a decent amount of time getting to know each other, hanging out, jumping on some calls, meeting in person, and we really had a good rapport.

(Ben Johnson at 00:11:00) And then we just happened to start to compete, and so that kind of died, but we stayed in touch. Right? And security, like a lot of different fields, but security has a ton of conferences, and so we would run into each other and still grab a beer or hang out, have a good discussion. And even though there's competition, you know, there's a lot of respect. I think at the end of the day we all know who the actual kind of bad guy is.

(Ben Johnson at 00:11:22) Right? Even if you have competition, especially in security, there's an actual adversary trying to do your customers harm. Right? And we're basically cyber weapons suppliers or defense suppliers. So

(Ben Johnson at 00:11:34) you know, there's still that notion of there's an actual criminal syndicate or foreign intelligence service or whatever trying to do harm. And so you still can rally together even if you're trying to win market share. So anyway, long story short, I decided to explore and go do something different, and I called a buddy, and he happened to be sitting next to Glenn having coffee with him, and Glenn was thinking about leaving at the same time. And so from there, we said, oh, man, let's do something.

(Ben Johnson at 00:12:03) And I was looking to move somewhere warmer. I was living in Chicago, and, you know, loved it, but me and my family were just like, let's go somewhere warmer. Glenn was in Newport Beach, can't get much nicer than here. It was 84 degrees this weekend. And so, you know, it all just sort of continued on from there, but the whole point was that long-term maintenance of a relationship and maintaining the relationship, and then you never know where it's going to lead.

(Ben Johnson at 00:12:26) And in this case, it led to something cool.

(Joel Beasley at 00:12:28) Do you have a big family?

(Ben Johnson at 00:12:30) I got three boys, three kids, and an awesome wife.

(Joel Beasley at 00:12:34) Yeah. I have an awesome wife too, and a little girl, but keep your boys away from my girl. Or how old are they?

(Ben Johnson at 00:12:43) Seven, five, and two.

(Joel Beasley at 00:12:44) Oh, okay. Mine's only four months.

(Ben Johnson at 00:12:46) Oh, no.

(Joel Beasley at 00:12:47) I just got into the game.

(Ben Johnson at 00:12:49) Yeah. It's just wait till they start getting mobile and chasing after them and stuff. But it's a blast.

(Joel Beasley at 00:12:55) Yes. Two days ago, the first time that—my wife's holding her, we're standing in the kitchen, and she reached both her hands out to me for me to hold her for the first time. And I'm like, oh my god, this is the best thing in the world. Yeah. So I just like to talk about it a little bit.

(Ben Johnson at 00:13:12) No, it's great. It kind of adds motivation at work too, because you kind of—you can think about what are you doing this for. Right?

(Joel Beasley at 00:13:18) I have never been more motivated in my business pursuits than when I wake up and I see that smile and I'm like, I'm going out into the world and I'm attacking the world today for that little monkey. You know? Yeah. For those little smiles. And was it hard to convince the family to move, or were they like, nope, we want the warmth. Let's go.

(Ben Johnson at 00:13:36) Yeah. Well, it wasn't really hard. You know, I was like, hey, do you need to come visit before I commit to this? And she's like, nope. I know the weather. It looks great. You know, it's like anything, it's an adjustment, you know, cross-country move and a new house and all that stuff. But overall, it's been great. I mean, you know, we were in the pool on Thanksgiving Day.

(Ben Johnson at 00:13:55) Right? It's just a different world.

(Joel Beasley at 00:13:57) Well, I live in Florida, Sarasota, Florida. So we have one of the top beaches in the world, which once we got listed as that, kind of ruined it because now it's tourist central. But so I'm very familiar with 80-degree Christmases and basically no winter.

(Ben Johnson at 00:14:13) Yep. Yep.

(Joel Beasley at 00:14:14) So are your boys showing—my dad would take me to work with him, and that's how I got into programming when I was eight-ish. And are your boys showing any interest in what you're doing?

(Ben Johnson at 00:14:24) Yeah. Absolutely. So actually, at their elementary school, they're doing a whole bunch of, you know, sort of like maker space and some code and some robotics. So just through that, they're starting to get exposure. We've also done some coding at home. You know, it's kind of cool. It's like blocks and stuff where you start to learn about for loops and other things. I've also just been—aside from the programming and the technical side, I've just been a huge entrepreneurship fan, and I was even teaching entrepreneurship for a couple years. So my oldest started doing pitches where he would get up and he would whiteboard and say, "Hey, this is my idea" and stuff. So I'm hoping that we can continue to cultivate that. But yeah, it's been great and they enjoy it. And honestly, the last few years before Obsidian, I was really traveling the world, so they didn't really get to experience as much. Whereas here, they can come to the office and I'm around a lot more. So, you know, I think they're starting to understand a little bit more around Obsidian. And strangely enough, me and Glenn and Matt, the three co-founders, we all live in the same neighborhood, so they might even see Glenn or Matt or see their children just out at the park or stuff like that.

(Joel Beasley at 00:15:29) I still, to this day, remember running around my dad's office, getting my static electricity up with my socks, and then going and shocking my siblings and stuff. And then the smell of electronics. Oh. Because they were doing, you know, physical devices. And so you'd smell the solder, and it would be—just, like, to this day, when I smell solder and baked electronics, I'm like, "Yeah. That's awesome." They were retrofitting—they invented this thing that went inside golf carts that mapped the golf course. And there were these screens. And this was in the mid to late nineties. Right? So having a TFT screen like that was a big deal and such a small form factor. And they would have to ship them into different countries and ship them across the United States. And there were heat problems. So my dad was one of the original—I think he was the fourth hire of what was a 300-person public company. So I remember him and the people, they would be baking the units that would go inside these golf carts, baking them in the oven in the house, like, in the garage. And just the smell of baked electronics. Because they were having issues when they would ship them away. They would be melting and malfunctioning because they were overheating. So then they had to start heat testing them. And so, like, growing up, that's a strong memory.

(Joel Beasley at 00:16:37) You buy them any of the Raspberry Pi, Arduinos, anything like that?

(Ben Johnson at 00:16:42) Not yet. I mean, you know, we actually got—I forget the name of it, but I think it was—I don't know if it was Wozniak or one of the sort of giants in the valley. There's these computer kits where you kind of build a computer from scratch. You know, they give you a bunch of components—a battery and a bunch of wires and chips and stuff, even the case. So we started doing some of that stuff, and we'll get into it more. But, you know, a lot of it's around trying to keep them active and not just asking for games on the iPad or something. Right? So you want to encourage some types of screen time, but a lot of it's a challenge too because, you know, there's a lot of screen time these days.

(Joel Beasley at 00:17:18) I'm taking notes, Ben, because she's only at four months. So I've got a lot coming up. I'm taking Ben notes, Ben parenting notes. All right. That's just a segment for me. Right? That's something I need. We actually had this guy on the show named Mike Anderson. He does embedded systems, and he puts satellites into space, and they're crazy. Have you heard of that guy?

(Ben Johnson at 00:17:38) His name sounds familiar, but it also sounds like maybe it's a common name, so I'm not sure.

(Joel Beasley at 00:17:42) Doesn't it? Doesn't it? You know what made me interested? I didn't even tell him this on the show. But what made me interested when I saw his name come up is I used to use that as my prefill form, like, in my earlier web apps, like, the fake data that would go into the form, for my test. And, like, for some reason, I just always picked the name Mike Anderson. I don't know if it was in the library of seed data or whatever. But when I saw Mike Anderson, I'm like, "Yes." And then I looked up who he was and I'm like, "They're doing this thing right now, Ben, where they're designing the first mid-orbit satellite refueling thing that's never been done before."

(Ben Johnson at 00:18:16) Oh, wow.

(Joel Beasley at 00:18:17) And so we were talking to him about how they—because he is at NASA's launch pad. He's the guy. You know what I'm saying? Yeah. And so we were talking about how they do it. They do a digital model, like, 3D rendering, you know, simulations of actually doing the refueling before, because you only get one shot. And it's multiple millions of dollars for this one shot to do it right, you know? And they do the digital models, then they do a small-scale model that's physical, and then they actually go to NASA's hangar, and they have a physical replica of the full-size model to execute all the coordination that has to happen in this satellite refueling process. He goes, "You're off by, like, a seventh of a degree, and you've got space debris, and you're violating international treaties. And then you lose millions of dollars." I'm like, "Whoa." That call is coming out in the next week or so, but, man, that's a high-energy call.

(Ben Johnson at 00:19:14) Yeah. And, you know, I mean, that all sounds amazing. It also makes me appreciate building software. It's so much easier to test. Right? It's still got its challenges, but I'm not worried about explosions in space.

(Joel Beasley at 00:19:25) Right? Like, when he was saying that, I'm like, "Oh, man. I get—I freak out when I get a downtime notice from CloudFront for ten minutes or something, or I get upset at Netflix not being able to stream for a second." And then this guy's putting stuff into space on the first try doing crazy things.

(Ben Johnson at 00:19:41) So, yep.

(Joel Beasley at 00:19:43) I was listening last night to Elias, and he was talking about the startup and how they're growing from 200 people to 110 over at Drift. And one of the topics he brought up that was important to him and that was unique to me, he said the concept of a lot of the CTO founders of SaaS products—they think that they don't need salespeople, that they just need to build a great product and things will come. And so he was talking—part of his talk was this thing called the "no salespeople myth." And he was showing us all these SaaS products and all these products where you would think that there's no salespeople, and they have these massive sales organizations behind them. What do you think about that?

(Ben Johnson at 00:20:21) I think that's the dream—is very cheap spending, or very, let's say, economical spending on the go-to-market side so that you continue to fund innovation and engineering. But in reality, especially if you're focused on enterprise, there's a lot of face-to-face. Right? And so I think the challenge is how do you build out a sales team? How do you leverage or utilize the efficiencies of SaaS and maybe the easier deployment? Basically, no shipping hardware to the customer or things like that, but still have enough of a field presence or enough of a sales team and marketing team to get those deals and to show enough customer support to make your customers really understand that you are there for them. Right? And so, you know, one of the things that I did in the last three years, I was essentially the field-facing CTO at Carbon Black. I did 500,000 miles, you know, all over the world, and it was basically because of that face-to-face necessity. Right? You need to be able to talk to the customer, make them understand that you're there for them. And even if it's a SaaS product, especially if you're selling enterprise, I mean, these deals are often six figures, maybe even seven figures. Right? And so there's just a lot of process that goes with it. And I think the dream is you just put up a website and people sign in and put their credit card or whatever. But in reality, again, it's helping them through a nice proof-of-concept or proof-of-value phase and just understanding how it's going to really integrate with some of their existing systems. So, yeah, I think it is a myth that you have no salespeople. But I also think that a lot of the—especially in security, a lot of the spending has been, "Hey, let's just hire as many salespeople as possible and flood the market and try to do a massive land grab." And it just gets so expensive. Right? And it's just so hard to have all these people trying to sell all these products, and really there's only a finite budget that they're all competing for and they're all expensive and stuff. So, yeah, somewhere in the middle. Right? You need some sales support. Balance. Yeah.

(Joel Beasley at 00:22:28) I'm just hoping that—I know right now what the composition of our audience is, and I know that there's a co-founder, developer, CTO person right now. It's just him and his partner, or her and her partner. And what they're doing is they're building this app and they want to go get funding or whatever it is. And because I get these emails from them. Right? And so one of the conversations I wanted to recurringly bring up is, like, if you aren't the salesy person in the mix of the co-founder relationship, get a third co-founder that's the salesy person. Like, don't be just the engineers that can't be client-facing. Get out there into the world and develop in-person relationships because that's what drives the business.

(Ben Johnson at 00:23:09) Yeah. I mean, I couldn't agree more. You know, as a co-founder or founder, or just very early-stage employee, you're often looked at to help sell the vision of the company. Right? Especially if you don't have a brand that people know yet, they want to talk to the founder or they want to talk to the CEO or the CTO. And you're going to have to be outgoing. Even if you have to fake it, you're going to have to be outgoing. You're going to have to pitch your vision, but you're also selling all the time. You're not just selling to the customer, you're trying to recruit talent and you have to sell them on the vision. You have to keep people happy. Right? So there's a lot to it that forces you to be more outgoing. And I agree, like, if that's just really not you, you need to bring in another person. But if that person isn't really there from the beginning, they're not going to sell the vision as well as the people that ruminated and sat there and thought about it and sort of, you know, kind of earned, as we say, earned their scars early on and learned those lessons from early customer discussions. So you really need to be able to have those lessons learned or that passion that comes through you when you're talking to those first five or ten customers. And a lot of the listeners might know this, but the first five or ten customers, especially in the enterprise side—you know, consumer is a little bit different—those are all going to be closed by the CEO or the CTO. Right? So you're probably not even going to have a salesperson at that time. So you're going to have to go out and say, "Hey, I know we're really early, but take a shot with us." Right? So, yeah, to your point, 100% agree, you have to be comfortable speaking and selling the vision.

(Joel Beasley at 00:24:41) Oh, yeah. So now I'm really curious. So you're in stealth mode right now building the most amazing thing. Right? And you say and do all the right things. So I really—you have this very obvious value to me right now. I can't wait for this question. You're in stealth mode. How are you—what are you looking at when you're going to be bringing on a sales team? Like, how do you know that's right? What are you paying attention to? Like, what's your thought process of how do you go from stealth mode to not stealth mode?

(Ben Johnson at 00:25:13) Yeah. So great question. So a lot of it's around finding the people that are still going to thrive without enough resources. Right? So even when we are more public with what we're doing and we're actually hiring full-time salespeople, there's always going to be too much work to do. And we're not going to have all the support structure and, you know, people helping out and doing all these different things. Right? Because especially on the enterprise side, once you build up a sales team, you sort of slice it up in different ways and different sizes, and you have people helping on channel and partnerships and stuff. So early people need to come in and really have that grit or that hunger and be like, "You know what? I can do whatever. I can roll up my sleeves and be very tactical. I can think more strategically. I can work those relationships. I can understand the product. I can help sell the vision." So a lot of it's around finding a few people that we think can really help us get some early good customers, and they're going to come in with relationships, but more importantly, they're going to come in willing to not just have a script. Right? Like, we're not at a stage where we're going to hand new salespeople the script and say, "This is how you pitch us and these are all the answers to the questions." They have to be a lot more versatile, kind of like our early engineers. Right? So it's more around getting just a few people and starting to slow-roll it a little bit because even when you come out of stealth, you don't fully know your go-to-market side. Right? Like, maybe your product is a little bit more solidified, but your go-to-market side is still going to be very iterative. So I think, you know, I know I'm overusing the word, but I think that term, you know, versatility or being able to adapt, certainly being hungry, not coming in expecting they're going to have a huge team or something like that—that's what we're going to look for. And then combine that with, "Hey, you're still probably going to be partnered up with myself or Glenn or some of the other early employees because we're still going to have to help sell the vision." We're still not going to have the trust yet because we're so early. Right? Even if we have a good historical track record, we still need to build up that trust in our brand and get those reference customers and that kind of thing. So a lot of it's around, "Hey, who do we think is going to really work very hard and be adaptable and just kind of go all out to make us successful?"

(Joel Beasley at 00:27:34) You know what? This is something that I'm noticing coming up a lot because what you said really triggered something. It's not just like we have salespeople, we give them a script. We have to have people that understand the struggle. Like, the struggle is real.

(Joel Beasley at 00:27:47) Right? They understand what the problems are. They feel them. They understand the solution. They're proud to be a part of the company that's creating the change, and then they are genuinely passionate about the fact that they're working towards the production of this solution.

(Joel Beasley at 00:28:03) Right? And so often, people will look at it exactly how you said at the beginning as, oh, let's just get a sales script, let's get a funnel, and let's grab a bunch of people, and let's just pound the phone and let's just drive the pipeline. And I'm seeing that this other thing is coming up. I think this is going to be talked about a lot more. I don't hear a lot of people talking about this in their writing or in their books or in their talks, but I hear a lot of people talking about it right now when I'm talking to you.

(Ben Johnson at 00:28:31) Yeah. And it's that entrepreneurial spirit more from the sales and marketing side than the engineering side and, you know, how can we approach the problem of providing our value to people that need it and try different things and not try so many things that we burn tons of cash, but being able to adjust and move forward as necessary. So, yeah, I mean, I agree. I think it's actually an interesting topic. I don't think a lot of people know.

(Ben Johnson at 00:28:59) And to something I said earlier, I don't think, especially on the technical side, that computer science students or first-time entrepreneurs understand how much you have to learn how to sell. And you have to learn how to sell in the sense that, like I said before, you have to sell your vision or you have to sell people on your preferred way of building something or actually selling product, right, or selling different ideas. So this notion of selling, everyone thinks about as money, but it's really around how do you get people behind you? How do you convince people that this is the way forward? And whether that's with buying your product or joining your team or whatever.

(Ben Johnson at 00:29:37) So I think continuing to expose that as a topic that maybe needs more conversation and writing is a great thing. And hopefully, through your podcast, that's one of those ways we can do that.

(Joel Beasley at 00:29:50) Absolutely. Communicating value is just, it's critical to every part of your life, whether it's business or your relationships. I mean, everything's. You know what's interesting? So I'm only 30, right?

(Joel Beasley at 00:29:59) But I feel like a lot of my mind has been changing and maybe also having the kid, but I'm starting to see things differently. And one of the things that started to blend is this concept of value. It's been really hitting me hard lately where it's almost like energy in a very physics sense where you have it and then it needs to be transferred. Right? So currency is one way to transfer the value. It's like I provide you value and then we can figure out how to translate that to currency. And sometimes companies do deals where they exchange value and there's no currency involved. Right? But there's a lot of value involved. And so, and then I'm just taking that same concept, and I'm seeing apply it with my relationships of any type of relationship, whether it's business or my personal. And it's just this whole thing just came up to me about value in life over the past year, and it's just, I find it fascinating.

(Ben Johnson at 00:30:52) Yeah. I mean, you know, I think to put it slightly different way, and I completely agree. A lot of times we look at a transaction as the result or as the goal. And so whether that's fundraising or selling product, but really that's when the work starts. So for example, you raise a bunch of money, you get your seed, Series A, Series B, whatever, that's actually when the work starts or that's when the work accelerates.

(Ben Johnson at 00:31:15) Right? And so, yeah, we have these pictures of entrepreneurs pitching and getting beaten up and going into shark tanks and things like that and thinking how hard that is. But, really, that's, once the check hits, that's when the real work begins. And similarly, when we're selling product or to your point, providing value to a customer, once you get them to buy your product, that's really when their work starts. Right?

(Ben Johnson at 00:31:37) They have to use the product. They have to train on it. They have to give it care and feeding, whatever it is. And so a lot of times I see entrepreneurs or salespeople forget that there's so many different aspects of value or of friction on the flip side. Right?

(Ben Johnson at 00:31:53) So all the meetings, all the time, all the emails, all of that costs something. Right? Maybe you can't put a dollar amount on it, but it all costs something. So I think just having a better understanding of value and cost would help us all out.

(Joel Beasley at 00:32:06) I see that you had some of your work published in some different magazines, like SC Magazine.

(Ben Johnson at 00:32:11) Yep.

(Joel Beasley at 00:32:11) How does that, so how does that go about? Do they contact you? Do you contact them? How do you get your articles in magazines?

(Ben Johnson at 00:32:19) A lot of it's, so it's a combination as you might expect. So a lot of it's networking and getting to know people as your personal brand or your company brand starts to improve, your friction around convincing people to accept your articles goes down. You might even be solicited to write something. A lot of times, you might have a PR firm help you push out your content or other marketing individuals push out your content. So it truly is a team effort, but a lot of it is writing something that's interesting and something that the editors think people want to hear about.

(Ben Johnson at 00:32:52) Right? So, you know, I encourage anyone that's trying to get articles on, especially online, it's pretty low friction, right, at least to write up something and send it to people. But put some effort into it and if you have interesting ideas, you know, these sites are always looking for contributors, even places like TechCrunch or some of the more popular general tech sites. They're always looking for contributions. So, you know, take a shot. Write something that's interesting that you think really would help other technologists, entrepreneurs, security people, whatever. And then, you know, start pushing that out and getting that rhythm of, you know what, I'm going to get better as a writer by writing every week or recording a video cast or podcast or whatever.

(Joel Beasley at 00:33:32) I have a book, and when I was going through this whole process my very first time, and I really, one of the things that I kept in front of my focus at all times was I don't want to cover topics that are very well covered everywhere else. I want to, I need to pay attention to the things that are happening, but that people aren't really talking about and then talk about those rather than just regurgitate the same thing over and over and over.

(Ben Johnson at 00:33:56) Yep. Yeah. I mean, it's, you know, I, so I used to host these dinners. I would fly all around the country and they were great. I would go in. I would say, look. We actually called them No Sales, Just Security. And it was me and 10 to 15, it could be chief security officers, directors of security, CIOs, whatever. And we would just start the discussion with, hey, what's working? Let's share what's working.

(Ben Johnson at 00:34:18) Right? And it was very open discussion, but out of that, people would learn so much because it's just sharing what's working or what's not is great and we don't do that enough and that doesn't have to be security. It could be in how you hire, how you build, what kinds of programming languages are you having success with, whatever it is. There's so much information to share and people are craving ways to accelerate their own career or their own company or whatever. And if they can take your lessons learned that took you maybe months and they read it for an hour and it accelerated them, you know, months ahead or at least gave them that understanding, I mean, everyone wants that.

(Ben Johnson at 00:34:54) So we've got to just continue to share and collectively work together, and it just helps us all out.

(Joel Beasley at 00:35:00) Well, it also means so much more. I could sit here and take team leadership advice from a figure like a Gary Vee or whatever business figure you would want. But if I'm in security and, man, Ben Johnson's going to talk about putting together a team, it's just, there's, you're going to put those little tidbits in there that are specifically related to your industry and it's just going to mean so much more.

(Ben Johnson at 00:35:23) Yeah. And just being open and honest. Right? You know, you go in and you have a discussion with a team, especially if you're a vendor. You're always going to be looked at a little bit with, hey, is this guy selling me? Is he really telling me the truth or just trying to get me to buy his product?

(Ben Johnson at 00:35:36) So if you really try to break through that and just have some honest discussions and say, look, I'm not even here to talk about my product or, you know, I'm very willing to tell you when you mentioned something that we don't do well or whatever, it just creates those bonds. And then, you know, spending time keeping up those relationships and networking and spending a little bit of extra time after the conference to hang out with people and get to know them and hear their problems. I mean, that's where all this comes from, and you just, you get so much personal growth through that.

(Joel Beasley at 00:36:03) That's what happened with the podcast. When I was writing the book, I was engaging all these CTOs, and I'm like, alright. Well, we have the book done, but I didn't want the conversations to stop. I'm like, alright. So now we need to find an excuse to keep these conversations going. Let's do the podcast. And I found that just talking to smart technology people about interesting things is what I'm doing with my life. We don't make money on the podcast. We don't have advertisers. We intentionally won't ever have advertisers because I just don't want to.

(Joel Beasley at 00:36:30) I kind of want it always to be a value space where we kind of bring up the next generation of CTOs and then share with each other. But that's, I kind of, I just, advertisers ruin everything, and I want to kind of keep this a clean space. You know?

(Ben Johnson at 00:36:45) Yeah. I love it. Yeah.

(Joel Beasley at 00:36:47) So, IoT security. I've been watching this crazy video of these guys stealing some Tesla-type car by tricking the key fob and somehow cloning it, and then it was very interesting. Are we going to experience a cybercrime wave in the next 10 years as things become more widely available, cheaper and, or is the security teams so far ahead that we're not?

(Ben Johnson at 00:37:17) You know, the tough thing, one of the tough things about security is telling people reality and not sounding like you're trying to sell something through FUD, right, through fear. Because reality, reality is scary in terms of cybersecurity. Things in some ways are getting a little bit better and in a lot of ways are not. Right? And the adversaries, the cyber criminals or the nation states and their intelligence community efforts, they're having so much success that it just breeds, it's like a market.

(Ben Johnson at 00:37:47) Like, when you see people having success, other competitors jump into that and this just happens to be success in stealing records or Bitcoin or whatever. Right? And so it's certainly not going away. You mentioned IoT, the challenge with Internet of Things or these embedded devices is that a lot of them are too small to really put security software on and the manufacturers, it's really a race to the bottom in terms of cost. Right? Like, they want to sell something that's super cheap as a little sensor, a little camera, whatever.

(Ben Johnson at 00:38:17) And so if they have to spend extra time engineering better security controls or just having better security protection built in, that raises their manufacturing costs. Right? And so it's a huge challenge. And then the other thing is if there is a security flaw and the vendor puts out a patch, it might be really hard to go patch your little sensors and thermostats and stuff. So, unfortunately, when you start talking about IoT, that's an area that needs a lot more security help and I don't know if you remember, but there was a big botnet that took control of, I don't remember the final numbers, but I think it was something like a million surveillance cameras, video cameras and then it was DDoSing DNS and it took down AWS, it took down Netflix, I think Twitter, right?

(Ben Johnson at 00:39:02) And this was just because people wrote scripts that found all these cameras and stuff, exploited those and then had those all hit a DNS provider and then it basically took out the whole East Coast. So we're going to continue to see things like that and as devices become more critical to human life like hospitals and cars and stuff, the government's going to have to add some regulation, but also the manufacturers are really going to have to take it serious because we can't afford not to.

(Joel Beasley at 00:39:29) Here's what I see happening. I actually, I feel like I see this actually happening right now. Technology is moving so fast. Everybody wants to make so much money. VCs, private equities, just shelling out cash to everybody.

(Joel Beasley at 00:39:42) IoT is hot. Everything's hot. Hot. Hot. Hot. Hot. And what you're going to get is you're going to get a bottleneck in the experience and the quality of people, and you're going to end up hiring less quality people to push product faster. And then you and I know software development, my friend. Corners will get cut with less quality people who won't push back, who just want the job. They'll write the code and cut the corners, and then you'll, what you'll end up with is Swiss cheese in the world of these holes that are everywhere.

(Ben Johnson at 00:40:12) Yeah. And it's, and kind of to your point, it's not even necessarily that there's security vulnerabilities. There could just be bugs because of that race. And the bugs themselves could take down very important systems and things. So, yeah.

(Ben Johnson at 00:40:25) I mean, it's definitely an interesting space and as you said, a lot of investments funneling into that. So, you know, we have to keep an eye on it, but also, you know, there isn't enough talent. And so how do we make sure, especially these critical systems, are being engineered in the right way and stuff? And so, I don't know. That's going to be up for debate, I think, a lot over the next several years.

(Joel Beasley at 00:40:45) All in all, I think now is a great time to start a security company. It's definitely going to, if I would, I mean, it's obvious to me that the need's only going to grow exponentially over the next five years, decade. It's not a future thing. It's a, you had to get started 10 months ago to really be in on this next wave of security that's going to happen.

(Ben Johnson at 00:41:09) Yeah. I mean, it's, you know, the whole digital transformation. Even these 100-year-old conservative financial institutions that took a long time to kind of modernize are now all of a sudden jumping into the cloud. You talked about the IoT. You talked about users. There's no real firewall or perimeter anymore at enterprises or at companies.

(Ben Johnson at 00:41:27) So, yeah, I mean, it's a tough challenge. It's really hard for security teams that have a pretty stable surface area to defend that. And then when you start thinking, my whole surface area is elastic and it's, you know, one click and I copy all this data to a public S3 bucket or whatever, it's just really hard to defend all that. And on that point, there's a huge talent shortage in security, even worse than in programming or something like that.

(Joel Beasley at 00:41:53) That's what I'm saying. Yeah.

(Ben Johnson at 00:41:55) Yeah. And so it's tough. How do you defend all this new surface area without butts in seats as we might say. Right? So that's going to continue to be a challenge as well.

(Joel Beasley at 00:42:05) I was reading this guy. He's a pretty smart security guy, reading his article about how he deals with struggles he's having with staffing and security seats. And you might know his name's Ben Johnson. He was writing about this recently. All right.

(Joel Beasley at 00:42:18) So I want to know, let's hypothetical situation here, Ben. Elon Musk texts you. He's like, "Oh, I need to ski on my Tesla." And no. But he texts you.

(Joel Beasley at 00:42:28) You come over, and he's got a time machine. You're going to get to go back ten years and give yourself a piece of advice. What are you going to tell ten-year-ago Ben?

(Ben Johnson at 00:42:38) Wow. Starting with the easy questions, aren't you?

(Joel Beasley at 00:42:41) All right. Starting with the easy questions. Yeah.

(Ben Johnson at 00:42:44) You know, I think, wow.

(Joel Beasley at 00:42:49) It's okay.

(Ben Johnson at 00:42:50) It's so iterative. Learning is so iterative. It's hard to figure out what I would—I think the whole, hey, entrepreneurship is so much fun and there's going to be so many opportunities and just, you know, continue to learn. But I think overall, to an earlier point, and maybe this is a cop-out, the earlier you can start to learn how to network and how to sell and some of the business side, especially if you came with a computer science background, even if you go to a large company, it's going to help. And so I think I would tell myself that.

(Ben Johnson at 00:43:26) I think also just, you know, one thing I like to tell students when I've gone back and talked to graduating students or whatever is we put so much pressure on ourselves in the first job out of college. Like, "Oh my god, this matters so much where I go," and really it doesn't. You're going to—what do we say these days? If you've been at a company for four or five years, you start to feel stale. That's sort of a trend right now.

(Ben Johnson at 00:43:51) And so you're going to work for maybe 10 different companies over, you know, thirty or forty years, maybe even more. And yeah, you want to set yourself on a positive, you know, good trajectory for your career, but it's very iterative and you can always go back and learn. You can always pivot. So I'm not sure that I have any huge regrets or anything I would go back and tell myself, but I would just reinforce that, you know, each move, make a smart move, but anything can be changed. You can always pivot. You can always switch and iterate.

(Ben Johnson at 00:44:22) So I'm not sure I gave you a nice crisp answer, but I would just go back and reinforce that.

(Joel Beasley at 00:44:28) No. I really like your pay attention to the business side of things earlier because, you know, I can imagine my 13-year-old self sitting, you know, writing code and not going out and being social because I enjoyed the code so much and not doing stuff. And then in hindsight realizing, "Oh man, I could have spent that time developing some social skills rather than developing them in my mid-twenties." Right? I could have built relationships with people that I've known for ten years by the time I'm 21.

(Joel Beasley at 00:44:57) Right? But I didn't do that. I had one friend and I wrote code all the time. So I had to kind of really learn that you have to go out and meet people. Technology is there to serve people at the end of the day.

(Joel Beasley at 00:45:11) And so it's all about people.

(Ben Johnson at 00:45:14) Yeah. And exactly on that point, whether you're trying to get up through the management track or whether you want to stay extremely technical, but if you do want to progress and be that, you know, tech lead or lead engineer or principal scientist or whatever, or you want to be, you know, C-level executive or director of something, to your final sentence there, it's all about people. And so just learning how people work, how to interact, how to get along, how to encourage and coach—all of those skills are super important.

(Joel Beasley at 00:45:42) Awesome. Dude, Ben, this is an amazing call.

(Ben Johnson at 00:45:46) I'm so—

(Joel Beasley at 00:45:47) I'm so pumped to see where you're going to be in five years other than, you know, with the bat cape and all the car and the Batmobile and all that good stuff.

(Ben Johnson at 00:45:55) Well, let's hope. But yeah, I'm having fun, and I really appreciate you having me out here.

(Joel Beasley at 00:46:05) Thank you so much for listening to the Modern CTO podcast. Share this. Get the word out. Thank you guys so much. I couldn't do it without you.

(Joel Beasley at 00:46:11) I appreciate it. You guys are the absolute best.