Loading summary
Transcript17 lines
- [00:04]
A
Hey, you with Casey Ellis with the Risky Business podcast. Today we're talking to the one and only Harun mia founder and CEO of Thinkst Things Make Incredible Deception and Detection products. They've, they've been out there doing the, the canary thing since way before it was cool. And, you know, Harun is an entrepreneur, is actually someone that I've, I've really admired and learned a lot from, from an execution standpoint on all sorts of different levels over the years. I'm always excited to get together, but particularly keen to, to get into some of the stuff we're going to talk about today. So, yeah, Harun, I saw you, you're chatting on, on X on Twitter, because it will forever be Twitter, it's not X. And I'll die on that hill. Just about, you know, some of the stuff that Robert Emily's been talking about and obviously there's a ton sort of happening around him and around them, but also Eric Rees's book Incorruptible. And it's just, you know, it's a really interesting thread to pull, I think. A really interesting conversation for you and I to have, you know, as entrepreneurs who've taken kind of different approaches, you know, in different ways, but ultimately ended up with levels of success. Right. Especially with everyone who's trying to jump into this stuff right now. So, yeah, let's go into that. Like, what's on your mind about that? I guess. What are you thinking? The world needs to hear at this point.
- [01:23]
B
So Rob Lee was interesting because obviously he built Dragos and Dragos have just gone through this massive thing, but something I didn't know about his journey, so he was on a podcast and he spoke about the effort he went through to initially stay out of the Valley, so not raise money from Silicon Valley. And a big part of his intention or stated intention was that he was trying to build a hundred year company. And so he deliberately only raised from people who followed this mission. And he goes through a few things he did which are very counterintuitive, including at times telling his board, look, we don't care about Metric X. And I think it's useful for founders to hear that they do have that power, that if you choose your board well and run your board, you can say to them, hey, listen, we don't think this matters because here's what we want to focus on. And none of this as an excuse to not do the work or not be accountable, but just choosing what you want to be accountable for, like saying, listen, this is what we're going to aim for as a business. And yeah, I didn't know this about me. Like, obviously I followed his stuff like you have for years, and he's done great work. Like, he's generally a nice guy, but it was interesting to hear that side of his company building. And it's an interesting contrast to us because we haven't raised, and he's obviously raised a bajillion dollars. But saying you can still raise money and keep mission as the central part of your company, I think is something important for founders in general, but cybersecurity founders to keep in mind. And for me it's time is because like I mentioned, I just read this Eric Rees book, Incorruptible. And if there's one thing that future founders take away from this podcast, like, they should go get this book.
- [03:26]
A
Go read that book.
- [03:27]
B
Yeah. So Eric Reese, everyone's read or quoted the Lean Startup, like his MVP ideas have like dominated Silicon Valley. And he's put out a book now. And his stated intention is, he says he's seen all these companies that have built up and then get turned into this Frankenstein thing that just exists to make money and something I didn't know. One of the things he goes after, he says, like, listen, part of the problem is that there was a time when you formed a company, you gave it what you intended to do with the company. He says, and what this has translated to these days is when you're forming your company, you go, it's to do business. And the stated intention of the company just becomes shareholder primacy. So he cites this example of imagine the worst company that you can think of. And he leaves it as an exercise to the reader. So he says if you imagine super tobacco company that exists just, just to give people cancer, like for no other reason, he says, and if they offer to buy your company for $10 more than the nearest offer, he goes, well, then it's your directors, it's their responsibility, their fiduciary responsibility to get the most money for that purchase, to consider that deal. Yeah, exactly. And he says, like many years ago, like when people came after the railroads, like the railroad companies went, this doesn't help us in our core mission of serving the public. And so we won't take this deal. And, and one of the main things from his book is for one thing, I think we all like books that confirm our own biases. And, and when we built things like, like we had a, we had very few mission statement things, but, but one of the, the things we had really early on was saying, listen, what if we don't do this just for raising shareholder value thing? What if we saw the community as stakeholders? What if we saw being good to our people as stakeholders? And it's not to say we don't like money, like we've been profitable from day one, but just the realization that there's a lot more to this ecosystem. Like what about being good Internet citizens? And the thing I like about the book, I'll stop rambling, but, but, but I really like it. One of the, the main things that I like about the book is just his validation that other big companies have done this, that, that there are companies all over the world that have built for, let's make money, but let's serve a mission. Like, like let's invent the future, let's. And, and I think more cybersecurity companies should be doing the same thing.
- [06:28]
A
Yeah, I could not agree with that more. You know, frankly, almost violently at this point, when you see, you know, kind of what's happening out there on the Internet from an offense versus defense standpoint, you go walk the floor at your, you know, your local kind of trade show focused cybersecurity event. You know, I do think that there are a lot of people, um, actually the reason why I think this conversation is really important to have right now is that there are a lot of people that for all sorts of different reasons are looking to get into the game. And like one of those reasons is, okay, there's a ton of money in this, you can raise a bunch, you can sell to folk. You know, there's, it is a, you know, at this point in history a fairly cash rich kind of industry to get into. But then on the other hand of it, you've got like one of the things I love right now is all of these practitioners that have got incredibly deep problem solution empathy from the time on the coal face, who aren't builders but now have the ability to at least prototype or get their kind of ideas to the point where they can communicate them to others through AI assisted coding and stuff like that. So there's all these different motivations and reasons to jump into the mix. I think the other thing is I couldn't agree more in terms of the, the gap between user value versus shareholder value. To me I've always thought about it and actually had to walk the line as a venture backed company with a board between this belief that user value comes first and then shareholder value logically precedes that because it's often not how it actually plays out. In reality, and I think as an organization gets bigger, those two missions can naturally diverge. If you haven't put your mission on your keystone and kind of baked it into your product and your team and all those other things.
- [08:20]
B
Right, it's exactly right. And the thing that REEC focuses on and like for us, there's a bunch of things like this that have happened over the years, right? And like I've quoted other stuff. So we build, we sell Canary, and we've always had Canary tokens completely free. And it's one of those obvious places where VCs will often ask like, well, why do you do this? And we've got hundreds of thousands of active users on it over the years. It's been used millions of times. And one of the things is we've just not have to charge for that. It adds value. Lots of people use it. Obviously there's some goodness for us. But like that there's a bunch of things that just say, well, you don't have to gouge your users at all. Like, like there's a way that you can be nice. And one of the things that, that Reese talks about in his book that I think is important for people to figure out is there's a bunch of like cheap sugar highs that you get pushed for when you're building a company when, when people are thinking quarter by quarter. And if you can just not get addicted to those highs, like, like good things can come out. One of the stupid things, and this is not like a promise forever for us, but like we've been running Canary for 10 years and we've never raised our prices. Right now we've got a few thousand customers. If we just raised our prices 10%, like, like just the change to our bottom line at this point would be huge. Right? 10% compounding every year. And people almost expect it in their contracts. Like if you're run a annual recurring thing, you expect some. And, and we've just not had to. And so we don't. And again, it's one of those things where you can get used to that high that says let's just take this money. Or we can say, well now we've got to find another way to make more money. We've got to find more customers.
- [10:28]
A
Yeah, no, yeah, exactly. So if we can just double click on that for a second because I like, I love that I do think, you know what you guys have done, like there's, there's different kind of expressions of that and this is a, this is a really visible one. But Then this is, I think, broader idea of the social contract that you establish with your customers at the outset. And it's like, okay, you know, you've got to be very deliberate and very mindful about, you know, any of that that you ever want to change in the future. Because, like, you can change. I could see what the whole pricing thing, like macroeconomics, for example, could. Could kind of force that issue at some point in the future or whatever else. Right. But. But this idea of, like, so how. How. How did you. Like, how do you guys actually do that? Just, like, putting it into practice for. For folks that are like, oh, that's. That all sounds lovely, but, like, how the hell do I actually make that work?
- [11:17]
B
Yeah, it's. It's a good question. And like, I say, like, not changing our prices was never a core promise that we make. So. So as a business, we focus, like, even internally, we talk a lot about promises. And so this goes through our design. It's like, if early on we find that the product is noisy for something, it's like, listen, we promised we wouldn't be noisy. Everyone fixes this. Like, everyone in the company knows we made this promise. We won't do that. Our price was never a promise. So someday I can totally see us having to change the price. It's just that we chose a price that we thought was fair, and we still think that's a fair price. And the annual increase is almost a side trick that. Because people are expecting it, we can, and we just don't think we have to right now. And until now, we've been able to offset that with growth. Like, we get more customers, we get bigger deals. And so again, it's just a question of, well, there is this easy sugar rush we can take. We could just tick this box and get that extra 10% per year, but we don't have to, and we still think the price is fair. And Eric Reese in the book talks about being so far from America, even. We know the story of, like, Costco, who've kept their hot dog at $1.50 forever. And there's this part where, like, the co founder gets told, like, listen, it's reasonable. Like, people will know you can charge a little more. And he goes like, I'll kill you if you change the price of that hot dog. Like, keep it $1.50. And what's interesting in the story is that they then end up having to do a lot. Like, they end up becoming hot dog manufacturers to keep that price $1.
- [13:10]
A
So you got to optimize your hot dog supply chain at that point.
- [13:12]
B
Right, exactly right. And in the same way, you end up doing different things in business to not gouge your customers. And those things build you for the long term. Because now you've got to invent differently and build differently and treat your staff differently. And I've mentioned before that lots of things in business are hard. Like, you and I have been doing this long enough to know, like, it's not just a walk in the park, but it's going to be hard anyway. You might as well choose the hard
- [13:44]
A
that says, yeah, choose your hard.
- [13:45]
B
Yeah, let's make these promises and keep these promises.
- [13:49]
A
I use that constantly, by the way. I got that one from you as a way to frame that idea and I use it all the time because. Yeah, I mean, completely agree. I think it's a good life principle too. But actually trying to figure out how to wrap that into the core of how you're building and growing. I mean, there's so much. It's interesting because there's so much. I think we talked about this last time we caught up on this pod. The whole thingst is built on love, which can sound kind of trite when you look at it on its face, but when you actually, you know, when you sort of think about what that means and what that implies, it's like, here are the core kind of mission principles and operating principles that we go off that are founded on, you know, beliefs that we have around, like the outcome that we want for our customers, not just for us. And I think that goes to the user versus shareholder thing. Right? Yeah. And then you just stick to it. Right. It was, it was interesting. I was literally catching up. I was chatting with, with Dowd actually a couple of days back. And you came up in conversation just around the deception market. Because I do think the other thing to call out for the new founders in particular is that there is definitely the burn brightly and burnout kind of version of things. I remember when you guys kicked off and there was definitely a lot of rumble around deception in the market at the time. And a lot of companies that got funded, most of them didn't work out or they had at least some sort of mediocre outcome. But what I saw you guys do is just relentlessly focus on this idea that this is sucky to deploy, sucky to maintain. Let's design the suck out of it and just make sure that we're focusing on the benefit for the user and keep this thing out of the way until it needs to chirp and just lather, rinse, repeat on that the entire time. Which is when you've got 100 million bucks in the bank and you're told to go off and conquer the world, it's very easy to just sort of throw features on top. You can create drift, I guess, in your core design thesis more easily. With more money, I guess, is really what I'm calling out there.
- [15:52]
B
It's exactly right. And I think the idea that more money helps you shotgun everything, but quite often not for focus long enough to do something well. And again, like I've spoken before, like I've been an Apple fanboy for years. And one of the things you see when you look at Apple is a company that is worth a trillion in market cap, but still hasn't changed the Apple tv because they haven't cracked past that thing yet. And when they have, they'll sell it to everyone. But for now they're able to focus and deliver this level of goodness with it. And that concept I think is it's hard for people to get used to, but we see it all the time, right? When you go to any of the trade shows, you go to rsa, you go to Black Hat and there's this company with the massive booth with a bajillion people and you know that their Mac product is an absolute sham. And it's like, listen, man, why don't you pay 10 good engineers and keep the promises you made when you sold that product Instead of the 500 people manning this booth that are just doing marketing for you? And you see this divergence of what cells and what looks good versus what keeps the promises that you're actually making. And this concept that says make a set of promises, find people who find those promises useful and then deliver on those promises, it's crazily undervalued. It's like you don't even have to sell to everybody. Then there's just a set of people who want those promises.
- [17:47]
A
I've got a post and I know we're going to hit up on time here so we can just touch on this a little bit. But my first job out of being on the technical coalface, moving into solutions, architecture and sales, was this Texan wildcatter who moved out to Australia and started an information security company. Like most of the time when I'm trotting out bumper sticker aphorisms, you know, a lot of the time they actually come from, from him back in the day. But one of the things that he taught me very early in my sales career as I was sort of wrestling with this idea of, like, am I becoming a white hat sellout? And all other stuff that you have to go through. At that point, he basically said, like, never sell security to people that don't care. Like, let the bad guys teach them right. Which is a really extreme way of framing it. And he was kind of like that. But what I took away from that was this idea of choosing your heart in the form of, like, the ICPs that you go after as a founder. It's like, okay, I'm going to be the best. I give this advice all the time. It's like, narrow what you do down to the things that you can be best in the world at, and then find the people that care and then start there. Don't go out and try to, like, cut down the tree with the wrong side of the axe. I do think. I do think that funding does create, it does increase. There's always a temptation to go beyond that. But I do think that funding can kind of increase that pressure, if that makes sense. At which point, going back to Rob's conversation, it becomes more an issue of will and board structure and who you actually end up partnering up with. Right?
- [19:18]
B
Yeah, totally. And again, I think to wrap it up, like, Rob shows that you can keep your mission at the heart while you raise even Reece. Like, here's this snippet that I tweeted or X'd where he's actually talking there about raising venture capital. And he says, like, listen, before you get used to this, like, explore, explore the possibilities. And he's not anti raising. Like, he's helped a ton of companies go the VC route. He's just saying you can still keep your mission at the center of things because ultimately, even with VCs, they want a successful company. It's just that a lot of people have now been coaxed into thinking that there's one model for successful company. And mainly, again, if there's takeaways from this talk, the one is, people should go read that book. I think it's great. But mainly it's just that there's another way where you still end up making money. Like I said, we're not complete hippies. We like money and we like the things that it can buy us. But you can build a company that matters, A company that lasts, that actually has customers that don't hate you and works towards a different mission.
- [20:43]
A
That's awesome. All right, well, as always, it's a pleasure to catch up, mate. That definitely did not disappoint. Thank you so much for your time. Thanks for calling this out, too. Like I said, it's a timely juncture to have this conversation and get it back out there, especially as we all head down into the desert next month. All right, so, everyone, this has been Haroun Meer from thinkst. You're all listening to to Casey Ellis on the Risky Business podcast. Thank you very much. Bye.