Zane Bond - Zero Knowledge Password Management Technology & Tips For Changing Your Career Path

(Joel Beasley at 00:00:00) Hello, my friends. Today, Joel is talking to Zane, the director of product management at Keeper Security, and they discuss Keeper's zero knowledge password management technology, how having better security doesn't necessarily mean compromising ease of use, and tips for changing your career path to keep it exciting. All of this right here, right now, on the Modern CTO podcast. Here we go.

(Joel Beasley at 00:00:28) This is the Modern CTO podcast. So can you give me a little background about how you first got into technology?

(Zane at 00:00:44) Yeah, absolutely. So let's see. I initially cut my teeth in tech support running a support org. I was always the go-to guy whenever we had a screaming customer. I'd end up getting them because I was able to handle the most frustrated. And then from that, I kind of grew and evolved and really took a liking to product management. And since then, I've been in product management probably about fifteen years. Luckily for me, I always had an interest in security-type things and security, pulling things apart, understanding how it works, and it just really intrigued me. And so for the last fifteen years I've been a product manager on security products. I've worked across the industry. I've done endpoint management solutions, network behavioral analytics, AI machine learning, managed detection and response, vulnerability scanning, privileged access. It's just a whole series of things that I've been fortunate enough to work on product-wise.

(Joel Beasley at 00:01:43) That's pretty cool. And then as you grew and transitioned as a professional, what sort of management human leadership insights did you gain from those steps?

(Zane at 00:01:55) Oh man, so many. Man, I'm still learning even now. Right? It's constantly about just understanding, evolving, learning. And then the little bits of knowledge you do have, you share with those that work with and under you. But I think largely, if you think about some of the management insights, it really does come down to relationship management. Know the people, know what drives them, know their interests. It's really easy to find people to work in a particular job, but creating a culture, nurturing a culture, nurturing people's careers and growth, and just investing in the people that are with you and around you, it really does go a long way to just being able to work effectively within a business, work effectively with people, grow them, mentor, even have mentees, things like that. So I think one of the really interesting things is it's just amazing to be able to continually learn, pick things up, grow, and then share that with different people over time. It's really amazing.

(Joel Beasley at 00:03:08) You transitioned. You made these moves up into management. You learned it's relationships. It's all about the people. Tell me a little bit—I guess first I want to know a little bit about what is Keeper.

(Zane at 00:03:19) Okay. What is Keeper? So Keeper Security is an enterprise password management product. We store the things that are most important to you, your access to everything on the Internet across secrets. We're able to manage, or at least store and securely encrypt, various other things—driver's license, certificates, files, keys, anything you need. But I think from Keeper's perspective, one thing that is really interesting is, especially when I joined, it was unusual that the business itself has security in its core, in its foundation. There are a couple of tenets that are just absolutely non-negotiable. One of them is zero knowledge. And I'd heard the buzzword in industry a lot. I'm like, all right, zero knowledge. I kind of get what it is. Your vendor doesn't know your stuff. I didn't really fully understand how important it was until I came into Keeper. Managing a product, it's frustrating because we have no visibility into customer data. We can't do a whole lot of analytics and things. But from a product and security perspective, it really is an amazing foundational component to build upon. And that no matter what happens, your vendor cannot access the information. There's any amount of third-party compromise or someone coming in, it doesn't matter. We have absolutely nothing. A lot of our encryption is done client-side, which is really awesome. And so much as you generate the keys, you decrypt the stuff, we have the ciphertext. So we become less than, hopefully, less of an interesting target for attack. But as a company, Keeper is kind of in the hypergrowth phase right now. So going from 30 to 300 employees and continually growing every month, we get lots more people on. We have all the right problems for a business to have—tons of customers, tons of new interest, lots of features, lots of things to do. And within the product org, it's really about maintaining direction within the chaos, ensuring we're going in the right direction strategically as a business, building and delivering the right things, and continuing to grow, which involves building in process where those didn't exist, things like that.

(Joel Beasley at 00:05:43) Yeah. Your level of growth is something that I see frequently because we do the podcast and we talk to all ranges of leaders. We try to get startup, growth, and then enterprise. But in the leadership company, the 100 to 300 or 400 people range is right when people start doing things like process. Like, we need a leadership training process and things of that nature. So my time off the podcast is often spent with companies that are growing at your size. And it's honestly, it's such a fun time, especially when you have good people.

(Zane at 00:06:14) It's absolutely my favorite. I love it. You're small enough that you're agile. You're able to get things done quickly and effectively, but you're not so small that you're worrying about going paycheck to paycheck or will we survive the next six, twelve, eighteen months. So it really is just a sweet spot to be in, especially in a growing industry with a product set that I'm just deeply passionate about, like security. Right? Across the industry, so many products, they make promises and they deliver on some of the promises, sometimes they oversell a little bit, or it isn't exactly a purpose fit for what they tell you, but in our space, it is pervasive, it's necessary, it is really strong, and many security products make your life more difficult. Right? It's like, all right, it's going to be more secure, it's going to be more of a pain, but let's do the pain versus security analysis. Whereas on our side, we actually make things easier. Once you get really well invested into a password manager and storing your stuff, accessing things, not having to have the cognitive load of 200-plus passwords in one of the websites, all that really not only makes you more secure, but it makes your life easier, which is awesome. I love that.

(Joel Beasley at 00:07:28) Yes. If people are listening that have not gone to password managers, your entire life will change. I saw someone—I did it four, five, six years ago. I switched to start using a password manager. And maybe even more because, man, time's going by fast. But I saw someone entering in a password, like, typing it in the other day, on a phone or something. And I just thought to myself, whoa, way to live in the stone age.

(Zane at 00:07:53) Yeah. Absolutely. So actually, you spoke with Craig a couple weeks ago and actually installed Keeper. How's that going?

(Joel Beasley at 00:08:01) Dude, that is going pretty well. Your team has been really great. Kate reached out to me and I really love the interface. I literally installed it, became a customer on the podcast. And then I think two days after that is when we started our ten-week journey. So I haven't migrated, to be direct with you and honest, I haven't migrated LastPass over yet, but I'm excited to do so. I really am be—and partially because of the experience. The entire experience, I don't want to talk badly about LastPass. But there's a lot to be desired in the design and user interface. It just feels like a product that was made ten years ago and hasn't been updated, and Keeper Security feels like a Silicon Valley-level product.

(Zane at 00:08:47) We absolutely focus on user experience. It's really fortunate. We were able to build a product that we use, that our family uses, that our entire business and company uses. And so understanding, seeing all the perks and bugs, those tiny little things that drive you nuts, we were really passionate about tracking them down, getting them fixed rapidly, identifying the components, and whatever it is, just make life easier. And we have extremely passionate leadership that just kind of trickles all the way down to our individual contributors.

(Joel Beasley at 00:09:19) Did you know that when you install a new one of these—because I had LastPass installed and Apple Pass, Apple's default keychains installed. But I went to go add a third one, and it doesn't let you. You can only have two selected at a time. So I wanted to start using it right away, but I didn't switch LastPass over. And for some reason, Apple, they've just dug their nails in just enough to where sometimes they have a few passwords that I don't have synced. Right? And so you can only have two password managers active at once. You can have—you can install multiple ones. You can see them on the list, but it wouldn't let me activate more than two at once.

(Zane at 00:09:57) Yeah. Especially with Apple, they do a really good job of integrating password managers across their ecosystem. So whether it's your Apple Watch, your phone, your iPad, and to maintain a semi-reasonable experience across all that, they really do limit how many things you can have. So in the enforcement they have, we can't get around it. But moving to a password manager from a spreadsheet is a task in and of itself. Moving to a different one is a whole different task. And what I found is if you take it off in really small, bite-sized chunks—don't try and tackle your own balls or all 500 passwords you've accumulated over the last couple decades. Right? Just say, hey, I'm going to get to two or three of them. And depending on the tool you're using, like within Keeper, we have dark web analysis and weak password analysis and password reuse, we kind of highlight, if you're only going to update two or three things today, here are the ones that make the most sense. And that shows up on our dark web section. And yeah, don't make a big project out of it. You'll end up getting burned out. Just tackle a couple of them as you have done, and go through there. Make it more secure, get unique passwords, et cetera.

(Joel Beasley at 00:11:14) Yeah. That's interesting. I'm curious. Have you guys ever—I mean, you use your own product. Right? So you get a lot of insight from there. But I like that you make those convenience issues—or convenience features—because, for example, Google Chrome is notifying me of stuff now, passwords. Right? It'll say, like, 732 of your passwords. And it's because I'm a developer. Right? So I'll have test credentials running and things of that nature. And so I like that it highlights—I assume you guys do it kind of based off activity. Right?

(Zane at 00:11:48) Yeah. Yeah. The main criteria are just, is it a terrible password? Stop that. Are you reusing it? Because password reuse is prolific. Right? Trying to remember 200 passwords is just not sustainable. So what we find really often is consumers will have a core password and then maybe they'll capitalize the first letter, throw an exclamation mark on the end or put a number one on the end, and then maybe change that. And that just from an adversary standpoint, it's not that much more difficult to attack. Just being able to completely have unique passwords per site and not worry about it. Just, hey, whatever the site is, type in the name, I click go, and I'm there.

(Joel Beasley at 00:12:32) So what's—what's personally, and I don't want to segment your teams or anything like that based off features, but what's personally your favorite part of the product?

(Zane at 00:12:41) Favorite part of the product? That is interesting. I think as a user of myself, I really, really like the iOS app. It's got a great user interface, ties in cleanly with the operating system. I put on multi-factors so I can have all the various levels of authentication, email validation, or token, whatever. But I can also save some of my one-time passwords in records. So if something needs a second factor authentication, I don't have to put it in. I go to the website, it will input my username, my password, and click next. I'll put in the authenticator code, it will click next. And I don't have to have 15 different apps open to try and get those one-time passwords across the board. So I find that one to be a lot of fun.

(Joel Beasley at 00:13:29) What sort of benefits does your product have? So there's a lot of competition in the market. Right? There just is. And that's a good thing. When I'd stand up in front of investors and like, this is a competitive market, I'd be like, yes. They're spending money here. People are—that's any market where people are spending money is going to be competitive. Right? So I'm curious, what specific niche do you try to fill?

(Zane at 00:13:53) We focus, from a foundational security standpoint, zero knowledge is just absolutely non-negotiable, like I mentioned earlier. And so we have individual record-level encryption. So even if, for some crazy reason, one record's key got compromised, which is highly unlikely, you don't get the entire vault. You don't get everything. You have individual components. We have really strong integrations, just whatever you need to run from a consumer or business perspective. Right? Whether you have a single sign-on solution, whether you have an Android device, iOS device, if you're on Chrome, Safari, Opera, whatever it is. So I enjoy the—well, I mostly enjoy the wide platform support. It's great for our customers. For our engineers, they have to support everything in the world. Drives them a little crazy, but it really is powerful where we can go to a customer and almost universally ask, oh, do you support this? Oh, do you support that? Oh, do you support this? Almost always the answer is, yeah, and it works fine. That's no problems.

(Joel Beasley at 00:15:01) You've mentioned zero trust, zero knowledge a couple times. I have a fairly good understanding of that, but everyone has their own unique way that they talk about it. Can you tell me how at Keeper Security do you guys talk about this concept of zero knowledge? What does that mean?

(Zane at 00:15:16) Sure. Zero knowledge, the simplest explanation of it is the vendor has absolutely zero knowledge about your data. So when you create an account with us, your encryption keys are created client-side. It's never sent to us. We never have the key. We never have the means to decrypt it. The information that is stored is stored in a completely encrypted format. All of our databases, our tables, we don't have access to read it. It's ciphertext that's stored. You retrieve the information and encrypt it locally. So even if we had man in the middle or our infrastructure compromised, we basically hold the ciphertext. You as a customer hold the keys. And what we do is we just make that entire experience incredibly secure but also easy. You have no idea that there's dozens of keys floating around and all kinds of encryption and different iterations and hashes and salts and all the fun security stuff that needs to be in place to protect your credentials and secrets. All that's there, but it's just super simple. Hey, I click an app, I want to go to homedepot.com, and I'm there.

(Joel Beasley at 00:16:20) So tell me how—like, if I have the Keeper app and then I go on the website, how does it connect those—like, how do I get to access it from multiple places, but it also not be aware? I don't know. How does that work?

(Zane at 00:16:33) Yeah, absolutely. So whatever device you connect on, that's where you'll create that first set of authentication. So on your iPhone, maybe you have a master password. If you don't want that, maybe you can do Face ID or Touch ID, fingerprint, whatever that is.

(Zane at 00:16:49) That encrypted value, that component, your master password, is what's used to decrypt the data. So when you send the data to our cloud, it's sending completely encrypted. And when you retrieve it anywhere else, whether it's the Web Vault, desktop, Mac, Apple, Android, it doesn't matter where you are. Wherever you retrieve it, you get the same encrypted data and you use that key to decrypt it. And you don't have to worry about maintaining and wiring all those keys.

(Joel Beasley at 00:17:19) So when I'm going into the web, the first time I enter in my master password, that's how it's encrypting and decrypting the data?

(Zane at 00:17:28) Correct. Yes.

(Joel Beasley at 00:17:29) That's pretty neat. So I just have to make sure that that password's really secure.

(Zane at 00:17:34) Yeah, and that's one of the really important things. Your master password needs to be secure. And then it's a really good idea to protect your vault with some kind of second factor. You know, maybe it's an email backup because it's super easy. Maybe it's a one-time password. Maybe you have in-app pushes, or maybe you can use a different device to authenticate your second device, whatever it is. But having a secure password is great for your vault. Don't pick something you're going to forget, please. We get a lot of those. If you call us, we can't reset it for you. We can't do anything. We have zero knowledge. But yeah, the backup component to protect your entirety of your secrets is really a great idea.

(Joel Beasley at 00:18:16) Tell me about the future, Zane. I want to know about the—tell me, I get your crystal ball out. What are we doing for authentication in the future? How does this find out?

(Zane at 00:18:25) I like it. As a product manager, I focus on future thinking a lot. So when you think about the industry, even if you go through the past, I've been doing security a while, and we find that so many of these topics just become cyclical. They come up time and time again, and you can really distill the things you need to do generically as, you know, update your systems, whatever it is, right? Make sure things are up to date—operating systems, routers, firewalls, access systems. Apparently cars, you have to update those. Make sure things are up to date. Second, don't reuse passwords or store them safely. And that's where Keeper comes in fairly well. But you know, just use a vault, please. I don't care. I prefer you to use ours, but just use one. It makes your life easier. And then just don't go and click on things that are risky, like, you know, suspicious. If you look at the evolution, it used to be attachments that were executables, then it would be scripts in Word documents, then it would be phishing pages. It doesn't matter what the exact technology is. If you keep things up to date, have good password hygiene, and click intelligently, you'll be in a really good spot. So how does that relate to us from the industry? People want things to be easier. They want things to just be seamless. So a lot of the vendors are doing a great job on updates. Operating systems send out an update every night. Don't worry about that. If you're in business, you probably have a lot of infrastructure to worry about. So hey, there's your job right there. Make sure it's up to date. From the password side, this is where we can continue to make accessing the Internet just a more seamless and easy experience across the board, right? It doesn't matter what you want to access. I want to get to a website, great. Just type in the name, click Go. Or I'm on a website and I want to get into it. That's fine. Click on the password, click on the login field, and just go. So from a future perspective, it's really about making sure that those use cases continue to be seamless across the board. And we find buzzwords come and go. One of the more recent ones that we've seen pop up is passwordless. Like, oh, everyone wants to go passwordless. Cool. That's great. It's wonderful, actually. But if you take a step back and look at the factors to authenticate, passwords don't have to be there. The types of factors—you can be something you are: your fingerprint, your face, your biometrics. It could be something you know: password and PIN code, mother's maiden name. It could be something you have: your phone, your Yubikey. There's tons of other ones, like somewhere you are: geolocation, general places. But when you look at the factors to authenticate, there's a whole lot more you can use instead of just a password. Unfortunately, it's going to take the Internet quite a while to get past them. And so for the next foreseeable future, you're going to have to authenticate. You're going to have to have them. But being able to get to where you need to go doesn't have to be painful, right? So we can have you pick up your phone, Face ID authenticates, website opens, it goes in. Right now you're able to get into your vault, authenticate, get to a website, pass through, put in your one-time token, whatever it is, all by just picking up and looking at your phone. That's a great user experience. We want things to continue to be that easy, but still be incredibly secure. And so, you know, whether it's tying into, like, on a business perspective, maybe you have Active Directory and you want to use a single password or single sign-on. You'd be able to remove users, have the business say, "Well, sure, that's fine. Use single sign-on. Sign into the system." Keep things as simple as possible to get to where you want to go because any time you make it more difficult, the user adoption is going to drop off. And in the security space, sometimes, especially with large industries or large companies and compliance frameworks, you can make certain security options not optional. You just have to use those. But in the consumer space, really, we want to be secure and we want it to be easy. And you have to just eliminate that friction entirely.

(Zane at 00:22:45) So continue building things in a zero-knowledge framework, solving the use cases for people where it's just easier than not using the product—that's an amazing goal to have, right? Like, the Internet is difficult, passwords are terrible, nobody likes them. Let's make that easier. But then you start thinking, where else are these secrets and passwords and credentials used? Well, you've got systems on your side and you're well aware of it, right? Your deployment systems, your source code, your CI/CD, your configuration files. Being able to remove those hard-coded passwords and get them out of the system and replace them dynamically and generate them and rotate them and do all the fun stuff you need to maintain just a healthy—just have a healthy view of the entire set of passwords and secrets in your environment. Have a complete audit of are they exposed on the dark web, are things showing up where they're not supposed to, are passwords being reused, or just, "Hey, I'm going to change a password on the server because somebody left. What else is going to blow up?" Right? Just understanding where things are and where they're being used is really important. I can't tell you the number of times I've worked in a system where everyone's like, "Don't touch it. It's been running. It's the full desktop. It's under someone's desk, and we've never turned it off because something critical depends on it, and nobody updates it because it's going to blow up, and we lost the source code ten years ago." You know, it just becomes difficult if you don't understand where things are used, how things are being used, and credential rotation becomes a nightmare. So definitely there's a lot of interesting places we're looking to evolve us as a business, but also understanding where's the industry going. And it really doesn't matter if you're consumer, small business, or enterprise. Trying to get your job done without having products scare you away is really important. You know? If we can make your life easier as a digital citizen, yeah, let's do that. I'm all for that.

(Joel Beasley at 00:24:43) That's pretty neat. Is this auto-rotation thing that you talk about, is there a standard out there? I think I've seen once or twice where it looked like there was a button in one of the password manager apps where I could just click it and it would change. But it didn't seem broadly supported, but I don't know if that was reality or if I was just imagining that it worked like that. Is auto-rotation a thing?

(Zane at 00:25:04) It is a very difficult thing. The problem is every website out there has their own method. You know, some of them, you talk to your top 100 websites, you may have APIs you can call, you may have pages you can get to to click this and work through it. There's a whole series of things. But then you've got, like, on the back end, you've got tons of websites out there where it's like some guy just throwing passwords in a SQL database in plain text. You don't even have a change password button, right? It's just the evolution is tricky. So the rotation is incredibly difficult and really has to be solved almost one site at a time or one target at a time. Maybe it's machine credentials, maybe it's website credentials, whatever it is, just step it up. What is this thing? You know, how do you rotate it? And then once that gets set up, then, you know, the automation kicks in and life's good. But especially on websites, they get updated all the time. You know, APIs change, website front ends change. So the rotation is a really tricky component. And for those that have jumped into that area, it really is limited for just, you know, certain subset of sites.

(Joel Beasley at 00:26:22) You get pretty nerdy about security stuff. I had seen in a newsletter a couple weeks ago that they were having a security, like, hacking competition, and they were trying to hack this operating system. But the operating system uses AI to rewrite itself, like, multiple times a minute, or maybe it was even a lesser value than that. Maybe it was like it would change parts of its own code and rewrite itself. So by the time they could find anything, the operating system would just be different. Have you heard about that at all?

(Zane at 00:26:50) You have polymorphic code. Really, really nascent technology, and it actually really has—it's been used more widely as an adversarial tool, where a virus comes in and instead of getting a signature or a hash of the device or the hash of that binary, it just continually rewrites itself to avoid detection. And so on the defense side, it's a lot more difficult. And yeah, I'm all for it. I think when you look at the interesting technologies that get developed around or specifically targeted for, you know, what's the flavor of the week for how to attack or how to defend or how to get against a certain threat, it's practically an arms race, right? It's the attackers come up with something or find an avenue, defenders increase their defense. Sometimes defenders do their best to close things off and that ends up looking at other things. But it's a really interesting arms race. But at the end of the day, we've gotten really good at locking down many of our systems and our people are still inherently—you trust other people. You want to trust other people. And so that has been a really interesting target is to just go for the people. It's really hard to get around that. As systems get more advanced and protect themselves better, you know, just find the path of least resistance to attack.

(Joel Beasley at 00:28:26) I'm curious to know, how did you actually find Keeper? Like, were you there since day one, or did you join later? Tell me about that.

(Zane at 00:28:36) No. I joined later. Like I've mentioned, I've been working on various different security products as a product manager, and Keeper is really growing. And so initially, CEO, CTO, and co-founder—they were effectively the entire product team. They would come up with the design, the features, the validation, and go out there. And as the business continued to grow, it just became unsustainable. So we brought on a product management team. And now we're trying to bring a little more process, a little more rigor to what we're doing, as well as continually delivering quality software. It's fun. It's awesome. And I think what brought me to Keeper? The most interesting thing is I really enjoy working on a foundational security product that almost everybody—like, if you're on the Internet, you're a potential customer and this product can be good for you. Period. So many things out there, you have specific markets, you have specific personas, you have really limited hardware support, whatever it is. No. You log into something, you probably have a password. Let's make your life easier. So being able to work across consumer space to the enterprise space is really amazing and fun. It's challenging to design it. But it forces us to keep a clean and simple user experience across the board, which once you get into the businesses and larger enterprises, it becomes really appreciated. Because so many products out there are like, "Oh, they're technical users. We can make the UI a little more difficult." Well, with us, it's not really an option. Now, we have technical users. We've got engineers. We've got people picking up the APIs and SDKs, all kinds of crazy stuff. But we've also got grandma, and grandma just wants to log into Facebook.

(Joel Beasley at 00:30:29) That's true. That's true. And then the kids go off to their Snapchats and their Instagrams to try to hide from grandma.

(Zane at 00:30:37) Exactly.

(Joel Beasley at 00:30:39) Okay. So one of the things, one of the core concepts we've got—educate, entertain, and elevate are the three reasons why we exist, right? Educate people, entertain them, and elevate them. And so from the elevation side of things, I'm curious. Could you tell me a little bit about what the courtship process was like between you and the executive team as you grew? You know, you came on board from when you first started talking to when you actually accepted the position and how all of that worked?

(Zane at 00:31:08) Yeah. Absolutely. The Keeper team here is incredibly motivated and just gets an enormous amount done, just more so than any leadership team I've ever seen. And so the process was really interviewing with CEO, CTO, understanding, is this a good fit culturally? Are things going to work? And we have a really good idea for just gauging personalities, understanding, you know, do we have a cultural fit? And so the process itself was surprisingly fast. It's quite refreshing. You know, when you interview at certain companies, you're going to have dozens of interviews. They'll do panels and all kinds of things. And with us, it was largely about, do we have a good fit? Does our future vision make sense? Do we align? Then can we get along? And all those things really came into place pretty quickly. I was really fortunate.

(Joel Beasley at 00:32:08) How did you first hear about it? Was it a recruiter? Was it a relationship introduction?

(Zane at 00:32:13) I wish I could say it was a relationship introduction because so many of my roles have been. This one, however, wasn't. This one, I found them out there and really was—I love the password management space as a whole because just being able to deliver, solve a problem that affects so many people is really just—it's fulfilling. Now it's not so much about I've got a job, I've got something to do, I'm going to deliver it. It's just it's powerful. This is something that could raise, you know, all ships in the ocean, get people to a better security posture, get everybody to use something. Be careful what password you use. I'd love it if you use ours. But, you know, just understand that this is part of your digital identity and part of being, you know, a citizen of the Internet is you have to be secure and protect yourself because, unfortunately, for the adversaries, it is far too profitable now to stop.

(Joel Beasley at 00:33:15) So you just found them online and were like, "Hey. What's up, guys? Let's do this."

(Zane at 00:33:19) Yeah. Found them online. Did some research about the company. You know, luckily, especially being in the space, well aware of what the solution is—or at least what I thought the solution was. It's far, far deeper and far more complex than I initially thought. I'm like, "Yeah, password vault. That's cool."

(Zane at 00:33:40) It's browser extension. There's way too much more to it. So, yeah, reached out to recruiting folk. I quickly got in touch with management. We had a great alignment, you know, the role, the responsibilities, things that made sense.

(Zane at 00:33:55) And again, just had a really strong interview with appropriate folk and moved on from there.

(Joel Beasley at 00:34:04) I like to talk about this because it doesn't get talked about a lot. Right? And I think it's important for other people to see because early on in your career, you think, okay, I can go to the Internet and do a search for job postings, and then I can fill out that application, and then I hit a wall. And that's it. That's all I can do over and over and over. Then you learn about relationships as you grow in your career and there's other things. And then, you know, at least in technology, me personally, I developed an aversion to the recruiters because they were always just spamming me. And so I was like in my head, I was like, don't like recruiters. And then I realized there's all types of recruiters. And at companies, they'll have recruiting teams, and that's the gate. That's the front door you would go knock on. Right? And then you can develop relationships with them. And then, you know, you advance even farther in your career and you realize, I'm gonna be spending a lot of time. I'm really passionate about what I'm doing. I'm gonna be working really hard. I better be doing something that I'm interested in and care about. And so most people, it takes them decades to realize that they can do what you did. They can say, I'm interested in this area. I'm gonna go search for the companies in this area. I'm gonna see which ones are growing quickly, which is all data available on LinkedIn, on, you know, different sites. You can see, alright, here's a fast growing company and an industry I'm interested in with a product I think is pretty cool. And you can take that passion and then reach out to them through, you know, you can email their executive team directly. You can email their recruiters. You can figure out, you know, where's the front door of this business. Maybe I have relationships in common. And you could say, I wanna go work for you. And most people don't know that that last thing I just described is an option, but you did. So that's why I want to highlight it.

(Zane at 00:35:41) Yeah, absolutely. If you think across various roles, right? Finding something that just gets you excited, like an area or a space, is really, really awesome. When you're starting out in your career, you think you may be limited to what companies are local, what roles are there, just what's available. But it's important to think about, you know, what areas you're interested in and, you know, if there are particular things that get you excited. Because when you commit to a career, potentially, you're doing that an enormous amount of time and you have potentially a portion of your life. Career changes are absolutely possible. You know, just when I had started, I found a company I really liked, worked with some folks that were interesting. I was in support. And from there, I got exposure to the rest of the business. Oh, this is what the sales guys do. Hey, that's not really for me. This is what, you know, engineers do. Like, I wish I could write code, but that's not up my alley. Then I found, you know, different exposure to different parts of the business and then just work towards that. And it's talking to the people you want to talk to, reaching out to them is so many times far more effective than you think it's going to be. Even if you get rejected, so what? What do you have to lose? Right? It's reaching out to someone and saying, hey, you know, whether it's in a different department or a different company or a company you're interested in, many times, especially if you're not trying to sell someone something or get some money from someone, you reach out and say, hey, can we chat? Can we talk about this? I'm interested in your business, your company. You almost always get a response. It's really common to have people, when you reach out to them, they're interested. Let's talk. And if they don't have a role available, that's fine. A lot of times, they want to help and they'll say, hey, but why don't you talk to so and so in this department because they may have something that's a better fit, or I don't have anything right now. And searching for jobs, persistence is so important, but just don't just apply blindly. Make the contact. Build out your LinkedIn profile, reach out to people, ask questions. There's nothing wrong with asking a question. Worst thing that's going to happen, it's going to go unanswered.

(Joel Beasley at 00:38:05) I love that strategy you mentioned of just reaching out to the people directly. And I think I should, I wanna add to that a little bit too. So that I've seen, because a lot of people reach out from the podcast, right? And so I've seen people say, okay, well, Joel, I've reached out to these two or three people and I didn't get anything back. And that's when I wanna share some advice from my experience working in sales. You have to reach out. Like, if you reach out to a thousand people and no one responds, then you probably, you know, you need to readdress something or talk to somebody for some help. Call up a writer. Go hire a writer on Upwork or something or send me an email. But, yeah, volume is such a thing that's hard to get experience with with outreach, especially for, you know, people in the technology world because we don't understand volume. Volume's inherently understood. It's like day one, one zero one, you understand volume in sales, how many times you need to reach out or interact with people before you get a response. But we don't have that in engineering. Right? Like, we understand we need a lot of data to run AI. We understand we need, you know, different skills. But that skill of contacting people is something that I like to bring up on the show a lot because it doesn't get talked about a lot.

(Zane at 00:39:21) No. Absolutely. It's important. And also just learning to be okay with rejection because, you know, applying to a job, especially when you first start out, you're like, oh, I applied to four jobs. This is going to be great. And then when you get a rejection letter back, it's like, oh, man, this is terrible. Like, was I just, am I just a bad person? Like, am I not qualified to be in this industry? And I can tell you from the other side, the reasons to accept or reject a job may come down to skillsets, may come down to education, may come down to stuff, but so many other times it just comes down to, you're awesome. I would hire you in a heartbeat. I just found someone a little more awesome. And just keep trying. And so, yeah, absolutely. Not taking rejection personal, keep plugging along, keep trying is massively important.

(Joel Beasley at 00:40:11) Go for 99 rejections. Yeah. You'll get one in there.

(Zane at 00:40:15) Of course. And, you know, also, sometimes what I find is if you've got a role that you're super, super interested in, apply to some roles that you're just not as excited about first. You know, get comfortable with the interview experience. Get comfortable with the application experience. And even if it isn't a great fit, even if it doesn't work, okay, that's fine. And then go into the ones you're super excited about, a little more prepared. And worst case scenario, the one you weren't as excited about comes in, they give you an offer, and someone else gives you an offer, and now you get to decide. But, yeah, it's really about persistence, practice, and getting a thick skin. It's so hard to, when you get rejected, you think, you know, so many are like, what's the reason? What did I do wrong? Did I screw up the call? And from the other side, I've had candidates that were, you know, fantastic and great. I just had somebody else that fit a little better with the culture or, you know, happened to be local or happened to have, I don't know, experience in a particular product or technology I was looking for that you didn't.

(Joel Beasley at 00:41:20) Yeah. It's not because you suck. It's just because there's someone that happened to meet it better. And then some of those things you can't control. Right? Like location. Like, if you had two people and they were completely equal, but one happened to be able to come into the office and work with you in person a couple days a week, you would probably pick that one. Right?

(Zane at 00:41:36) Yeah. Absolutely. And COVID has really done a number of things, but in general, being able to interact in person, there are massive benefits to that. And if you have the opportunity, I strongly recommend it. Get in the office, work with people. The amount of relationship building and fostering you get from just water cooler chats or talking to the right people or, you know, being in a lunchroom with somebody who you would never talk to, like VP of sales or something. You have no reason to interact with them, but you just happen to. You can learn a lot. You can practice communication skills. Always good about learning how to build out some small talk, learning how to communicate with people, understand what other parts, what other things are interesting within the business. And that's definitely interesting.

(Joel Beasley at 00:42:30) While I have you here, I was hoping that I could, you have a lot of security experience, but you also have a lot of product experience. Correct?

(Zane at 00:42:37) Correct.

(Joel Beasley at 00:42:37) Okay. So we've launched a couple products, like, two. And the first one's doing really, really well. The second one is getting traction. But what it alerted me to, and we're a small company, we're under 15 people, is that we needed a framework for how to scientifically, like, the scientific method, come up with a hypothesis, test it between, like, go to market, like, cold emails and then ads and, like, run different value props against different audiences. And then figure out this metric that we came up with, which I'm sure is not unique, but we call it market pressure. Like, how many responses per thousand do we get against that audience and value prop? Is there content out there other than me just using the scientific method and writing up the document, building the spreadsheet with my team? Is there a more solid framework out there? Is there a different way? How do you guys do this?

(Zane at 00:43:30) Yeah. Absolutely. So at the foundation, you know, focus on the customer. Are you solving a problem for your customer? Is the problem pervasive? Are people willing to pay for it? Right? Just make sure you've got some of the basics handled and you assume, let's go to the assumption that, you know, you're solving a problem in market and you're now trying to get some more velocity, get some customers, get some more awareness. When you get a couple customers, talking to them, understanding how to use it, understanding what's going on is really important to building and growing that understanding of your customer journey, your buyer journey, whatever that is. There are some frameworks out there that I've used to train product teams over the years, most common being Pragmatic Marketing. I've also done Serious Decisions.

(Joel Beasley at 00:44:25) Are these books? I'm sorry, I'm taking notes. Are these books?

(Zane at 00:44:28) Yeah, well, Pragmatic Marketing is a product management framework that really just takes the things that you should do within product management and puts them all in big boards and it's, hey, if you're doing stuff right, here's the whole list of things. Foundationally, it comes down to, you know, identify market problems, you know, make sure you understand who you're building for, build them properly, get them to market, talk to your sales, build out a sales plan, build out a marketing plan, all those things. So that's...

(Joel Beasley at 00:45:01) Have you had to do this? I'm sorry to interrupt because I'm so excited. Alright. So I'm pretty comfortable with, like, scaling something up that already works. Right? Because that's pretty simple. You sort your customers, you pick the ones you want more of, you analyze them, you talk with them, you spend time with them, you understand them, you love on them, and then you go attract more of them. Yep. Right? And then you're like, this is how I'm steering the business, and you just repeat, repeat, repeat as your customers will get bigger and change. Right? And, but the first 10 closes, this first 10 sales, proving that this problem is a problem and people are willing to pay for it. Have you come across any frameworks that help you with that very first early stage?

(Zane at 00:45:45) I think not a particular framework, but one of the first books I got when I became a product manager, the product team got it for me, the whole team autographed it for me, was Crossing the Chasm. And that talks to the, there's actually three books in this series. It's creating a product, getting it to market, solving the problem, identifying those components. And that's one of the good stories of it. So from there, Crossing the Chasm, Inside the Tornado, I forget the third one. That series is really good about talking about that entire process from growing something, targeting just a really small niche that you can do well. Find one thing, do it excellently. And then validate that, expand upon it, and go from there. So that's one resource that I've found is just, was really useful. And luckily, coming into product management, I had some really strong mentors that were able to guide me in the right direction. So so many product folks just don't have that, and they just kinda have to wing it and figure it out on the fly.

(Joel Beasley at 00:46:50) Well, put it in the back of your mind over the next couple months as you go through life. If you come across someone or some resources that are like, this is how you test, because you could build a product. You could spend a lot of money and time or even just build an MVP. You build a product, but I run across, like, one or two people who had mentioned something along the lines of, like, they'll test the marketing messages first, then find pressure, and then they will, you know, sort of shape the product as, because you can do a lot if you have a fire hose or if you have a stream of water, you can start to redirect that stream. But when you're just looking at dry land, you're like, let's get some water flowing through here.

(Zane at 00:47:27) Yeah. It's really, that's where you have to validate that, you know, are you solving a problem that really exists? And a lot of times, like, when you look at a lot of these startups and founders, it's problems that they ran into, and they're like, man, this is a thing that I think I can fix, and that was bad enough that I'm going to take a big risk on it and build it. So just making sure that you're building something that solves a problem, and then, you know, continue evaluating that there's pervasiveness, impactfulness, like, is your solution enough to make things nice enough that they're going to pay for it? And, you know, expanding from there. But yeah, the beginning is really the most difficult. And for some things you could take a stab and you may fail at it. And then, you know, as long as you're not investing too much in an attempt, then you can just take a bunch of little attempts and you'll take smaller risks. And it's better to get something small, try it out, see if it makes sense, evolve a little bit, go from there, and then build some huge thing and, you know, secret stealth mode. And then hope that, you know, when you come out of stealth and launch, you just wow the world because it doesn't always happen that way.

(Joel Beasley at 00:48:43) Well, you're the first person I've really asked about this because we're, we kind of, you know how you'll be pursuing a path with your team and then you realize that, you know, this journey that we're on, it's not working out well. Let's figure out, like, what we learned from the past eight week cycle that we've been working in. What we haven't done right, what we have done right, and then let's create a plan to, like, you know, start again and redo it. And so where we've been falling short is structure and organization around testing value props against specific audiences to figure out if we have market pressure.

(Joel Beasley at 00:49:18) And we realized that we weren't fixing the number of contacts we were reaching out to. So some campaigns had more than others, and we weren't logging it correctly. And so we're on our second iteration here. And as I was working on that before our call, I was like, man, Zane's a product manager and product managers release new products, right? And they release new features and things like that. And I'm curious if there's some amazing framework out there that everybody knows about that I don't, that should be staring me in the face. And so I'm glad I asked. And then if you come up with anything in the future, if someone mentions it to you, pass it along to me.

(Zane at 00:49:54) Yeah, absolutely. Launching new products is definitely really challenging and risky. And it's exciting and fun. And really focus on understanding as best you can the problem. I think one thing that you already have that's really doing well is you've got data. I can tell you, even myself, I've made so many decisions in a complete data vacuum. And those become, the less data you have, the higher risk it is. And so the fact that you've already got some good points to measure against when you try to optimize for that is great. Also, I think understanding what done looks like, what your deliverable looks like, helps you. If you know what done looks like, you can work backwards and strip things down to get the smallest bit working towards that.

(Zane at 00:50:46) Some of the times, especially with some of the PMs on marketing, they just say, look, if you're going to design this big feature and grow this big monstrous product, just figure out what your end product will look like. What does the ideal output look like? And then let's work backwards to make sure that the outcome, the output, the value that we're delivering at the end of the day is not getting lost, because it's so easy to realize that in the beginning. And then when you break things down into little pieces and you start delivering little chunks, you don't get enough of it to actually get the value out the door. And with larger projects, you architect something, you have a whole back end, you have a whole something, and then just don't take that last little bit and you end up falling short.

(Zane at 00:51:30) So understanding what the value is, the value you're delivering, what does done look like, and then you can say, well, we can't have an automated engine of this. Let's do it manually. We can't have this component because it's going to require a dummy or something. You find alternatives to get the complete picture of the value deliverable early.

(Joel Beasley at 00:51:54) I love it. Thank you. Thank you. Because, yeah, we do that in our sales calls. We focus on the outcome, but we could definitely be doing it better. You're giving me some ideas. But as we start to wrap up here, I want to be respectful of your time. What is the value that you guys sell at Keeper? What is that moment?

(Zane at 00:52:14) The value you sell at Keeper, man, we make the internet easier for you. We make it more secure. We do our best to use our own products and make it easier for us so we can also make it easier for you. And security is absolutely at our foundation, along with ease of use. Just the whole enterprise password management space is really exciting in so much as it's one of the few security products I've worked on where you make the customer's life easier. And by using it, at some point, just like you mentioned earlier in the call, like, I can't believe I saw that guy not use it at all. It's just more difficult. And we try and make people's lives easier while keeping things secure.

(Joel Beasley at 00:53:00) I love it. And if people want to try it for free, can they?

(Zane at 00:53:03) Yes. We have a free option within, actually, we've got a microsite for you guys. So keepersecurity.io/moderncto. You can try out the product. You can get a, if you try it out for a business trial, we'll give you a three-year free personal account so you can use it personally for quite a while. I'd highly encourage you to try it out. We do our best.

(Joel Beasley at 00:53:27) Excellent. I'm super excited about it. I'm looking forward to getting all of my data transferred over. And man, I really like what you guys are doing so far. Everyone I've interacted with over there, great culture, great people.

(Zane at 00:53:39) It's an awesome team to work with. Really energetic, really motivated, and I have nothing but good things to say about the team here. They're amazing.

(Joel Beasley at 00:53:50) And you guys are hiring?

(Zane at 00:53:51) We are hiring. Keeper Security, we have a whole job section across the board. Just about all parts of the org, we are growing.

(Joel Beasley at 00:54:02) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you'd like to hear discussed on the podcast, either add me on LinkedIn or send me an email, [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.