Loading summary
Transcript26 lines
- [00:01]
A
Sometimes we have to educate the market because when we go and pitch these solutions, this almost seems like the customers are driving a horse buggy and we are pitching a self driving car. And sometimes they ask are very simple, can you do ticketing for us? Of course we can do ticketing for us, but in addition to that, I mean that's very trivial from our point of view to do.
- [00:22]
B
Welcome back to another episode of Builders. As always, this show is brought to you by Frontlines IO, Silicon Valley's leading B2B podcast production studio. If you're bringing technology to market and want to learn from your peers, we have a library of more than 1200 interviews with Venture backed founders and marketers. Where they talk, all things go to market. Of course, if you want to launch your own podcast, we offer podcasts as a service to more than 80 tech startups. The idea there is very simple. You show up and host and we do everything else. Now with all that said, let's jump into today's episode. Our guest today is Mehul Ravanker, co founder and CPO of Quantro Security. Mahal, welcome to the show.
- [01:01]
A
Hey, thank you for having me, Brett. Excited to be here.
- [01:04]
B
Of course, really excited to have you. And I know we've talked a few times before this conversation and I've been a huge fan of what you and the team have been building ever since. So let's jump right into it. Before we talk about the company and your go to market journey and what you're building, tell us more about you and your background.
- [01:18]
A
You know, I've been building cybersecurity products for over 20 years and I'm actually an accidental product manager. This is not supposed to be what I wanted to do in my life, but I was lucky enough to join a very successful startup in the early stage of my career at Tenable. And Tenable was founded by very hands on founders, Ron and Renault. And they were very hands on in the sense that they didn't need any help for engineering, product, marketing, go to market. They were just doing it themselves, completely hands on. So it was them and us, right? So it was, you know, it was a very small company, very successful company. So for somebody like me who was super young in the career, I got to watch them scale this company to this billion dollar juggernaut that it is today. And I learned a lot, soak all of it in and you know, the way they built the companies, the way they designed the system was that they could ship features every day into the product. And this was way before, like the CI CDS were a thing, and we could ship features into the product, we call them Nessus plugins every day. And for somebody like me, you know, I could ship, build and ship features every day, end to end, like completely without any real overhead. And I was so close to the customers, I could see their pain points and ship this. And it always gave me a kick out of shipping something that the customers loved and enjoyed. And I didn't realize very late into my career that this was actually product management, because we were a very scrappy startup. So the engineers were responsible for product marketing, messaging, blogging, podcasting, you know, evangelizing the product and so on and so forth. And I just naturally started to do that for all the products that I was doing. And I realized this is actually a product manager's job. And then eventually the company hired professional product leaders into the team, and I realized they don't understand the company or the product. So that's when I became a product leader. I started building products and I've never looked back. And I've been building cybersecurity products from open source to enterprise, taking them from zero to one to products that are hundreds of millions of dollars in er, and then scaling them from there. So it's been a fun journey. And now I'm building Quantro Security. It's the agent AI solution for cyber defense.
- [03:17]
B
Let's talk all about Quantro. So you're given the background that you've had in cybersecurity, and if you're like most people that I know who come from cybersecurity, you know that there's a lot of problems out there to solve. So when you were thinking about what business you wanted to build, what problem you wanted to solve, how did you settle on the problem that you're after today?
- [03:34]
A
You know, as I said, my first job at Tenable was being a vulnerability research engineer. And the core responsibility was writing signatures to detect vulnerabilities at scale and doing it safely without crashing the system on the other end. And this required a lot of skill to master because, you know, you had to find the code base. You know, you had to understand the code base of products that you didn't understand. You had to look at the old code and the new code, do a div, figure out where the vulnerable code is, write the perfect exploit, and figure this out. And I sucked at it. But it took a lot of time to master this craft. And what I realized is with AI, the skill and the cost of exploit development has essentially gone to zero. So now an Attacker can essentially build a functional exploit with just a prompt. So now attackers have AI native offensive tools. And if that's the case, and so as a result of it, the attacks will be faster and much more better in the AI native age that is coming our way. If that's the case, what are defenders supposed to do? Are they just supposed to sit around and take it, or do we actually build tools to help them? Because from their point of view, their playbook doesn't change. You just make sure you have a good inventory of all your systems. You patch them, secure them, you repeat this. The only thing that has changed is the speed of response. You have to respond quickly. You cannot go back to the manual processes that are still very much prevalent in large enterprises and organizations. So we started to build the tooling to help the defenders fight this fight against AI, you need AI native defense against AI native offense. So that was the core thinking behind Contra Security. We built AI agents for cyber defense. The other part was when you think about AI, most of the discussions have been around productivity and the productive enhancements of software engineering team. So, you know, look at my software team, they can ship 10x faster, 100x faster, and it's much more easier to measure because you just ship more core, right? So you know, you're more productive. But then the equivalent of that doesn't exist in the cybersecurity world, at least from our point of view, the way we envision it, you know, the equivalent of a productive cybersecurity engineer doesn't exist because the way the productivity is measured for cybersecurity is how good you are in closing the security gaps or effective you are in closing the security gaps. So if you do that more efficiently, you are a better cybersecurity engineer than somebody else. So we wanted to build tools that will make their teams much more productive, find risk, close them quickly before then attackers can find in and exploit them. And the last thing I would say is both me and my co founder Susan, we were leading elite cybersecurity teams, researchers, engineers and so on. And we always had a struggle finding the right talent. Finding the talent was very hard. It's very difficult to do. And if we like you know, the elite organizations have, you know, we worked at college tenable crowdstrike. You know, we are having trouble finding engineers for our teams. Just imagine the situation for enterprise teams or medium to large scale enterprises, right. So we always wanted to build like, you know, an always on expert advisors that, you know, teams can onboard like an, almost like a virtual teammate who can help them in tricky situations without having to hire an army of people who are productive for like five minutes and then probably not relevant for the rest of the day. Right. So those are the three things that we wanted to make sure that we build AI native defense against AI native offense. We wanted to make sure that we provide the productivity tools to the cybersecurity teams to make them much more competent in what they do. And if they're in a tricky situation, there is an always on expert advisor helping them, guiding them and walking them through.
- [06:51]
B
In terms of the market category, where does that sit? What's the category here?
- [06:55]
A
So that's a tricky question. Most of people will try to bucket us into exposure management, ctem, continuous threat exposure management, and so on and so forth. And my thinking is this is not about tool replacement. This is more about making hiring a virtual assistant on your team. So we don't replace the tools, we just make their existing tools much more effective. The talk of AI is System of Record. Everyone is going after System of Record. Oh, we're going to replace HubSpot, we're going to replace Salesforce and all those things. But that's not really a logical thing to say because, you know, if you're a large enterprise, you're not going to wipe code your way to HubSpot or Salesforce.
- [07:30]
B
Right?
- [07:30]
A
That sounds silly to me, but the better way to frame this is we are the user interface of record. So you basically connect all your tools into our ecosystem. And as soon as you connect your data sources, whether it is cloud security infrastructure, vulnerability management sources, web application, container security, you connect your data services into the solution and you essentially have a virtual teammate, a digital assistant. And that is the category. We believe it's a new category that needs to be built. This is not the legacy way of doing things. This is an AI native assistant that is helping you scale your business, either to find the risk or if you're a service provider, make more money, save money, and so on.
- [08:08]
B
This show is brought to you by Frontlines Media, a podcast production studio that helps B2B founders launch, manage and grow their own podcast. Now, if you're a founder, you may be thinking, I don't have time to host a podcast. I've got a company to build. Well, that's exactly what we built our service to do. You show up and host, and we handle literally everything else. To set up a call to discuss launching your own podcast, visit Frontlines I.O. podcast. Now back to today's episode and do you see? Is there any Existing demand for a solution like this? Or is your job to not only go out and build this company, build the product, you have to go out and build demand and create demand so that people even know that they need a solution like yours?
- [08:44]
A
No, sometimes we have to, sometimes we have to educate the market because when we go and pitch these solutions, you know, this almost seems like, you know, the customers are driving a horse buggy and we are pitching a self driving car. And you know, like sometimes, you know, the ask are very simple. Can you do ticketing for us? Of course we can do ticketing for us, but in addition to that, I mean, that's very trivial from our point of view to do, you know. But in addition to that, we can like, you know, deploy patches for you, we can prepare risk reduction plans for you to holistically reduce risk. Essentially you have an agent that can think like a human on your entire enterprise security data at speed and scale. That's the hard problem to solve. And it's very hard for people to wrap their head around. What do you mean it can do that? You mean I can just ask a question or create a task in English and it just understands me? Yes, that's what I'm saying. You literally have to know what it is that you want your virtual analyst to do. Define that task in simple English terms, give it some instructions like you would give a junior engineer, and just watch the agent get the job done. And, and eventually the agent becomes autonomous, where, you know, most of the tools are built with the mindset of humans prompting the agent. But we envision a world where the agents are prompting the humans because the agents already know everything about your organization. They have a good sense of security, so they should be prompting. Hey, I just found these five things. Do you want me to take some actions on them? Brett, yes or no and you click yes. That's how we envision the world to be rather than the humans. Because, you know, we have a limited understanding of our data, of our organization. We might be there are some blind spots that we don't account for, but that is not the case with AI. We can literally scan the entire organization and connect all the dots and see where the risks are, where the attackers will actually break in and close those gaps. Isn't that the holy grail of like, you know, defensive cybersecurity? Instead of just reporting and all of this manual process, you are genuinely just looking after closing the risk faster than anybody can. And that's what we do.
- [10:39]
B
And how does that change the day to day workflows for the people who are actually using these systems day to day, it sounds like it's a wildly different way of work. Right?
- [10:48]
A
The way it works is they're now offloading the high effort, low value tasks to the AI agent. The way to think about this is like most of the times when we talk to our customers and prospects almost 50% of the time is like triaging false positives, reaching out to the people they have find a bunch of things that are. They don't know who the owner is of this asset, who needs to fix this? Even if you have the remediation, like who's the owner, who should it do it? Even if you find the owner, the owner is like I only own the system, I don't own the application. The application needs to go to somebody else. So you need to contact that guy. Once you've contact that guy, that guy is probably on vacation or you know, like he fixes things. But then you have to recheck with that person two weeks later, hey, have you fixed it? You're following up on all these things. They're just wasting time. It's not actually helping you reduce risk. You're just pestering people. All of this could be automated, all of this could be automated where the grunt work is offloaded. Then you're focusing on genuinely high order risk reduction across the organization. Like one of the things I was talking to one of our customers is like, you know, hey, I have like $2 million in budget, like what's the optimal spend of this money to actually reduce useless. That is a very difficult question to answer if you don't have the data. But if you have the data, well, your cloud security seems to be completely sucking. Actually you really need to invest in cloud security or maybe remediation is not as good. So maybe you use a remediation tool to actually close the gaps faster and so on and so forth. These are all data driven decisions that would take weeks or days to analyze and come back to. With AI it's like a minute or two. You can literally once you connect the data, hey, what's the most optimal strategy given this thing to do? Or maybe you just have 10 hours in a week to do this work. What can I accomplish in 10 hours? Like what's the most optimal plan to accomplish in 10 hours? And the agent will come back and tell, if that's what you want me to do, I can get these things done for you, for you.
- [12:32]
B
On the positioning side, I understand you recently came out of stealth. Talk to us about some of those late changes to the positioning that were made.
- [12:39]
A
I mean, you know, the way, you know, this aspect of AI being used to launch industrial scale attacks at scale is underappreciated as it exists today. Right. I mean, you know, because building products for the future, you want to understand where the puck is going or the puck is today. Right. And so what is going to be the state of future a year, two years from now? And the way we see this is running exploits. You know, all these campaigns, these are just going to get easier, faster, much more functional and productive at scale. Then how should the defenders think about this? How should the defenders think about. Because, you know, this problem of just bringing the data in, centralizing it, giving a unified view has been existed for a long period of time. You know, there are tools like, you know, risk based vulnerability management, they're very static tools. They don't have a mind of their own. They're very rules based systems. They can't think on their own, and so on and so forth. But the world we are entering now is like, you know, these tools are no longer equipped to handle the things that are coming our way. So you have to really think about the defensive nature of the organization and improving your defensive posture. These old tools will not work. So the way we positioned our company is, you know, if the future that we see is where there is AI native offense, then the defenders need AI native defense. Instead of like, you know, getting us lobbed into, are you a C10 player? Are you a risk based VM player or a VM player? Well, no, no, no, none of that. We are essentially defenders helping you defend against the attacks that are coming your way and then go from there and then basically build a Persona or team of people targeting different Personas within the team. Like, you know, we announced our first agent, which is a vulnerability management agent on the platform and they'll see more Personas come online which are essentially virtual assistants for maybe compliance, pen testing, virtual C, so on and so forth. This show is brought to you by the global talent company, a marketing leader's best friend. In these times of budget cuts and efficient growth. We help marketing leaders find, hire, vet and manage amazing marketing talent for 50 to 70% less than their US and European counterparts. To book a free consultation, visit globaltalent.co.
- [14:43]
B
what about the competitive landscape? Maybe you don't have to name competitors specifically, but maybe the buckets of competitors and how you think about the landscape.
- [14:51]
A
The way I think about this, there are three big buckets. One is the hyperscalers, like the Microsoft security co pilots of the world. Because the way they see the world is they are a mile wide, a millimeter deep. So they claim to do everything but do nothing really well. So that is one group of. And in some ways they are forced down to their customer base whether they want the product or not. So whether they get used it or not. But if you have like for example in the case of Microsoft, you know, if you have an E file license, you know, we'll bundle this, we'll give this for free or 50% discount on whatever it is. So the customers don't necessarily get the value, but they have a perception that they're using something AI but they don't actually extract the value and the outcomes that they really want. But hey, you're doing something with AI, the second bucket of competition. We don't necessarily see them as competition, but we are actually a complementary solution to them. But they are the siloed tools, like they just do everything really well for their own data. So they have a very siloed point of view. You know, maybe it's a cloud security tool, maybe it's an infrastructure vulnerability management tool or something else. They have a very good understanding of their siloed data that they have collected but they have no understanding of the organizational context around it. Right. So they're kind of very deep in their context but like completely blind in the organization context. Because in the customer's point, from a customer's point of view, they're very risk centric. They don't really care which tool finds the risk. They just want to make sure that, you know, they don't show up on the front page of Washington Post. Right. So that is all they really care about. And the third group that we find is we run into is the wipe coders. Wipe coders, internal projects, you know, weekend projects and so on. Hey, we, you know, let's cloud code into, you know, this solution into our company. But these things are, they lack the innovation that is required or the sustenance that is required for an enterprise grade solution at scale. So what we do is we become the connective tissue. The way I define this problem is this is like the barbell problem of AI agents. On the one side you have this, you know, big hyperscalers and the other side you have these big siloed players and then there's a connective tissue where the customer is like pushing against these two heavyweights to make sense for their world, like, you know, whatever they have to buy. The Microsoft security copilots and the Silo tools, but then they have to customize it for their environment. And we essentially come and we become the glue to make everything work seamlessly and so that they can extract the ROI from the tools and the investments that they've done and at the same time make their teams much more productive.
- [17:03]
B
Let's talk about vision. We always like to end with the fun questions, paint a big picture vision for us of what this is going to look like in three years, five years, ten years from today.
- [17:12]
A
I mean the way I see this, and this is my lived experience, you know, we are a super elite tiny team, but then we are backed by six or seven coding agents, right? And then these six, they're super efficient in what they're doing and elite team managing 10, 1500 agents to do the work behind the scenes. And we imagine a similar model for cybersecurity teams where there is a small super elite cybersecurity team and they are essentially assisted by an army of agents. And the army and these agents are purpose built for a particular function. Maybe it is for pen testing, maybe it is for vulnerability management, maybe it is for compliance, threat intel, maybe it is for ROI planning, risk reduction planning and so on and so forth. So you have like five or six human analysts that are managing maybe 50 or 100 AI agents. And you know, we essentially provide this entire layer of agent AI, layer of defensive cybersecurity. And as we start off with some basic agents, as you need more, as an organization like you need more help, you just onboard these digital or virtual equivalents on your team and basically tell them what you want them to do and off they go and get the job done. And then you manage and analyze their work and make sure the whole point of all of this is to make sure you don't get breached, you don't get attacked, you know your organization is secure, doesn't show up on the front page of Washington Post or New York Times and that is like the ultimate outcome. We essentially ensure that never happens.
- [18:32]
B
Amazing. Love it. We're going to end here. For those who are listening, who want to follow along with you and your journey as you build and execute on this vision. Where should we send them? Where should they go?
- [18:41]
A
Contro Security is our website. We just came out with a new website. We are on LinkedIn X. We just came out of stealth and we don't have a lot of followers. If you follow us, you know, we'll providing continuous updates for the product. We'll be at RSA later this year in the early stage Expo So if you are interested in what we are building, come visit us at the early stage Expo number 48 and both me, my co founder, our team will be there. We'll answer any questions that you might have.
- [19:03]
B
Amazing. I love it. Well thanks again for taking the time.
- [19:06]
A
Thank you bet. Thank you.
- [19:09]
B
Well, that's all for today's episode of Builders, brought to you by the Frontlines. If you want more amazing content like this, visit Frontlines IO where you'll find the library of more than 1500 interviews with founders, marketers and other GTM leaders where we unpack the tactical lessons from their journey. And of course, as always, if you do want to launch your own podcast, we'd love to have a conversation with you. Visit Frontlines IO Podcast as a service. Mention that you listen, mention you love the show and we'll give you a 10% discount. Thanks for listening. We'll catch you on the next episode.