Loading summary
Transcript43 lines
- [00:00]
A
I'm one of the founders of Baobab, which is a cyber insurance provider, but we combine it with risk management software.
- [00:08]
B
What was exactly that market gap that you identified which sort of draw users out to found the company?
- [00:14]
A
These insurance products were not profitable. There were a lot of losses being paid out to customers and the premium didn't cover that. So it wasn't profitable overall. Insurance companies had trouble really understanding the risk.
- [00:26]
B
How building a company in the US is influencing you as a founder was
- [00:30]
A
an extremely high level of ambition and then a very strong drive for excellence. So that really raises the bar of how you think about problems and how you think about roles and how you build companies.
- [00:44]
B
Vincent, thank you so much for coming. Maybe you could start with shortly introducing yourself and the company.
- [00:51]
A
Yeah, thank you for having me, Dan. Yeah, very glad to be here. I'm one of the founders of Baobab, which is a cyber insurance provider and provider of different type of insurance products for the broader digital risk ecosystem. So there's cyber E crime but also tech errors in omission insurance. So software companies fail. We ensure them if they have liabilities towards their customers. That's what we do in a nutshell. So it's an insurance provider, but we combine it with risk management software because we are one of a new kind of insurance providers that don't only insure against the risk, but also tries to prevent the risk from happening in the first place.
- [01:42]
B
And this what sets you apart?
- [01:44]
A
Yes, that's one thing that sets us apart. But of course it's important how we do it and how effective it is. And I think the effectiveness of that is really what we measure success by.
- [01:54]
B
Is this USP was something that you were going for initially when you were about to found the company or what was exactly that market gap that you identified, you know, which sort of draw users out to found the company?
- [02:07]
A
Yeah. So there were, there were basically three pain points that we identified. One was the one we already talked about. So the lack of protective and resilience enhancing products that accompany the insurance contract. And so that's, that's one thing, that's a clear customer pain point. Another one is these insurance products were not profitable. So let's take Cyber as an example, which is our biggest insurance product. There were a lot of losses being paid out to customers and the premium didn't cover that. So it wasn't profitable overall across Europe, but actually worldwide. And the reason for that was that the insurance companies had trouble in really understanding the risk. And so when we said, okay, we can Combine the first pain point with actually preventing things from happening with the second one of actually making it profitable, but doing it in a way that actually helps the customer because they don't want the thing to happen in the first place. Right. So but they want to have this protection and the insurance in case the protection fails. So that was the second one, actually making it profitable and also understanding which risks to insure and which not to insure and at what price. And then the third pain point we identified was that the distribution of the go to market didn't really work so well. So insurance in our markets of B2B insurance predominantly sold by insurance brokers. And there are some good reasons why that's the case. So we believe in that channel and working with insurance brokers and empowering them. But a lot of these insurance brokers were the average insurance brokers, 55 years old. They have more legal and business expertise and insurance expertise, therefore on the contractual level, but not so much on the technical level, which of course is important in the lines that we are, that we're active in and we want to equip them with that knowledge and help them actually make the sale successful. And we saw that they were oftentimes sort of shying away of really sort of going after the sale because they, they lacked the understanding of basically how to make it happen on a technical level.
- [04:26]
B
So you educate your sellers on the technical aspect, but you're still working with those 50 year old insurance brokers or.
- [04:36]
A
Yes, I mean we work with insurance brokers of all ages, so we don't, don't discriminate there. But. And of course also across expertise levels. Right. So for some insurance programs, we work with the first cyber insurance policy they've sold to a customer. But of course we're also working with the ones that are very sophisticated, that have large teams that also consult large customers on how to best place the cyber risk. But we have basically different approaches of working with those partners.
- [05:10]
B
Do you remember your first customer?
- [05:12]
A
Of course. I think every entrepreneur remembers the first customer. I think it's a funny thing that that's oftentimes the case we're not allowed to name customers, but I can say it's a law firm from Berlin that was one of our first customers. Medium, smaller, like a smaller partnership. Yeah.
- [05:30]
B
And speaking of partners and customers, you're currently moving towards bigger partners. How does that, what does it change for you internally at baobab? Like what did you have to adjust or change in order to go in that direction? And also how do you Win their trust.
- [05:52]
A
It's interesting that you mentioned that. So first of all, of course we are moving up market, of course. So we started insuring companies from zero revenues already starting at zero, up to 100 million in revenue. So already large company. Right, 100 million revenue. But we then said, of course, let's maybe push the boundary and push the ceiling up a bit more. And then we first moved this, this is for cyber, now moved it to 500 million in revenue and now to 1 billion. And of course the customers are different and also the distribution approach varies a bit, not so fundamentally. There's always a broker in the middle and the broker really has the trust of the customer to manage the insurance of the company on their behalf. And there's a good reason for that because it's basically sort of this idea of having a one stop shop for insurance and risk and so forth across lines. Because it's not just about cyber, it's about directs and offices, insurance and liability for factory and so forth. So you kind of want to have that insurance aspect with, with one or two brokers that, that you work with and then the broker picks the provider and the broker actually does that in a, in a diligent way in, in Germany. Because contrary to the, to the image that brokers sometimes have. Yeah. Or that, that insurance sales people sometimes have, this is a different type of broker because it's not the type of broker that sort of knocks on your door and tries to sell his life insurance, but it's really an expert in risk management for complex commercial risks. So those are people who understand what are the risks in a factory with fire, but also when it comes to the liability of the management board and so on. Right. And they have built up this expertise over decades and now basically there's this new area, still new to some extent of course, which is cyber comes to that. Right. And they understand their customers very well, they understand their needs very well and they increasingly also understand cyber very well. And the larger the customers are, the more expertise is also on the buyer side. Right. So quite large companies oftentimes have professional insurance buyers. So these are basically insurance experts. Sometimes they've worked at a brokerage firm before and they know exactly every clause. Right. And they, they negotiate with the broker and the insurance on certain aspects of the insurance and on how it's structured and how the deductibles are set up and what the limits should exactly be. And that happened very much in the larger space. So that is something where we basically brought on more expertise on how to do this. And also we had to create the product in a bit more flexible way to do this. To also give brokers different clauses that they want for their customers. So that's something that we did. Whereas in the smaller, for the smaller clients, what basically counts is to have a comprehensive product at a good price that you can really sell in a fast process. So that is basically the difference in how it has evolved.
- [09:24]
B
And also set them up, set the whole security setup probably as well, since they most probably don't have it in place.
- [09:32]
A
Yes, but that is something that is basically true for all sizes. Right. So that is something that we did from the very beginning. So we, we monitor the attack surface of the companies that we insure. So think of it as you're looking at the risk from the outside in and you basically see an attack surface that is of course happening in a digital world. So this is your website. These are sort of APIs and ports that are exposed and so forth. Right. So that's anything that you can see, email addresses, DNS records and so forth. But also, for example, data that has leaked from the company. So that is your surface area. So think of it that way. And then we take that surface area and we basically map it digitally with technology that we've built. So you can see that passwords have leaked. Right. So we are the leaders in actually retrieving leaked information from customers or potential customers. And a lot of our customers are actually surprised by what we find and how much there is out there already about them passwords. And this is a good example. That's one thing that we do. But also we look at all of the web facing it assets of the company. And that is happening of course, not in a way that we just count it, we just map it and say, okay, it's that big or that's a little bit what the shape is. But we of course use artificial intelligence to basically find correlations with and patterns across other companies that have been attacked. Right. And then we can map out the attack vector that that would be the most likely attack vector for that company. We can map it in our risk model to the operations of the company. So one thing is of course, how likely can you get in and then how much damage can you cause when you are in? And for that you actually need to understand the business itself and also how that can trigger the insurance contract. And that's basically what our technology does up front, the reconnaissance and then also the risk model behind it. So it's one thing really that then scores that and Actually makes it measurable. And then the good thing about this is not only, of course, that we can give very accurate insurance, but we make all of that information available to the customer. Right. So we tell them, look, hey, this is what we found. And now you can actually do something about it and improve your risk and
- [12:08]
B
to not be attacked when doing this. Scannings for patterns. Have you ever been surprised about something, especially when you analyze, well, companies that appear to be, well run all the time.
- [12:25]
A
That is basically the nature of the job. So it's happening all the time I'm looking for. Because of course, it's a bit of a tricky subject. But to give you an example, what we oftentimes find is information that is just openly accessible. Databases that are openly accessible from the web. Right. So we are sometimes able to. We don't do it, but it's sometimes possible. Right. To download the whole customer database. Right. And that is, of course, you know, there's basically no guard to the outside. So that, that's one thing. We oftentimes see credentials clearly written in the code. Right. So the developer just leaving the credentials there sometimes do that in a staging environment. They keep their password above where they need to type it in when they're testing an API and then they just deploy it and they don't look for it. So that's sometimes. We often find it's also very critical because a lot of security scanners don't find this because they only look for categorized vulnerabilities and developer leaving something somewhere is not categorized in that sense. So that's something we find very, very often. We found webcams of a whole factory and offices that are just openly accessible security cameras. Right. So things like that, so things that we then take these things and let the customer know right away and they, and we can see that they act very rapidly on it and, and remove these things. Yeah.
- [14:10]
B
So you act sort of as a consultant here. You leave it up to them to then clean up the, the mess.
- [14:16]
A
Yeah, sure. I mean, we, we don't. I wouldn't even say consultant because a consultant usually charges for it. Right. So we, we basically. So I think we're in a quite unique position, right, because we have like the interest of a consultant is to bill you by hours. Right. That's the incentive that a consultant has. Our incentive is that we don't have to pay out if you get hacked. Right. So that is, I think, a great, a great incentive mechanism. So we have no, we have no business in going back to customers and telling them about Stuff that is not important. Right. It's only about really important stuff, and that really helps the customer understand. Okay. Oh, this is actually something I should act upon totally.
- [15:05]
B
It is a win, win situation for. For you both. All right. I know that before founding Baobab, you. You. You found another company, which is Insuretech, which was then acquired. And usually people, after experiencing a successful exit, take a break, and you decided to go after another project and rather not a simple one. Also in the European scene, unlike with your former company. Why.
- [15:44]
A
Why I didn't take a break or why.
- [15:46]
B
Both. Why didn't you take a break and why did you decide to then move to the European space and build something here?
- [15:53]
A
Yeah, so the decision to move to Europe was basically a sort of personal decision. Right. So it was in a stage of my life where I said, okay. I had lived in San Francisco in the Bay Area then for five to six years, and, you know, you get to a point then where we think, hey, do you actually want to now become an American and have to sort of go all in, sort of take the path to citizenship and marry, have children there and then also, you know, have your grandchildren and all that. And I just didn't see myself, you know, with 60 in sort of the suburbs, watching the Super Bowl, I just didn't. Didn't occur to me that that was. That was my. My path. But I loved the US So of course I spent a lot of time there. Right. So it's not something that I said, okay. It was. It was great time, but it's okay. It was for a specific time in my life. And then, of course, I had founded the company. Right. So that doesn't make it so trivial about how to make decisions. But I, I thought, okay, there's never. There's never a good time to. To leave something behind. But I did it at a time where. And this was important to me where I thought that everything's in a good shape. Yeah. So I've, of course, had four co founders, so there were folks that were running the ship at the time and doing it very well, and the company was doing phenomenal at the time. Right. So it was like one year or so after Covid started. So at the beginning was like, oh, my God, what's happening? You know, you remember that time? And then we've gotten through that sort of the operating mode within Covid and said, okay, and when that was working and the numbers were good and said, okay, maybe this is a good time. So, and then I decided to come back and then yeah, well, the reason why I didn't take a break is a bit more trivial. There wasn't really anything to do. Right. Because it was Covid. Remember? Like you cannot, you cannot travel, you cannot do anything. So I did take a bit of a break. That's not sort of. I started right away doing something again, but. But you know, I was getting a bit bored so I had to find something again.
- [18:15]
B
I see. What are the learnings that you, you know, that are shaping the way you are today from that experience in the us? Like how building a company in the US is influencing you as a founder? Now?
- [18:30]
A
It's hard for me to say in a sense because it was the first time I had founded a company and it was then happened to be in the US Right.
- [18:37]
B
How did that happen? Actually
- [18:40]
A
it, it happened because my co founders and I, we saw a gap in the market. You probably know all these insurance comparison platforms like you have in Germany, you have check 24 and then you have compare the market in the UK and so forth. The US didn't have that. Right. So we thought, okay, maybe do it the other way around if we bring actually some innovation from Europe to the US and that worked out well. What I think was US, or maybe even Silicon Valley specific was an extremely high level of ambition and then a very strong drive for excellence. So what that means practically is if you're operating in a place with such a high talent density, like in San Francisco or the Bay Area, you meet every day, you meet people who are so amazing at something and who really belong to the best in the world. May it be artificial intelligence, online marketing, whatever. Right. So. And that really raises the bar of how you think about problems and how you think about roles and how you, how you build companies. Because these people are very good at challenging the status quo all the time and are always sort of setting up a high bar. But it also keeps you humble. Right. As a founder, you say, okay. And it really felt a little bit like I didn't have a lot of experience. I hadn't worked for 20 years at Google and was a VP or something like that. So I really had. You really have the feeling that you are applying to the employees to please work for you. Right. Because they have all the choice. So there's really sort of this, call it war, but whatever. This competition for talent is something that was very, very apparent and I think also made the company much better. And this is also something where I think today we're also looking to bring the best talent to what we do and I think it's a unique thing in our current company at Baobab because the talent pools that we have to draw from are basically the opposite ends of sort of culturally, in a sense. Right. Of people. Right. So you have the cyber security world which is, you know, fast moving, very technical and you have the insurance world which is conservative in the best sense almost. Right. So in a sense of sort of maybe sustainable also, but, but also more sort of legal backgrounds, local or national of course, as legal topics are. Right. Where you have relations with customers for a couple of decades and then you have the cyber security world where the world looks completely different compared to three years ago. And bringing people from both sides together to work with the same problem, I think is something that is quite hard. And I think that's also our advantage, maybe also something that I focus a lot from my entrepreneurial experience in the US to, to be able to make that work. Because I don't think that, I think that is not something that like even the largest competitors that we have, like the likes of Alianz, like the largest insurance in the world, I don't think they are, they can do that. I don't think they're particularly good at it. Right. To, to attract people from, from, from these different angles. They can inter. Attract people in their backyard insurance. Right. And also I don't think that let's take the crowd strikes of the world can attract people from this conservative insurance world so well and basically create a culture that works for both equally.
- [22:44]
B
Yeah, it does shape an interesting cultural environment at Baobab. You mentioned the war you're waging. How exactly do you wage that war for talent? What makes you unique as an employer brand?
- [22:59]
A
Yeah, look, I mean at the end of the day it's really institutionalizing processes of hiring and also retaining and developing talent. Right. So and then there are certain best practices of how that, how that can work. Right. So I think in the outreach to people is quite important in the sense of always explaining what you stand for and basically broadcast your vision, but then also specifically targeting people and saying hey you, have you thought about how you could fit in and can we talk about that? Right. So basically combining this high level vision communication with actually very specific discussions about opportunities and so forth for individual people. So I think that's what makes talent attraction very good. And then retention and also development is something that we basically have very number step driven approach. So we measure the satisfaction, we measure how we communicate in the company. So we very data driven approach around that to make sure that that we don't only listen to those who speak loudest, but to get an accurate picture of what is going on and then also try to chart individual development path. And also over here, I think compared to maybe San Francisco or so sometimes it is also about explaining the startup employment thing a little bit more in the US that wasn't really so much needed anymore. Right. But here I think, especially if you're hiring from conservative industries, having a good way of basically talking someone through who has spent two, three, four years at a large insurance company, for example, or a large brokerage firm and say, okay, how does this next phase of working for an insurance provider like us, like a tech company, which we are at the end of the day, actually fit into your career progression? I think is quite important.
- [25:32]
B
And what are the qualities that you are on the lookout for when hiring what let's say candidate should offer to fit in at Baobab?
- [25:43]
A
So I think there's a, there's, there's a couple of those, right. So of course it depends so generalizing it a little bit because we don't want to talk about individual roles, but more so of course on a culture on that. I think what is very, very important for us is mission alignment is probably the most important one. Right. So we have to work with people who actually want to move this mission that I just talked about briefly in the beginning forward and where it matches to them. Right? And that is true for every role, Right. So it doesn't have to be only in strategic roles, but it has to be also in supporting roles or in HR roles and so forth. Right. Because that all is driving the mission forward and the alignment to the mission. Then we're looking for a certain level of grit, right. So tenacity grid is important of actually getting, getting things done and a way to also a willingness to engage at every, every hierarchy level. Right. So that means we have this value. It's called the obligation to descend. It's borrowed from, from some other company that, but it's, it's actually very true. And, and that means that every, every employee has the obligation, not just the right to descend if they have a different opinion and they can actually articulate it and, and substantiate it. Right. So I think that is quite, quite important one. So it's not so much that you can say your opinion if you want to, but you have to and you have to really help the company in this way of finding the right path with, with, with stating your opinion and then also committing to the mission. So that's super important. And then of course, we're also looking for folks that we just connect with and then we like to work with in the sense that we like to come across rather humble and not so
- [27:53]
B
much
- [27:55]
A
just talking about things, but actually more delivering, but doing it also in an atmosphere that's actually nice and where people want to work. Because at the end of the day, you also spend a lot of time at work. Right. So it should be fun at the end.
- [28:08]
B
I love the point about employees speaking up. I guess that's one of the underrated sources of truth because people usually working in the operations have so much to share and I don't know, speaking to them, doing shadowings, asking for their opinions is a great practice. And finally, I'm really curious about, you know, what are you personally looking for in terms of building at Baobab this year? Is there something that you're really excited about?
- [28:38]
A
Yeah, so there's, there's tons of things that, that we're excited about. So we just took a big step of becoming a more pan European company and we did that technically end of December. But, you know, this is really the year where that. Where that fully comes. Comes to.
- [28:57]
B
Congratulations.
- [28:58]
A
It comes to life. Yeah. Thank you. So we're so after we had already expanded to Austria, we now expanded to Netherlands and Belgium and very optimistic for what we have to offer there. But that's, of course, only a step in the way of really becoming a pan European company and broadening the vision. So that's one thing. And then we're going much deeper in the cybersecurity realm. So we have built a suite of products now that. Where we can manage the cyber security of companies not only from the outside in, but also in a more involved way by getting data feeds from the company out of sort of their network, but also where we. We have deepened also our dark web research to retrieve leaked credentials and so on. If we filled a comprehensive cybersecurity product suite that we'll announce in, in a couple of months, we'll announce a bit more regarding that. And that is basically what I'm most excited about this year.
- [30:07]
B
All right, then we're staying tuned for the new product and announcements from Bob up. Vincent, thank you so much. It was a blast.
- [30:15]
A
Thank you. Thank you for having me, Dan.