Risk Grustlers EP 5 | De* Romanticizing the Cybersecurity Complexity

The fifth episode of our podcast Risk Grustlers promises to be exciting, thanks to the unmatched energy of Ross Haleliuk, the Head of Product at LimaCharlie, a cybersecurity startup, and the author of the blog Venture in Security.

Ross provides a captivating narrative of his unique and unexpected journey into the realm of cybersecurity. As someone who initially hesitated to enter the field due to its complexity and jargon, Ross sheds light on the challenges that newcomers, even from tech backgrounds, might face.

He gives useful advice to founders aiming to connect with Chief Information Security Officers (CISOs) to effectively tailor their solutions to cater to specific customer segments.

Ross also delves into the evolving synergy between cybersecurity services and products, offering insights into the emerging convergence that seeks to bridge the gap between automation and the irreplaceable expertise of human decision-making.

All this and much, much more is discussed in his engaging conversation with our CEO Aayush Ghosh Choudhury. You don't want to miss this one!

Watch the complete podcast here

https://www.youtube.com/watch?v=9Dtez0PisaI

Keep reading for some interesting highlights from the episode.

Aayush: What led you to the security space?

Ross: My journey into cybersecurity is a bit unique, yet I believe it's more common than people admit. I've been a tech guy for over a decade, working in various fields like e-commerce, retail, wholesale, and financial technology.

Eventually, a friend approached me about joining their cybersecurity startup to lead the product side. The team and opportunity were fantastic. Excited but unfamiliar with cybersecurity, I started researching. Initially, I hesitated and told my friend I wouldn't join.

This story comes up whenever someone asks how I got into cybersecurity. I've always considered myself a generalist, focusing on aspects like market strategy, partnerships, sales, and operations, not coding. The switch to cybersecurity was daunting due to the complexity and jargon. Unlike my previous roles, understanding cybersecurity products proved perplexing due to the myriad abbreviations.

For a product person like me, grasping the roles of different cybersecurity tools was challenging. Plus, getting hands-on experience was tough due to the barriers in accessing the tools. There was also significant overlap between products, blurring the lines between categories.

All these hurdles initially made me decline the offer. But, history shows that I eventually changed my mind. Now, after years, I'm here, deep in the world of cybersecurity.

Aayush: What led you to start blogging about cybersecurity? What was the journey like building Venture in Security?

Ross: When I stepped into cybersecurity, I knew I had to catch up fast. Unlike folks with years of experience, I had to quickly grasp the basics and industry dynamics. To do that, I dove into reading and attending events, absorbing as much as I could.

Cybersecurity, being highly tech-driven, had a ton of technical content. If you're into security engineering, you could find communities and tools to learn from. However, the business side lacked comprehensive resources. Few people truly understood the full industry picture, not due to their intelligence, but because day-to-day operations rarely leave time for that big picture thinking.

Understanding the ecosystem proved tough. The cybersecurity landscape is intricate, unlike any other. For instance, unlike most industries, the movement between private and public sectors is incredibly fluid. People come from various backgrounds - law enforcement, compliance, software engineering, incident response, law, and more. This diversity makes getting a holistic grasp challenging.

But I needed to catch up quickly, so I connected with people, attended events, and read extensively. I distilled my learning into simplified notes for myself. Initially, I didn't plan to start a blog, but I shared an article which garnered positive responses. I continued writing and gained subscribers, and that's how my blog started.

The principle of simplicity applies beyond cybersecurity. Whether it's starting a company or a project, the approach remains the same. Identify an idea, try it out, iterate if needed. Just like my blog. I started with a simple idea, saw interest, adapted based on feedback, and kept going.

Aayush: As an angel investor and industry insider, how do you recommend striking a balance between leveraging experience and avoiding tunnel vision, while also avoiding the challenges of a lack of expertise when starting a cybersecurity startup?

Ross: In the world of cybersecurity startups, there's a variety of problems to tackle. In any industry, successful founders often share certain qualities. When you think about the consumer space, anyone can identify problems and attempt solutions. Yet, in B2B, understanding business dynamics, decision-making, and purchasing complexities is crucial. Cybersecurity's technical nature makes it hard for fresh graduates to start a security company. Likewise, decades of solely cybersecurity experience might limit innovation.

It's about striking a balance. Founders need a mix of industry experience, innovative thinking, and humility. The best founders are open to seeking advice and mentoring. The founder pipeline is narrow, resulting in many repeat founders, especially in cybersecurity. Familiarity breeds trust, vital in an industry where relationships play a massive role in success.

Aayush: As a founder, what would be the worst possible advice you could give me that would completely sabotage my chances of getting a CISO's attention?

Ross: When founders aim to connect with CISOs, they should dive deeper into their problem-solving context. Too often, they generalize issues for "enterprise businesses." To succeed, it's crucial to identify the personas and customer segments most interested in their solutions. For instance, it might be CISOs who recently started their roles or companies with small IT teams transitioning into security.

The key is understanding the buying journey specific to your solution. Map out this journey, involving stakeholders and decision-makers. Not everyone has equal influence. If your solution requires technical expertise, target companies with relevant roles. Experiment with different approaches, like attending conferences where your target audience is present.

Don't just aim for CISOs their time is limited. Identify the right people within the organization to champion your solution. Perhaps it's someone from HR or finance, depending on your value proposition. The idea is to align your outreach with the customer's needs and interests, rather than relying on a broad "enterprise" approach.

Aayush: You'd written a blog that discussed how at some point in time there would be some degree of convergence between cybersecurity services companies and cybersecurity products companies. Where do you see this convergence happening and how should companies think about it?

Ross: When it comes to services, providers want to streamline and automate to improve their economics. It's like if they can make their processes predictable and efficient, it boosts their margins and scalability. If they're eyeing venture capital funding, having a product component becomes almost necessary due to better potential returns.

Customers, even those using services, want visibility into what's happening in their environment. They're looking for a way to track progress and stats, like on a dashboard. This visibility trend is pushing service providers to emphasize products and simplify processes.

For service providers, many have a good customer base, but they often rely on manual work. So instead of hiring more people, they're seeking to automate tasks and offer more streamlined experiences, like products. And on the flip side, customers love to compare costs, right? If a service isn't priced per unit, like per employee, it's tough for customers to compare and make decisions. By offering clear pricing, it's easier for companies to understand costs as they grow.

Now, on the product side, companies are realizing they're missing out if they don't offer services alongside. They're sitting on a revenue opportunity. Imagine if you're a big security product provider. You have customers who want to upgrade for more attention and support.

Another thing is that while automation and AI are great, they can't solve everything. Mature security teams get this. They know that a customized approach is essential. Plus, there's a growing recognition that some problems are just too complex for pure automation. There's a need for human judgment.

Lastly, the need for services is crucial in areas like incident response. You can't automate every aspect of handling incidents effectively. It's all about finding that balance between what products can do and where human expertise shines.

So, this blending of products and services addresses the need for efficiency, customization, and holistic problem-solving in the cybersecurity landscape.

Aayush: Can you tell us a little bit about your blog? I'm sure our viewers would love to know more about it.

Ross: I like to tackle complex issues and share industry insights in a way that's easy to understand. Honestly, I'm not a fan of using fancy abbreviations and jargon that only make things harder to grasp. Some people use these terms to sound knowledgeable, but it often just hides the fact that they don't really get it. English is my third language, so I prefer simplicity.

I apply this approach in my blog too. When I talk to potential founders of early-stage companies, I tell them to explain their ideas in a way that anyone with tech experience can understand. If you can't do that, how can you sell to CISOs who come from diverse backgrounds, some with no deep technical knowledge?

By the way, check out my blog. It covers various topics in cybersecurity, like investing in startups, data trends, dealing with multiple security vendors, and the evolving industry landscape. I like to analyze the tough problems worth tackling.

Click here to check out Ross Haleliuk's blog: Venture in Security!