Founders on Fire: Evan Blair, Co-founder and Global VP Channel Sales, ZeroFOX Founders on Fire Podcasts Posted by Jon Howell | 11/03/2020 ZeroFOX are a perfect example of how the Tech Trailblazers Awards can help new Enterprise startups to gain the recognition that they need to attract investors and customers. Chief Trailblazer Rose Ross caught up with Evan Blair, ZeroFOX’s co-founder and Global VP Channel Sales, at RSA Conference 2020 in San Fransisco. Evan recounts the journey that the company has been on since winning the Tech Trailblazers Security Award back in 2014. He also explains how an all-hands policy has managed to keep a blossoming company feeling like a small, inclusive startup. Listen to the full podcast here: You can also listen to the podcast on YouTube and AnchorFM Interview transcript RR: Tech Trailblazers interview with Evan Blair, one of the co-founders of ZeroFOX. Well, obviously, You guys won within about 18 months of being founded, I noticed, and a year later you’d had one of your significant rounds of funding. So, what I thought would be great is, we love to revisit things, and 2014 is a long time ago, and ZeroFOX has come on leaps and bounds, if you’ll pardon the pun. It’s great to have you here and to sit down with you at RSA, it’s particularly nice to sit down in a park, versus in an exhibition centre or in a press room. EB: Very much so. RR: I thought we’ll just go through exploring a little bit more about what’s been going on. Can you tell us a little bit about ZeroFOX and what your focus is? EB: ZeroFOX is the leader in digital risk protection. When we started we were very laser focused on social media, because a lot of business engagement with the market, with their customers, and employees engaging personally, took place on social media platforms. So, there was a lot of risk inherent in that engagement and activity, but now we’ve since broadened our scope as businesses have really engaged across all of the digital world, into the web, forums, blogs, news sites, mobile app stores, marketplaces, the deep web, pay sites, even the dark web, on and on; so we provide customers with a single platform to gain visibility, and then manage the security risk, and the attacks that are propagating across this digital surface. We call it, ‘The public attack surface’, if you will. These platforms are public in nature, you can’t secure them the same way you secure your own infrastructure, and so ZeroFOX gives you the ability to see what’s happening in realtime. To analyse what’s happening in realtime using machine learning AI and our open rules engine to look for particular risk issues, maybe things like impersonations, fraud, targeting phishing campaigns, social engineering activities, piracy and counterfeit goods being sold, identify that and then take action on it. So we’re not just alerting you to say, ‘Hey these are the bad things that are occurring to your brand, to your customers. This is the data that we’ve found that’s been shared in an unauthorised manner’, but we’re actually taking it down. We’re doing something about it, we’re remediating the problem, and that is a remediation that takes place on the platforms themselves. These platforms that we don’t have control over from a security perspective, we reach into Facebook, we reach into LinkedIn and remove that. We reach out to domain registrars and remove fraudulent or spoof domains. We even have the ability to impact email security in an advanced email security capacity for BEC, Business Email Compromise, types of attacks through takedowns, and infrastructure dismantlement of the phishing campaign itself. So really it’s visibility and production is what we’re providing customers today, and it’s really important because most of our business activities are taking place in this public sphere. We have to secure the business where the business exists; we shouldn’t be focused inward when everything else is focused outward. I think that’s a different thought process for security professionals, but we’re seeing more and more think this way. The market is growing fast, you see it in a couple of areas, ours particularly, the digital risk protection space. You also see it in the tangential market of intelligence, that’s growing, where we’re trying to say, ‘Hey, how do we look external to impact the security of our organisation?’ That’s really where ZeroFOX sits, it’s the global leader in digital risk protection. RR: So, obviously as a founder, and I think there were four or five of you setup ZeroFOX originally. I’m sure it’s been quite a speedy journey, although I’m sure you would have wanted things to go a little bit faster at times. EB: Always! RR: What would you say are some of the key moments on your journey that were especially challenging? EB: Mm. Especially challenging. Well, one of the challenging moments was, how do we go international? So we’re a US-based company, we’re an East Coast company based in Baltimore Maryland, and I think that’s really an important distinction. I think we operate with a different mindset in the East Coast than the West Coast. Our first large investors, or Comcast Ventures, they’re CCH fund and NEA, but now NEA is obviously one of the largest venture capital firms in the world, and people think of them as a Silicon Valley firm, but their main office is in Washington DC. So, with that mindset and the growth that we have, especially in the financial services sector, in the consumer goods space, when we were ready to go international we said, ‘How do we do this?’ Now we have three international offices. We have an office in Santiago Chile, we do a lot of research and some development out of there, we run some operations out of that, and we also have a fairly sizeable Latin American sales presence out of our Santiago office. We have an office in London which is a very fast-growing office for us, as the UK market and then the broader EMEA market in general has been very receptive to us, and to the problems that we’re able to solve. We also have an office in Bangalore, Bengaluru India, and that has really allowed us to expand our managed services capacity for a market that is certainly in desperate need of vendors, not just saying, ‘Here’s a new tool to waste your team’s time with’, which I think sometimes you get in the threat intelligence space, that there’s another tool that I throw analysts at. People shortage is a problem, so what we’ve tried to do is to provide not just a platform that’s an automated solution, and an automated security technology, but we’ve also tried to provide a managed service to all of our customers, to help them manage the alerts that get fired by the platform, ‘What do I do? Is there an investigation needed? Do I issue takedown of the command?’ So going international, the first international office in Santiago, and the second was London, the third was Bengaluru, and each of them had their own unique challenges. Certainly in the UK we had visa challenges, and now I’m sure we’re going to have some more challenges with the departure of the United Kingdom from the European Union. Yes, that was one of the big stepping stones for us that raised concerns, and you’re always looking, there’s always challenges along the way. Do we have the right pricing model? I mean pricing is such a funny thing especially when you’re in a new market, and you’re establishing a beachhead, you’re the first mover, you’re the pioneer, which is the position that we sit in. RR: A trailblazer, in fact. EB: A trailblazer, exactly! So, how much do I charge for this? I don’t know. What does the market bear? Especially as a young company, you sell your first deal. Oh you’re scared, you don’t want to overprice it because you want the deal, you need the sale, you need momentum, it gets you your next round of funding. ‘Well, did I undersell it?’ Then you’re kicking yourself, ‘Should I have charged them more, what’s it worth?’ And so over the years you start to ask customers, you start to feel more comfortable with a group of customers that share feedback, and as long as you listen to your customers I think you end up in the right spot, both from a product to development and future functionality perspective, as well as pricing perspective, but it took us years and years to get to a stable pricing model that makes sense. What we decided to do at that point was to throw out the general security notion of secrecy around pricing, and say we’re going to make our pricing publicly available. We have to make our pricing simple; it’s got to fit on one page, and it needs to be explained in three sentences, customers need to be able to look at the sheet and pick the coverage they want, pick what they care about protecting. So, that’s really the way we went down it. We said, ‘Where are you trying to protect your organisation? What digital data sources? What are you trying to protect?‘ So, your brand or executives, or your team, or your physical locations, or your products, or your accounts, and that’s it. ‘Where?‘ and ‘What?‘ Very simple, straightforward. Our sales teams go, ‘We need to charge more!’ But what we try to do is, we try to make sure customers feel the value for what they’re paying for. I don’t think that’s necessarily the case across all the security industry, I think there’s a lot of, ‘Well, how much money do you have… yes, that’s the price’. But that’s not okay, we wanted to change the way people perceive security companies, and be a little bit different, blaze a new trail around the pricing and the secrecy component. So, our partners, our customers, everybody knows what the amount is that we charge, and that’s that. Also in the security industry we were trying to break away from the, ‘Well, here’s the price, but I’m willing to give you 85 percent discount’, mentality, and just say, ‘Here’s the price, this is what it costs’. That’s the world we live in, right? How much is your cell phone? How much is your iPhone? It’s $800, that’s the price. How much is coverage? $1000, great, that’s the price. RR: Maybe we’re starting to touch on this already, but in the same vein on your journey what are the things perhaps, that you’re most proud of? EB: We definitely are touching on it. I think listening to the customers and being willing to take critical feedback from people to improve ourselves and improve our process, improve our product, and not to feel like we’re doing everything right. A lot of entrepreneurs will say, ‘Well, I know best. I’m the smart one, I’m the one that come up with the idea. I have the best idea of direction’, but certainly you need that innovation, you need that ideation, but customers that are dealing with the pain, they know what the pain is and they have ideas too, and so if you involve them in your process then you’re going to end up in a much better place, and we did that from an early stage. There’s a couple of customers who come to mind right away, that really pushed us hard and they really made us a much better organisation, and they made us a much better product because of it. So that’s definitely something I’m proud of. I also think the culture that we’ve created at ZeroFOX. Everybody talks about culture especially in startups, but it’s really important to create an environment where people are excited to come to work, and where they feel that they’re being given as much information about the organisation, the successes and the failures, as humanly possible. So, we started the company and ran all hands. So it was just a handful of us sitting in a conference room, we would go around, ‘Hey, what are you working on this week? Let’s talk about what we were doing. We’ll give you an update on the fundraising that we’re trying to go after. We’ll talk about different customers or product challenges.‘ There were six of us, and then there was 10 of us, then there was 20, and then there was 50, and then there was 100, and now there’s 300, and so how do you maintain that level of transparency and connectedness to the business. So, still to this day, every other week on Wednesday mornings we run a company all-hands, from Baltimore, or from London, or from Santiago, or from Bengaluru. It’s a video session that’s hosted with slides, at the Castle, which is our Headquarters, it looks like a castle, it’s an old Pabst Blue Ribbon bottling facility, pre-prohibition. We do have Pabst on tap if you’re interested! We also have a rotating selection of local Maryland and Baltimore craft beers, because of course we do. But what we’ve been able to do is foster a culture that’s unique in a regional aspect, but the same across four global offices and hundreds of people, by over-communicating and ensuring everybody is a part of this journey together, and that everybody feels a shared sense of ownership in what we’re doing. Everybody feels the ability to raise their hand and say, ‘I think something’s broken’ or ‘I think we can do this better’ or ‘I’ve got an idea’. That’s really, really important, and not all organisations can say that, and that’s definitely something that I’m super proud of. RR: Obviously from our perspective we were delighted that after you won in 2014, which seems I’m sure like a lifetime ago for you now, and definitely much closer to the beginning part of the journey, rather than the end. EB: Yes. RR: You secured $27 million in B round funding in December 2015, and congratulations, you’ve just done another round! EB: Yes! RR: I just thought a little Google to see what’s been going on! That was led by Intel Capital, $74 million, so you’ve actually boosted our security sort of alumni raise by over £800 million now. EB: Yes, it’s actually the largest funding round for a security company in Baltimore in the history of the city. So we’re pretty proud of that as well. We take our responsibility as a citizen of Baltimore and what we’re trying to help build for that city very seriously. Then the State of Maryland and all the good things that we’ve gotten from them, received from them, and then they continue to support us. So that was very exciting. But fundraising is a funny thing. Peter Barris who is on our board of directors, and is one of the managing directors at NEA, led our A round. He once said that ‘No-one congratulates the chef when they come back from the market’. So yes we pat ourselves on the back for raising funds, but that’s the raw materials, it’s what you do with it afterwards. It’s the Michelin star cuisine that you create with those ingredients that people actually pay for, and people really should be congratulating you on. So, it’s great having Intel Capital behind us, it’s opened up a new world of possibilities. We’re running all of our artificial intelligence machine learning in the Intel cloud now, and we’ve seen marked improvements in speed and accuracy through the Intel cloud, working with their team there has really helped our AI. The market opportunity that Intel is able to open for us. Let’s not forget Intel owned McAfee for a long period of time, it was a McAfee-Intel security, so there’s a lot of great synergies between the Intel team and the ZeroFOX team. And so it’s nice to continue to have investors that come around the table, that have deep expertise in every stage of our growth, from building companies, to finding the right people, to selling and marketing, and taking a product that is growing at a great speed, but how do you accelerate that ten times faster? RR: It’s interesting, it mirrors very much a conversation that I was having, just before we sat down and chatted, with a bank who work a lot with the startup community, and was asking them what they were seeing, and they were saying, ‘Tech’s always been a huge element, but we’re expecting to see more money being put into the enterprise tech space now, because it’s easier to be unique within enterprise versus the consumer world, where you’d have so little time between you becoming Uber, and then there’s Uber 2, Uber 3, Uber 4, Just Eat, and Deliveroo, and all that kind of stuff.’ It is so easy to replicate that success, and if you get it right you can basically be annihilated very quickly, so you can build it up quickly. Also the other thing is getting something to 50 million is fairly easy in the consumer, but getting it beyond that is harder because you get those factors coming in. So, that’s good news for everybody in our space, right? EB: Yes. RR: That the money is going to be freer than perhaps it has been of late. So, we’re seeing a positive trajectory which is good. EB: That is really good. RR: But you’ve already done it, so you don’t have to worry about it! EB: That’s true. I think building an enterprise company is a longer journey than building a consumer company that can be a success overnight, because enterprises especially in the security space are highly demanding on the technologies that they deploy to protect their billions of dollars in revenue. I think it’s another important point, that once you get a customer, you need to make sure that you keep them. I think a lot of companies in the enterprise technology space, may not place a high enough importance on keeping those customers happy. On an account management aspect they’re focused on the new business, net new sales, but you keep a customer happy your lifetime value for that customer goes up, the worth of your organisation grows, but also you’re going to just continue to compound year over year, and enter into that nice growth trajectory that everybody wants to see on a chart, going up into the right with a little curve to it. So, enterprise security technology, but security specifically, poses so many challenges, and there’s regulations, there’s compliance standards, there’s data privacy and protection centres you have to comply to, if you sell at all into the government space, the state and local where you have a whole other set of requirements. So it’s always trying to stay one step ahead, but I think you can build something very sustainable and hopefully predictable if you get it right. RR: Yes. I always feel that the entrepreneurs who set up very successful enterprise tech companies, are much more likely to be able to replicate that success. Rather than being perhaps the unicorns that yes, will come through once in a million, but that is the right circumstances coming together, at the right time, with the right idea, and to then have another idea that does the same thing is going to be quite a big ask of someone. EB: Yes. RR: That would be great to keep reinventing a new Facebook or whatever it would be. So, from your perspective let’s just have a look at the Awards. They came at really a very crucial time for you, You guys were just getting yourselves on the mark, so thank you very much for your team taking the time to submit yourselves, and we’re delighted that you’ve won. What tips would you give to other people who are considering doing stuff like this, at this early stage when you’ve got so many other things that you could be doing, that maybe you would see as being more valuable to all your customers, those types of things. EB: My co-founder James Foster, always placed a high priority on industry recognition and awards. Maybe there was a time when I just thought trying to win an award maybe comes off as vain. However, what I realised was it’s very important, because this is an independent group that is reviewing so many other companies, and helping you stand out from a crowded field. Especially when you’re an early stage company, and you need investment, you need investment to keep the lights on and to grow, being able to say, ‘Hey, we’ve won an Award’, that is a reputable reward in the industry and it doesn’t go unnoticed by investors, it doesn’t go unnoticed by customers. I think it’s a very valuable thing especially for an early stage company to spend the time to promote their product, evangelise their product into the market, and what better way to do that than with an independent third-party trophy, to say, ‘Hey, take a look at us. Somebody else thinks we’re pretty cool and we’re doing something really unique here’. That might be just the leg-up that you need to get the meeting with the investor, to get that customer to open that email, or to get that next deal across the finish line. RR: Yes, every little helps as they say. EB: Absolutely. RR: The other thing we were talking about today is also this long time, if you’re in a consumer tech start-up you’ll be working very, very hard for a much shorter period of time, right? EB: Yes. RR: Don’t tell me you got the awards in your first round of funding, and then suddenly you can relax, everybody’s kicking back in the Caribbean for a couple of weeks. There is a sustainability, it’s much more of a marathon than a sprint, and it takes a lot of effort. I feel there’s certainly a benefit for your team because you have been slogging away, and somebody’s noticed, and you need to motivate yourselves to keep going to the next hurdle. EB: Absolutely. It gives you a moment to stop briefly, only briefly, and just say, ‘Hey, we’re onto something, we’re doing the right thing. The hard work is being noticed and recognised, and we’re heading in the right direction. All this pain and suffering, time and energy is worth it’. You can’t place a dollar value on that morale boost that it gives to the team, and the people that are really pouring their hearts and souls into the project. Because you’re right, the returns don’t come right away, it takes years and years to build in the enterprise technology space to start getting those returns, and getting the validation from the market in terms of revenue and customers, that ultimately is now how we measure our success. RR: Brilliant. Well, let’s hope that we get to sit down next year at RSA, and you can tell me more about the exciting things that have been happening. I’d like to just thank you for your time and all the efforts that you’ve put in. EB: Absolutely. RR: Appreciate your time. EB: No, thank you for everything, and I’ve enjoyed the conversation. Hopefully somebody listening to this will say, ‘This is something that we should pursue. Let’s go after this, and let’s take it for a run’. RR: Great! Lovely.