Hitesh is the CEO of Vectra, a leader in the threat detection and response for cloud and data center workloads. Vectra was founded in 2011 to leverage AI/ML to detect network threats and has since seen phenomenal growth in the business.
In this episode, we’ll talk about security, the state of the public and the private market, the great resignation, and above all product and company building.
Hitesh: “One of the most important things to do with detections is not rely on individual detection. I think it's really critical that you have the ability that the product, the platform have the ability to correlate. So if you, if you take a sequence of events and you create a narrative around that sequence of events, that will give you a far better picture, that it is something that's spending time on, versus not”.
Ankur: Hello, everyone. Welcome to another episode of ZeroToExit. This is Neelima and Ankur. Happy new year everybody hopes you all had a fun and relaxing holiday break. We took a bit of a hiatus from the show to get ready for our second season. We were busy lining up the best in the business and to that, I couldn't be more delighted to kick off our second season with Hitesh as our guest.
Hitesh is the CEO of Vectra, a leader in the threat detection and response for cloud and data center workloads. Vectra was founded in 2011 to leverage AI/ML to detect network threats and has since seen a phenomenal growth in the business.
In this episode, we’ll talk about security, state of the public and the private market, the great resignation and above all product and company building. Hitesh takes a no holds barred approach in his interviews so you wouldn’t want to miss this.
Hi Hitesh
Welcome to the show!
Hitesh: Thank you very much Ankur and Neelima. It's a real pleasure. I appreciate your, kicking off this, this next season with me. Happy new year to all your listeners and to both of you as well. I'm looking forward to the conversation.
Ankur: Thank you. Are you a new year's resolution kind of guy? And if so, do you have any personal goals for this year?
Hitesh: I'm actually not. I think I tend to find, most people, when they do these resolutions tend to be fairly fairy tales. Consistency and goals year on year is better than cooking brand new ones every single year. It's like, the fitness thing, like you wake up on January one, then gym membership shoots up for a while. And then the plummet on February one, like what's the point? Right? No. So I don't have new year's goals, I definitely have goals that are fairly consistent.They've gone year to year, and then I'd rather stick with them. One is there's a whole bunch of Vectra oriented stuff that I'm, I'm pretty fixated on.
But the other one that you may, this is sort of like work in progress perpetually, as you make progress in a career, is one of the things that you really try to find is some kind of balance. And if my family was listening to this right now, they would probably chuckle and say, “He's got a long way to go” and that'd be right.
But honestly, it is one of those things that is important that as you build your career out in the end, if you're building a business out or whatever it is there's a continuous learning around how do you achieve better balance? And I'll confess entirely right now that I indeed have a long way to go.
Neelima: Awesome. So here's hoping for that. You'll find that balance in 2022. I go towards a little bit about your founding journey, right? You started Vectra 10 years ago. And we've often heard you in your interview saying great product and company building, is often a grind, right? Like it shows 10 years, same company, and awesome growth. How do you maintain your mojo year after year?
Hitesh: It comes down to why you do something like this in the first place. I'm assuming you're going to have people who are either, have started companies or are aspiring to start companies on this podcast. I'll tell you what doesn't work.
If you're looking to start something, because you're fixated on an economic outcome in a short period of time, don't do it. Don't do it because the chances are you could get lucky and you could make a lot of money and you'll feel happy. And you think you've done it. The truth is, the chances are even a failure, so it comes out first and foremost - why do you do this? And in my case, I was very passionate about the application of AI to network security. It started with that. That was number one. The second thing, I was very-very passionate about building a company with a great culture, right. And, having had large roles at multiple companies, you realize, and I'm sure you realize that where you are right now, you inherit the culture, you are so like, you really can't do a whole lot. You can try and improve at the edges , but you really can't do a whole lot of the core of it.
And there were a lot of lessons learned along the way. And, things that really just are miserably awful. And so how do you avoid that in, and really build something that you can look back and go, okay. Only did we make a dent in the universe in a positive way from a business point of view, but you build something that you can live by saying, okay, you know what? That really was the best time of my life, no matter where you are in the company. If you're gonna achieve that, then for me, that is super fulfilling and that does not happen overnight. Those things don't happen overnight. And that takes a while to get through. And so, you've got to have that stamina and persistence to do it.
Ankur: I have often struggled with this myself, and I'd love to get your perspective, regardless of the economic outcome and you're right. Like, that's not gonna, that's going to burn you out. But after four or five years into a product and company, you kind of lose that zest sometimes. How do you reload your gun every year? Like, is it the business goal? Is it that cultural change? Is it you becoming a better CEO as your goal kind of gets you going, brings you up, and gets you ready for the year? Or you just, you let a couple of weeks elapsed and it's just business as usual, you've gotta go through the drain all over again, kind of thing.
Hitesh: In my case, It is not the four or five-year thing, that is, it's not the time horizon. That's really the thing that I think about any company you go through great periods and to go through really tough periods. Right. And it's when you hit the four or five-year mark and it's really that's when you really sit down and kind of go like, what the heck am I doing? Why am I going by doing this at all? And look, the two of you and I suspect there are many people on this call who are immigrants. I like to think you have some degree of stamina building already, right. Otherwise, who leaves everything where we've come from other countries and landed somewhere else. And, regardless of what economic background we came from, there's a level playing field that occurs here when you come here to the US, which is one of the best things about being here. But the thing for the US, for me, in particular, I drive a ton of energy from customers as we've gone through and we have had our share of. Call it dark periods as a company. the thing I come back to is, is again, why did I start this in the first place? Why did I get involved in something like this?
And when you're going through a rough patch, sitting with customers who are close to you is very energizing because, Hey, they're going to tell you suddenly what is wrong, but if you've done a good job in building relationships, right, you're going to do, you're going to learn a lot about what is right. And, you know, keeping a perspective on what is right in that period becomes really essential. And I think that gives you a way to parse through the topic. The other thing I'll tell you is it is so critical that you have a set of advisors as board members around you who have the ability to take the long.
When you are in the middle of a crisis period, right which is usually what you're talking about, like, how do you lose your mojo, so to speak, that's really when you lose your monitor the most, if you've got board members and investors and advisors, whose thing is, “Hey, you know what the best thing to do is just get out and sell, find the first route first off, up and do it.” Sometimes there'll be right in fairness, sometimes it'll be right. If they are balanced about taking the long view, that really helps you out, in our case, right. When we've had one or two episodes like that, I had a couple of advisors who are like, you know what - “You should sell”. I mean, it'd be great. Go and find somebody who is going to give you a bunch of money, let us get some more money back and you'll be good to go. But then I had other people around me who could take a very long view right about this. I'll give a name out. so vinod Khosla at, at KT.
If he ever ends up listening to this, he would not mind my saying this. He is a very tough guy to work with, but it's precisely why he's a great guy to work with. He absolutely takes a long view and it's not just, you know, I had others, I've got other people at the table as well around me.
Charlie, John Carlo, Eric Walford, I can keep going, Who have been, Brad Gillespie was one of my earliest investors. They can take a long view and that really helps you. So it's not just what you do, it's the people you surround yourself with that makes a difference. The last thing I'll tell you is - inside your company, if you are, if either of you decided to go become a CEO, have a couple of people who are constants that you can really count on. Okay. The reality is you won't be able to have 15, 20 people. If you're lucky, if you have four or five, six people or even two people for that matter who have the stamina, the same way you do, that is really essential to really go the long haul on something like this.
Neelima: So you feed off of each other's highs and lows..
Hitesh: Highs. You don't want to get off the lows, but it's the high really that they make, but more importantly, just feeding up highs. It's having the perspective that this is indeed a journey and it just doesn't happen overnight. There's a tiny-tiny percentage of startups where you could be an idiot and you can stumble into a market and you could do well, no matter how good you are. And, but for the majority of the people out there, it is indeed a grind.
Neelima: A minor follow up on that Hitesh, it looks like you had some founding principles and you sort of went to those, is this fair to say that you should have goodtime founding principles and wartime founding principles because you tend to see that over 10 years?
Hitesh: I don't think so. I think being really clear about your core values very early on, is really essential. And, your next question is as likely to be what are your values? What do you guys focus on? Right. So I would say, If you're too late, if you're lucky to have joined Vectra tomorrow, So that's a, by the way, on the, can I say this on podcasts, I'm making a job offer right now? –
Ankur: (Chuckles) Of course, of course.
Hitesh: –So put that aside, that's table stakes stuff. The three things that we care about the most in Vectra are : number one, putting the customer first. We are obsessive about this. I am personally obsessive about it. So what does that really mean? And he's a reasonably smart individual who should put the customer first. In this case, do you have a culture that has got genuine empathy for the customer's success? Is that pretty consistent across the entire company? And the reason that's important is then you don't have a culture where it is putting it simply it's either product first or sales first.
And, you see a lot of that. In my time before Vectra, I saw that. And that was one of the things that really paid me the most, which is that I've been in very great companies depending on what business you're in, right? It was a product culture or a sales culture. Rarely is it a marketing culture or, in our finance culture, sometimes if you're a shitty company, it's a finance culture. but product and sales, you tend to have a lot of comps. How do you eliminate that and really kind of go everybody aligned in the interest of the customer, that's number one. Number two is no drama teamwork in those exact words. And the place where this matters the most is with the executive team where, in most companies, they tend to be the biggest offenders of this maxim. And so what is key to achieving something like no drama teamwork? One of the, one of the essential elements is, if you and I were having, you know, either of you, you know, the three of us having a debate about something and we were on completely opposite ends of the spectrum of what we think the right answer is. But if you assume positive intent from the outset that look at the end of the day, we are serving the customer, it's coming back to the customer for that.
This is in the interest of achieving customer success, right? 9.9 out of 10 times, if you are really authentic about the positive intent, you will land at the right answer. But on the other hand, if you don't, then it's the fastest path to do, having a ton of drama and that comes up. No drama teamwork.
Third is integrity. That's it? Those are the three. Remember you're already smart. Good-looking, hardworking.
Ankur: I love those. It's nice and simple. The last thing on this particular thread is, as you address your teams, whether it's your end of your newsletter, your quarterly-all hands, employees who have stuck with you for many, many years, are you always repeating these messages over and over again? And, how do you balance that? Where the employees are like, okay Hitesh, we go with dash again, same three things, right? Keeping your message fresh, there's something new. How do you ensure that the vitality within the organization is maintained where like every year, some of the folks who have stayed with you for longer feel like, Hey, there's something new to look forward to?
Hitesh: Yeah, look, I think there are a couple of things here. One is, not just every year, every quarter, hopefully you're talking about material growth in the business. You're talking about new areas that you have expanded into new things that you have done. So, I mean, that's like, company-wide right.
You've got to put that out there and be very communicative. There's a message that I put out every quarter to the company that lays out the accomplishments for every part of the company. It's not just like, “Hey, we achieved these numbers and it was great. And these were these great customers”, but I think you want to highlight, okay.
Yes. The obvious ones. What did the product team achieve? What is the marketing commission, but what is the finance team? What did HR achieve? What did the legal team achieve? And that highlighting what I would essentially call the glue of the company becomes really important because it ties over together and you have a better appreciation for what it takes to actually be successful as an entire company.
That's fine. But to your point about the people who've been here, the longest, I tend to have direct sessions with them. People who have been here four plus years, in a separate group, because they've got a long perspective and you want to sit down and have a very open dialogue on a regular cadence and to get their perspective, I could be living in my bubble, because they've been here is a high degree of trust and w they're already invested in the company, they have full permission to pop my bubble any single, any time they want to buy, but you've got to engage them at that level and take the feedback and act on it.
It's hard to do. It's hard to maintain the discipline to do that well but if you do that, there's a relationship aspect of that, that allows people to kind of ride forward or over a course of time. Right. And that is super critical. If you, again, authentically invest in the relationship with the people that you've got in the company and the people who are sticking with you the longest, that in itself creates energy for people to be there with you as you go from year to year.
Ankur: I really liked that perspective. Actually. We recently did a celebration of our folks who had been with the company for 10 years. It was the first time I saw it. Obviously doing so on a more regular cadence, I think goes a long way in retaining them.
Hitesh: You've got to have a culture where those folks feel like they have a direct line to you.
Neelima: And they can amplify your message, right? Like that's, I think that's..
Hitesh: But they will only amplify it if they direct the line to you. If you are listening to them, if they can pop your bubble periodically, if they need to, you know, all that is going to be really real for them to kind of say, okay, you know what, I'm going to go and amplify the things that are really positive but you've got to have that open communication chain and the relationship.
Ankur: Yeah, I just wanted to switch the gears a little bit and geek out a little bit more on security because a lot of our listeners are security as well. So one of the things that you've often said in your talks is that a kind of prevention in securities fool's errand and that bad guys are going to break through your preventative controls anyways.
Yeah. and then detection is the holy grail, if you will. And just for our listeners preventing it, just like, Hey, having some sort of a security, preventative control, to not even let the bad guys in versus detection is if the bad guys even detecting, tell us more about it.
Hitesh: Let me give one small point of clarification. I think prevention is something, any customer should, they should try and do that because the foods are, and if you think that's the only way, you're going to deal with security and so like the latest brand of cyberattacks is the reason for that statement.
And I think today, I don't think I've met a single CISO in the last 24 months who would disagree with the notion that you cannot, I mean, it'd be crazy to rely on prevention as the only mechanism. I think there's enough evidence out there, we all know this, there's a new attacker, very in something it's like, COVID, it happens, on a pretty frequent basis. The infrastructure reality, the attack surface is morphing at an exponential rate and for prevention to work, you need to have a static attack surface, and that is just not the case. You look at something like the cloud, as an example, Okay. Cloud is like, windows, circuit, windows 95.
It's the wild west. Yeah. Okay. And, you could argue that in Windows95 created the security industry. I think the cloud is going to sustain it quite thoroughly. Gods. The reality is we'll have Jobs. Yeah. Everyone's going to have Jobs for a long time to come. The reality is that the attack surface is morphing so fast it's an end by end pro mutational problem.
There is no way you're going to solve it now. Look at it on the flip side. Let's take some, something fairly narrow, like Network security. Okay. When you're dealing with the notion of detection and response, the network stack is seven layers. It's been seven layers for a very long time.
Tick is not changing, the only size stacks. No, but to add an eighth layer. So therefore, in terms of, if you think, contained problem versus uncontained problems to solve, this is a contained problem when you're dealing with, how do you deal with somebody as they're navigating the, the seven layers, that's a contained problem on the way in it's an uncontained problem. So therefore yes. Try and stop it the best you can. It's a smart thing to do. Right. But for God's sake, don't try on that because you'll get killed. And there's enough evidence to tell you that yes, you ain't guaranteed 100% of getting killed if that's what you can rely on.
Neelima: The one thing related to detection though is then there is this concept of noise, right? Like you, as you start detecting, it's very hard to really know what is like good detection versus Vectra says that you guys do AI in detection and response. So two related questions there, one, we hear a lot of hype around AI ML in security products. Like what's the difference? And how do we know it's real?
Hitesh: So let's start with the noise level and detection, which is true, depending on how you have implemented the solution of what products you bought, right? You're going to get killed with noise. And that's like one of the realities in socs today. Okay.
“One of the most important things to do with detections is not rely on individual detection. I think it's really critical that you have the ability that the product of the platform has the ability to correlate. So if you, if you take a sequence of events and you create a narrative around that sequence of events, that will give you a far better picture that it is something that is spending time on versus not”.
Let's take a simple example. Okay. If you've got the command and control event. Okay. So somebody is trying to message out to draw and get instructions. And that's all that occurs for a period of time. Okay. It's important that clearly somebody is infected and so they're trying to get something, I'm trying to get some communication going on with some entity outside, but is the sky falling for you really at that point? No, it's not Versus you could have had a ransomware that's underway and you can see a set of behaviors that tell you that there's actual, real progress around that. Okay. Now, because you're talking about an accumulation of activity and you find a way to create a narrative out of that, that helps you prioritize where you spend it. And that is very hard to pull off.
We talk about AI in the context of detections, only AI in the context of correlation, prioritization is equally critical. It's equally critical. So for us United Vectra, we don't just talk about, Hey, we can apply AFA detections, but really a lot of the value add to the customers is how do you stitch it together?
How do you create a narrative around it? How do you prioritize that? Right. And that creates real efficiency for the SOC (Security Operations Center). Okay. Then to answer your question on the second part, it did, there's a ton of hype around ML and AI, now, it's a much abused term nowadays. And so how does a customer know that it works, it doesn't work. A couple of things first and foremost, if you are doing a paper evaluation of, you know, I would stare at the company and kind of go, So if you are a vendor, pitching me for Palo Alto, I've got an AI based solution. I'm going to sit and go. Okay. That's great. What kind of data scientists do you really have? Can you walk me through the background of these people?
I don't, you know, everybody just, I don't know the names, but tell me what they have done. And then let's talk about how you actually construct your algorithms. And then what do you do to go about doing that? And, frankly, what you will learn very often. I'm not saying this to Palo Alto, but very often what you learn is it tends to be simple heuristics.
And you'll pick that up, but, but you have to double-click on that a little bit too, to understand that that's the first thing, have a discussion about datasets. And what do you do with datasets? What do you do with supervised and unsupervised? Right? What is your philosophy? So you have to double click on that a little bit to really kind of peel that back and go that I, I believe I have reasonable conviction that your ML-AI tools have got some depth to them.
And then ultimately I, and we say this, the customers ourselves, when we get into an engagement, do a real red team, Forget after it's all said and done, yes, we want you to believe them, but, there is no better evidence than doing a, a real red team. you will know very-very fast, right? Whether the efficacy is, is real or it's a bunch of garbage.
Neelima: Got it. So for our listeners, red team exercises are where you simulate attacks on your environment. And you start seeing the real detections and since you know what you're simulating, you can match it with the detections that are coming in. So, you know the efficacy of the products that are deployed and many organizations do that..
Hitesh: I think it's important too, not just rely on, just internal red team folks because many companies have internal folks as well, and it's okay, you've got them, but getting somebody from the outside to come in, the mightier framework tends to be a really good way to think about it. And so to ensure when you look at red team entities, whether it's inside or outside, think about what framework they're utilizing to construct the attacks. And it's complex enough, if you do simple things, like my example earlier, it's all command and control. I mean, honestly, it's not that interesting, any smart attacker knows how to get around that problem. So you've got to make sure the right complexity, the attacks. A Mightier framework provides a good way to think about this.
Neelima: And related to your models, comment, very-very true. But what we see, we, both Ankur and I, work in the security industry too. I mean, there's not enough supervised datasets available for meaningful directions. So, a related question one, what should one think about from a company perspective, how do you get to that data? And the second thing do you see as an industry? And I asked this of many people getting to a point where these data sets will be commonly accessible?
Hitesh: Yeah. First of all, when you think about crafting a detection portfolio, right, for the customer, you have to take into account both supervised and uncertain machine learning. Because, if you just go down the unsupervised path, then you know, you're really building just a simple anomaly detector and you can get gorgeous graphs and absolutely garbage results out of that.
So, it's really critical that you have both the perspective of getting your heads of data for supervised machine learning is tough, but if you have a really good relationship with a set of customers, the best data is live data. And you've got to find a way to harness live data without fully revealing the secrets positive extra, I would say we've done a really, really good job in harnessing live data to help us. So, there is an analogy that, I think, especially if your listeners are from the bay area, they can relate to.
If you drive a Tesla. And if you think about how it learns, because it's always learning, when they do updates for you, those updates are based on your driving behaviors. Every-every single Tesla driver is in some way, some ways a Guinea pig. But that means these days, a relationship with live data that exists, that constantly allows you to improve. I would say we have something similar.
Ankur: Very cool.
Neelima: Very cool.
Ankur: I was listening to Elan's interview with Lex Friedmanhe's a great podcastor. And he was talking about, obviously, I mean, Tesla takes the AI-ML to the next level, like they're using Euro links and stuff. And apparently in order to detect, like, as part of the FSD, module that he's now selling for like 13K by now, what are we going to raise? The prices later is a, like an order of magnitude reduction in the data sets that they consume to detect, street signs and trees and all that stuff. and machine learning, by itself.
I guess my question, just, just following up on that is, the amount of data that is required. So you have kind of the MDR, XDR, that are like siloed data lakes, Uber data lakes. And we live in a world where, but there's just way too much data. It's just an enormous amount of data. What should people think about it? Like, is it, “Hey, there's an endpoint data lake, network data lake, cloud data lake kind of thing that they are excited about”. What is there a next gen AI-ML, whatever technology, which is not going to require zettabytes of data to detect threats?
Hitesh: One of the biggest fallacies that exist in our security business is the notion that more data is better. I can go back to the beginning of the Vectra, right? That used to be, that was a founding principle at a really good time, which we have now discarded, which is collect, find a way to collect as much data as you can. That's the best way to find the needle is the haystack. The truth is- Can you get your hands on the right data? And then do you have a clear notion of what the right data means? And if you do that, they'll shrink your data set requirements, pretty dramatically. Let's take it again, let's stay with network traffic just for a second. The traditional notion was I need the food packet every single time a lot of companies where either they looked at NetFlow or they were looking at, like I just gotta collect the entire traffic and that's how we've been go and lean the signal when the truth is that the signal there lies in metadata, which tends to be, one or 2% of the overall traffic at most in that example, what is the approach you're going to take, just collect all the traffic and God knows how much storage you need.
And then the means to go sift through that. Or do you just rely on one or 2%? So what becomes really critical as you think about what data you need, think about the use cases. You gotta be use case driven versus I'm going to find the use case once that. Which tends to be what a SIM tends to do very often. That's also one of the, one of the, challenges with SIM tends to be that, originally it started out with John depository, just collecting as much as he can.
And then we'll write a bunch of analyses on that, right to go find the use case that you care about versus the use case that dictates what data are you going to collect in the first place?
Ankur: Yeah. Very good. One of the things that you brought up that kind of struck a chord with me was you said, Hey, like there was an idea in the founding principles and you said, Hey, look like that hasn't stayed true to the test of time. Just the question on that learning is how do you ensure that the company's not too enamored by the founder CEO's original idea on a mission driven approach, like, oh, we're going to detect the most advanced threat and not be receptive to the market and the customers.
Hitesh: It's a really good question, I'll tell you, in terms of learning experience in our case, If I go back to our Series A deck, the city has Series A deck, neural networks, and a bunch of traffic GPU's. That was the thesis. Okay. So therefore, you know, you've got a whole bunch of–
Ankur: Data that deck today lands at 10 billion rounds at a trillion valuation.
(Both chuckles)
Hitesh: –I think sadly you're right. Yeah, exactly. It checks off all the boxes that it would be caring about right now, so that was the thesis which is to use advanced AI techniques, really anomaly techniques, you know, neural networks, you need, clearly, horsepower so get GPU's. I mean, Palos, would you do it and then collect a whole bunch of data and, magic is going to occur. The truth is, we don't do what I said earlier. We had like the most beautiful graphs, the results were terrible. Like there was a noise, like noise galore.
Okay. The thing is once you have that stark result, there are a couple of things you can do. One is to be dogmatic about it and say, no, no, if my algorithms got tuned better than suddenly, it's going to get better. And so two things occurred in our case in particular. It was clear to me that the initial team that was on and chasing this thesis did not have the capacity to look outside of the pieces. So that was very rapid, let me bring on other people who can break the mold of our thinking, and allow us to kind of look outside the box if you will, right away.
The second thing was, built early relationship with customers coming back to the customer thing because of the relationships I had or a period of time, predating Vectra, we were able to sit in their environment and coming back to the notion of live data and really prove what's going to work or not work in a live environment, as opposed to a theoretical lab environment, a bunch of data love it.
Those two things were key in breaking the mindset. So you've got to have, and the key to that is the people thing is always right. You've got to have the courage and to, kind of say, “You know what, okay, you guys are–”, this initial crew that is thinking about this, I appreciate the fact that you are on day zero, But you cannot monopolize the path forward. And if that means that this is the hardest thing, if that means letting go of a couple of them then you've got to be able to do that too. And that decision early on is going to determine what path you're going to take. And it's very hard for me to talk about this right now, because it's after the fact, but that was a tough set of calls to make early on.
Neelima: And knowing what you know now, would you do anything differently if you were restarting Vectra?
Hitesh: I think honestly, maybe some of the people's decisions are made faster, probably the biggest thing I would have done differently. Because look, the truth is when we started this out, the whole notion of applying AI-ML to any kind of dataset to go and find for signals was considered fairly esoteric when I'm in the up and down sand hill looking for funding. People kind of support us, right? Majority of the people were like, this is a really high beta. That's just, don't do this, you can go and do any number of things, what are the odds? This is going to work, and the odds were not terribly high other than the thesis that he could work. So I couldn't change the thesis fundamentally because until the rubber meets the road, you get knocked around a little bit, you don't have enough hindsight to go and say, I want a different piece.
This is good. the practical application and moving fast on making some decisions that's 20-20, but at this point I would have changed some people's stuff faster. Got it.
Ankur: I have a quick, product question along the same thread. Let's just say, you know, you decided you're going to have this advanced threat detection capability, staying true to that general mission, and the customer buys the product. Hitesh, it is great. And last one year, I haven't detected anything and it tells you to ask the customers, well, you got to renew, but yeah, like we haven't the bad guys haven't entered the market, right, because nobody got into the house. How do you decide whether to also send signals on if somebody's knocking on the doors versus gardening as well?
I have personally decided as it pertains to detection, just to show value, “Hey, somebody is knocking on the door”. You gotta pay attention versus, “Hey, somebody got in because that somebody's event doesn't happen that much”. And most customers are not ready to do red team exercises. They're like, “Hey, deploy it. We'll see if it detects it great you have proven your value. Otherwise you have.
Hitesh: In some ways the whole posture market is going to emerge from that.
Ankur: You're welcome.
(Both Chuckles)
Hitesh: Until I am the direct beneficiary. You guys know this, so especially you Ankur, that becomes essential in helping customers think, that. Okay. It's not just about whether somebody is in the door, I, you set up correctly to prevent them from getting to the door in the first place. Okay. So, you've got to make sure that your toolset has got that baked in. And then frankly, you've already done a red team. You can make that part of your offering to them. They don't have to do it. You can, this is, again, it comes back to how deeply you're engaging the customer.
If you've got a regular cadence with them, and you are maniacal about customer success and all that, then yes, they will let you come in and do your version of red teams as well and help to highlight the gaps have got and the need for a detection portfolio, which by the way, what you just said, three, four years ago, I used to run into that all the time, all the time, like, what if this doesn't light up like a Christmas tree? Am I really in trouble? A rare customer today is going to wake up and go if I don't get in, in fact, I was talking to a customer yesterday. Who is a customer? And it was like I said, so how are we doing?
And it was like, well, no one is good news because I don't want to hear from you. I really did not want to hear from you that I sleep better at night when I don’t get a call.
Ankur: Interesting point. And like, I've gone 360 and we'll get in and security we'll keep going in circles.
Right. we light up the Christmas tree, a little too bright and they're like, okay, tone it down a little bit. Would ya? So that's something you got to discuss!
Hitesh: I don't have the people, I really don't want to report this. This is really hard.
Ankur: And then like my pre-sales, then we dial it down. They're like, dude, I can't value the first time. I gotta show you gotta light things up. So anyways, we just wanted to geek out on the product stuff. I'm sure we can spend a lot of time, but I know Neelima, you've got something on great resignation. Go for it.
Neelima: So basically the next question is, which is a very-very hot topic right now is the great resignation. My LinkedIn, lit up with bye-bye messages, looks like people have too many choices and too many startups are coming up and they're getting a lot of money in terms of salaries. How do you keep your best people in a climate like this?
Hitesh: This is going to sound pretty obvious, but the culture you have in the company is one of the biggest things that keeps people around again, super easy to say the, one of the key things to really being, data-driven about it, if you will, do you actually do regular surveys of employees? Do you actually collect data that backs up the thesis you may have in your head that I have a great culture, right? It's not enough for me to kind of think here that I've got it.
Can I get it? Can I get feedback from the customer we know from our employees that tells me that, okay. by and large, we are trending correctly or we have gone off the rails in the following areas. So that becomes really critical. That's number one, because ultimately, it's only about money and that's the only reason that they're going to have a short lifespan, people will take blood money for a period of time.
And then at some point I'm going to go like, who cares? I'm miserable anyway, I might as well leave. The second thing is you've got to have honest discussions with, with people, and this is very hard, whether it's the right fit for them and for you, this is true, regardless. This is just good practice, no matter what.
But in this period, when you're getting bombarded by new job offers and crazy compensation packages, all I thought of as part of the equation that gets missier is the career. And where are you going with yourself? Okay. And oftentimes, if you have an honest discussion with the individuals above their path, it could be that the best place for them to go is not where they are, but go somewhere else.
But make it about the career first and foremost, as opposed to just about, it's just a bigger title or a better pay package and ideally you're offering them a far better track internally to get there. And that should be the reason. So that honest dialogue becomes really critical if you're going to retain people.
And then you're going to have a percentage of people, one mercenary we're going to do. They're going to go to the next job offer. And that's just the way it goes. Yeah.
Neelima: But the one thing I struggle with in wanting to get your point of view is hiring new grads. They really don't understand, well, they do understand theoretically the culture piece, but they have not tasted it. And they are to some extent driven by monetary benefits, any advice or insights into how to hire them better compared to the expertise?
Hitesh: I think we should not underestimate that, even the new grads want to hang around smart people. And we've had very good success fending off large company offers because the people they talk to here, ultimately they're gonna, you know what I want to be around these people. And I want to work with these people. I'm going to learn from them. It's just going to be a great crew to be around. If you have done a good job of having those kinds of people in the first place, they will serve as a magnet for the new folks coming off, coming out of school. Because, that plays in our experience, at least that plays as big a role as whether you're paying them $20,000 more or whatever the case may be. But that people aspect becomes really critical.
Ankur: Very cool. I have a question along the same lines, but before I ask that question, I want to take a quick detour, a little birdie told me that, you had your names all over, the word iPhone or the term, you had a pattern, of sorts, tell us a little bit about that and I'll come back to the question I had?
Hitesh: So I, not me personally, did not have the patent to the iPhone as Cisco did. Okay. What you're referring to is, startup within Cisco that I led, and we ended up according to the company and the company had the trademark to iPhone. So it was, the original device in the house, broadband was pretty limited. This is now going back to 98, 99, early days. So that company was bought, had the trademark for the iPhone, and it was, I would say maybe 15, 20 years too early at that time, the right concept. And ultimately, it was Cisco's attempt to be in the consumer business. And the premise there was that you could build a set of devices that are broadband connected inside the house, right. To connect you from the outside, build a content model where service providers would subsidize that. And the average consumer would end up getting that and, you know, can do much like what we do day to day on our devices, phones, iPads, and such. It was tickled as a very early incarnation of that. and then at some point, Cisco, to some arrangement at apple and I'm giving you the trademark to apple. Yeah.
Ankur: Yeah. I was in Cisco 2006. And around that time, like when Apple had to pay Cisco and I'm like, holy cow, like we had iPhone names back in the days. I didn't know you and Charlie–
Hitesh: No, no, we ain't. Charlie and I were knee-deep into this. And so we actually have the, that time, that version of the iPad. We had one like the best industrial design award. Chambers was going to be on, on the cover of business week at that time. Right. And it was like, it was pretty far in, And then, at that time, what we're trying to do was to get the new brand of service providers that were in the market. They were challenging the incumbents right at the time, and kind of coming up with new business models.
The goal was to use them as a way to break into the market. And then the lights went out and when the lights went on, that brand of service writers uniformly collapsed. And so once they collapse, right, the old business model came back and it was retrenched in the market and we're like, all right, you know what? It's a good idea. but the best thing to do is to write heads, to shoot it and, go back to like, routing and switching, which is what it was.
Ankur: Yeah. So here's the reason why I asked this question. Right. and because we were talking about people, et cetera which is that Cisco had the iPhone iPad idea, hack I mean, Cisco thought about slack and messaging stuff even before that thing became a thing. and big companies consistently try to experiment with this. And Neelima said young people, but young people are drawn to the cool, the sexy, the new thing. But there's something about big companies where kind of entropy builds up. It's not that the innovation engine is not there. But over time, the cool gets lost. How should the big companies maintain coolness? Or is there a level of inevitability around here?
Hitesh: I think the beauty of what we do here is that there's an endless opportunity for somebody to come along and disrupt. Okay. But there is a lesson in that Cisco story, which if I were to be candid at, maybe you can tell me if I'm wrong. I see what is happening with you guys, like, for example, how is your consumer business working out?
Ankur: (43:10) I must say early days.
Hitesh: So that's exactly what I would've told you If you'd asked me at that time, we would know how the consumer business is working out. I said, it's early days. You can make, as a large company, think that every adjacency is available to you just because you've got momentum in one sector, you think you can go and do that really well elsewhere. That happens rarely. And anyhow, if you look at the, the, in the history of enterprise, Microsoft is probably one of the very, very, very few companies, at least that I can think of, that build their business in the commercial enterprise sector. And then ultimately found a very dedicated consumer oriented stuff. Yeah. People were pieces in the house, but it was really with XBox and others where they really went by the way that was a loss leader for a long time and maybe a loss leader and I don't know but you have to have the capacity to be really pour endlessly into it to really branch out. Right?
So even a company like Cisco, who had no shortage of money, found it really, really hard to get into that. but coming back to your question about how do you attract the young people there? What are the key things that ultimately drive innovation, is that, are you willing to disrupt your business model? Companies make this mistake all the time where. For example, if you're a box company, and a box company is going to struggle to kind of go, I'm willing to cannibalize this revenue stream. And you can go from perpetual to subscription, you can say, you're going to do it.The journey is super hard. But the reason that your ability to transition there becomes critical is that it leads to the kind of innovation that attracts folks to come in. If you can be fairly ruthless about it. And have the backbone to go do it. Then it's going to lead to innovation.
That's going to lead to you, attracting the right people. I'll come back to Microsoft as an example. I don't know if people would call it Microsoft. Cool. But today people would say Microsoft is a great company without question. Before Satya took it over, nobody would have said, it's a great company, but what they've done is what he has done. And the team around him they've done is incredible in transforming that into a cloud-force company. Where today, if you are coming out of any of the top schools, right. And you land in Microsoft as a first job, and three years later, you want to leave and go get something else. People are going to look at the resume and go, okay, you're a part of Azure. You know what I want you versus. 10 plus years ago, I joined the windows group from school. And you go okay. Or Microsoft Middle school or whatever. It's like, not that interesting.
Neelima: They are, they are in all the hot markets. I mean, you name it,
Hitesh: They're there, but then they've been willing to change their model along the way. And then there've been, they've been maniacal about it and, and that takes courage. It takes real leadership courage to go do that.
Ankur: It is. I don't think there is a playbook. I mean, books and annals of history have been written on this. I think great leadership is one of the leading indicators. Netflix consistently cannibalizes their own old model to get into new and new stuff. And you talked about Microsoft and, but then we handful, you can literally count in two hands, big companies who got better as they got bigger. Usually it doesn't happen.
Hitesh: Doesn't happen. Nope.
Neelima: So now pivoting to the investment, or the VC market, Vectra raised 130 million last year, the middle of last year. And we've never seen so many unicorns in a year raising monster rounds. What do you think happened last year? And do you think the trend will continue this year?
Hitesh: For the next 12-24 months, there's a ton of capital in the market. So I think you can go and raise, good chunk of money, and do what you need to get done. If you are one of the people raising money, you want to be really thoughtful about what you're going to do if you raise $5 million, you can find a million dollars actually quite quickly, if you want it and not get the right return on it. So, one of the biggest things that is, are you disciplined about the way you're building your business out? You want to go for growth, ideally, hyper-growth. We can get it but the thing that you have to keep an eye on is that, what are you going to look like again, in the long game? Are you going to be a sustainable franchise?
Once you go to wall street and, you know, because here's the truth, everybody who goes through this, this growth period, and it's, it's super high. Once you get to a certain scale, inevitably some kind of slowdown is going to occur. The thinking is, “Hey, you know what as we scale, I'm going to get just smarter about how I manage my expenses and then magically, when the growth slows down, I've just tuned everything just perfectly”.
And so you're looking for this perfect scenario that never happens. And so all these people are raising this, got all gobs, all this, like, you know, doing a million, five millions, right. We have about 350 right now, so far. there's a time when 250 would have been, looked like good God, like $350 million.
Now you look at this and go like, man, what's wrong with you? Like, that's like, why don't you go raise another $500 million and go do that. Then the question becomes, what are you going to really do with it? And is it setting you up for a successful public outing? The reality also is that look, some of your competitors, whether it is Lacework or Wiz or something, one is going to have a great outcome. Only one, You're not going to get five people raising that kind of money and they're going to go out there and kill it. You're hoping that you'll be one of them, you'll be that one, but a smarter way to do this is to be tactful about the money you're in a race.
Ankur: Yeah. Playing the long game. I think that's been one of the consistent themes across the interview, whether it's a company, people, culture, or raising money and conduct. We can ask a whole bunch of questions just on this thread, we're running short on time, so I'm going to kick us off with rapid fire. It's a quick set of questions - Yes Or No five questions. Are you ready for this?
Hitesh: Go for it.
Rapid Fire Session
Ankur: All right, let's go. January 22, so it's a prediction time. So I'm going to ask you a bunch of questions. What are your predictions, does web three gained steam or lose ground this year?
Hitesh: Can I tell you neither think he's got a long way to mature. Okay. All right. Like it,
Ankur: Is the stock market remaining flat, significantly higher or lower?
Hitesh: I would say for the next six months, right. We'll continue inching up if you want me to say yes or no, but stock market, you know, I would have been an idiot to give you yes or no. If interest rates go up significantly, then the market will run into turbulence. It has to.
Ankur: Okay. This requires quite a bit of thinking. Time's person of the year in 2022?
Hitesh: I will tell you the profile of a person. One of the biggest risks we have got here, one of two, one of two flavors of people, I would say if somebody emerges in the United States who can bridge the political divide, I think that person, because that's not just a United States, that there's a global implication for that. Then I think that person deserves And the second profile would be if the person, whoever this individual is, if they can find a way to create a better bridge between US, China and Russia, I would say that would be the other individual that would deserve to be on the cover. Those are the two that I would, I would try and go for.
Ankur: Yep. When pigs can fly, we'll have no political divide and we'll have somebody who can bridge that, but we can be optimistic about it. You heard it first on the record. I'm going to give my prediction for The Time’s person of the year.
I think it's going to be Marc Benioff. I hope Marc Benioff is listening to this podcast. I think he has a big chance . If CDM is going to be so big where new companies will get built and he is the original architect. So, is COVID still a pandemic or becomes an endemic at the end of the year?
Hitesh: I would bet it goes. It becomes endemic by the end of the year.
Ankur: Love it.Biggest technology breakthrough, in 2020.
Hitesh: Something to do on medicine. It would be in the realm of, I think, you know, the whole MRN technology that has been used for COVID right. And what can you do to accelerate vaccines, not just for COVID, but for other areas as well. Is there stuff out there right now that they're looking at shingles and stuff like that already, right? It can change the game pretty dramatically in shortening the cycle for how vaccines get developed across the board. Not just what's being applied in COVID right now. I also
Ankur: We heard that if you were not in technology, you would have been a nuclear physicist. So the next couple of questions are actually a little bit longer time horizons. You don't have to be constrained. What's the biggest unsolved mystery in physics that may get solved in a long enough time horizon?
Hitesh: It's understanding dark matter. Okay. Very cool.
Ankur: And the last question, Tiktok got more traffic than Google in 2021 or the next three to five years. Do you think Tiktok captures more ad revenues than Google or Google is still the dominant player in ads?
Hitesh: Google being the dominant player is right. Easily.
Ankur: That wraps up the first installment of our season-2. Hitesh, thank you so very much for taking the time to really enjoy this conversation. It's already over and out and, based on how the conversation was going, we could have done it for another hour, but we respect your time.Thank you so very much.
Hitesh: Thank you. I appreciate Ankur in dealing with both of you. I appreciate you making me your first conversation this year. It's an honor. I really enjoyed this quite a bit. And, and I wish you guys the very best as well.
Ankur & Neelima: Thank you.
