I think it's become a vanity metric to raise a lot of money. The real
purpose of a seed stage startup is to find PMF. It's not fundraising.
Fundraising is a cost of doing business. I'm joined today by my
friend Ahmad, the founder of Corgea, which is an
app security startup. We talk about why you don't need to
raise more than $2.5 million in order to get Product Market Fit,
Corgea's journey to Product Market Fit, what they were actually doing on a tactical
level, and we talk about why he doesn't believe in design partnerships. Enjoy the
episode. Product Market Fit. Tell us why you
don't need a lot of money to actually find it. Yeah, I think,
you know, this came from when you and I were chatting and we
were talking about topics and I put this post on LinkedIn and,
you know, usually the story is it goes viral. It did not go viral.
I think I got a lot of like friction from it, but my hypothesis is
that You don't need a lot of money to find PMF.
And what I mean by a lot of money is like now you see round
sizes being like, you know, seed rounds being 5, 10,
20, maybe even 30 million in some cases.
Like we're in cybersecurity. And so those rounds in the seed round are like
ludicrous sometimes. And so, um, you know, I put, you don't
need more than $2.5 million to achieve PMF, which is, you know, give or take
a little bit. And I think a lot of people didn't like that.
Why? I think it's become a vanity
metric to raise a lot of money. I think people kind
of show, think that they can show market validation through that.
I also think it's optimizing for the wrong kinds of things
that you're trying to do. I think the real purpose of a seed stage
startup is to find PMF. It's not fundraising and fundraising is a cost of doing
business. It takes a lot of time, energy, and effort to fundraise,
which is not the primary goal.
And then I think it also incentivizes bad behavior,
right? Overhiring,
throwing bodies at the problem. I remember having a
meeting with one of our RYC partners, Diana, and we were talking about,
as we were fundraising and all of that, and she's like, if you don't need
more money, don't take it. Money doesn't solve your problems.
Money doesn't solve Product Market Fit. Money doesn't solve your go-to-market strategy.
Those things you as a founder and your team have to figure out and solve.
And you can do that. And you see a lot of companies, I'm not saying
go bootstrap, but you see a lot of great companies that are bootstrapped or raised
very little. Like people forget about Stripe and Airbnb and
Ubers, like seed rounds were much smaller than today's standard.
They had worse dilution. And on
top of that, like they had a harder job, like cloud computing wasn't a thing
when Airbnb was like kind of doing its thing, right? Like they had to like
run physical servers and buy those machines and do all kinds
of stuff. Right. And so that's kind of my opinion on it is like staying
lean. And I think even Paul Graham talks about it. Like he even talks about
some of this stuff is like, you always want to surprise people by how lean
you are, because that's actually a stronger signal of Product Market Fit. A small
team has achieved something so visceral and so strong that
it shows really strong signs of Product Market Fit and go-to-market strategy. And I see
a lot of startups raise these large rounds, hire an army of salespeople
that can't feed because their go-to-market strategy sucks.
Their product kind of sucks and they end up having to let go people
or pivot or sell the company and everyone kind of celebrates, oh my God,
we got an exit and acquisition, but it really was pennies on the dollar.
And I've seen this time in and time out. What is a seed
small lean team? What does that typically look like? And what
is it? What's an example of not a lean team?
Yeah, that's a good question. I mean, you have to really assess it for your
use case in your industry. So like whenever I say these things, people shit,
oh, but hardware is different and biotech is different.
100%. They're different. They are fundamentally
different spaces and you should raise according to those spaces, right? I believe
for the most part, like most companies, $2 to $4 million raised
should give you roughly like 2 years, 2 and a half years of runway to
figure shit out. That's, that's what you really need.,
right? And that's Bay Area money. Like I'm talking, you're hiring in the Bay Area,
you're keeping it very local, the most expensive talent on the
planet. Like I'm not talking, you know, you go to start a startup in Thailand,
like as a digital nomad, that's going to be very different fundraising. Right. And I
really think you can accomplish a lot on a team of 3 to 5 people.
I really think maybe if you stretch it a bit, but like under
10. You should really find early signs of Product Market Fit and a go-to-market strategy
that works. Above that, I really
start to question if you're really, if you're overhiring. Like I sometimes
see these startups with like a chief of staff and like an
operations person being added and all these things. And they just came out
of like stealth or just announced their seed round. And I'm like, what are you
doing? Like, do you really need that many bodies? To like run your
operation. And then, then they're like, you know, I like to be very cheap on
tools too, or like very cost efficient on tools. Then they're
like doing their SOC 2 and they don't even have customers yet and an
ISO 27001. And then suddenly they're like listing jobs on
Ashby and nothing wrong with these tools, but it feels like
you're putting the cart before the horse, even before like PMF or seeing early
signs or really strong signs of PMF. Right. We punted on a lot
of that kind of stuff. Like we did SOC 2 much later till
it became like a hard requirement for some of our deals. Right.
And so I feel like those are like, in my opinion, bad signs is when
I see really bloated companies without
that level of traction to back them. I can give examples actually of
other companies I've literally seen sell for like pennies on the dollar.
Because of this.
Um, I don't know. Do we want that? Do we want to say that?
Probably, probably not. Probably not. Just,
I won't name them. Okay. Yeah. Let's go. Okay. Yeah. Let's, let's do it without
naming. Yeah, we can do it without naming. I mean, there's one competitor
that I observed, you know, raised, I won't give the exact
numbers so that I don't get into trouble for like doing this, but I know
this from credible sources of their investors. They raised anywhere from
like $50 to $80 million and only
netted about, you know, $4 to $7 million of revenue
after raising all that money and could no longer, and ran out of money eventually,
ran out of money eventually and got acquired by a much larger
company for half, a little bit less
than half of what the investors put in and all the investors
and all the companies celebrated, look, we got acquired, we're such
a valuable company. But then when you go talk to their investors, they're like,
that was actually like a really bad outcome for us. So bad,
it actually, they don't want to invest in that space anymore. Scaling DevTools is sponsored
by WorkOS. If things start going well, some of your customers are going
to start asking for enterprise features. Things like SSO,
SCIM provisioning, role-based access control. These things are hard
to build and you could get stuck spending all your time doing that instead of
actually making a great devtool. That's why WorkOS exists. They help you with
all of those enterprise features and they're trusted by OpenAI,
Vercel, and Perplexity. Here's what Kyle from Deepo has to say about WorkOS.
We use WorkOS to effectively add all of the SSO and
SCIM to Deepo. So for us, we can effectively offer SSO and SCIM
and it's like 2 clicks of a button and we don't ever have to think
about it. It's like one of the best features that we can add to Deepo
and it's super affordable, which effectively allows us to like break the
SSO tax joke and essentially say like
you can have SSO and SCIM as like an add-on onto your monthly plan.
So it really allows smaller startups to essentially offer like that enterprise feature
without a huge engineering investment behind it. Like it's literally,
we can just use a tool behind the scenes and our life is exponentially easier.
Thanks again, WorkOS. Back to the episode. So was the mistake raising the
money or the mistake was spending it on like the wrong things
or like spending it prematurely or? No, I mean, the YC
thing is always competition doesn't kill you. It's often competition doesn't kill you.
It's death by suicide. Right. And it's death by
suicide. You end up burning too much money too quickly,
making bad decisions because now you're like burning through runway
and you end up running out of money and,
you know, it becomes a very difficult position to be in. I know Paul Graham
has written about this called the, I think it's called the Fatal
Pinch. Yeah, it's called the Fatal Pinch. There's a whole article that startups end up
not realizing that they're about to die 6 months before the end of their runway
and they don't have enough money in the bank to keep going. So it's too,
too short to pivot. Like they don't have enough runway to pivot now.
And now they're burning through money and they potentially could have like a little bit
of customers, but not enough to keep the company alive by default or default alive.
Right. And that's a really dangerous place to be in, especially because you do not
know the like macroeconomic factors. Like I bet you a bunch
of companies around the world were super eager to like, you know,
raise money and COVID happens. Right. And now you're in
a very difficult position. You maybe have to pivot or change your business
model or do something else to account for that, like you kind of always want
to play to the worst hand because startups are really risky.
Yeah. Okay. And so let's say I
hypothetically came out of YC and it was like raised to,
let's say $4 million and, uh, to be on the upper end.
And then I'm like, okay, so I'm going to hire,
if I'm going to start counting, How many till you're like, whoa, jump again.
I'm like, I'm going to hire one engineer. No, I'm going to hire two
engineers, three engineers, four engineers,
five engineers. What point are you coming in and being like, whoa,
one second, like, let's have a think. I think, look,
I think like it depends what you're building and
what you need those people for to get to Product Market Fit.
And you're maybe, maybe let's even start from the beginning. Like you're,
you're going into YC, maybe you're a solo founder or two founders or three
founders, right? How do you get your initial set of customers? That's all it
takes. That's the fundamental question behind everything. We made the
mistake. We made big mistakes at Corgea very early on in our journey.
We started building a product that we really didn't think there was like a big
advantage in the market for. And four months into, you know,
our YC experience, we pivoted. And that
was the best decision we ever made. And we were completely correct about the market.
Now we were able to do that. We were a very small key team.
We were, I think, roughly 3 or 4 people. We were 4 people doing this.
So we weren't like huge. And that allowed us to pivot very easily because I
could just put all the people in the room and say, this isn't working.
We need to find something else. I have an idea. Then we started
building out what is current Corgea manifestation, but we didn't know about it. We started
building like this initial wedge. I'm giving this example because I think it answers your,
like, your question. And we didn't, in my opinion,
build wide enough. We were kind of taking the advice
of building a wedge, building a wedge, building a wedge. And we were kind of
navigating through customer conversations. But every time we were shipping something,
customer probability started increasing towards them wanting to buy, which was super interesting.
So we were like, okay, there's a path here we see of like problems
we started going after and we started selling into that. I think
we sold like our first customer. We were like a
company of like 3 people at the time.
Hmm. Like, or 4 people. No, we were 4 people. We were 4 people when
we sold our first set of customers and we grew a lot
till we eventually added Alan on the go-to-market side.
And we just kept growing from there. We became 5 and then we added our
6th. But it was always justified towards the revenue being
generated and we started feeling stronger signs of Product Market Product Market Fit and
so on. And we still remain very lean, but it
was, I don't think there's like a hard number per se. I think is what
does it take to get to your Series A goals and your Series A
goals should be, we have early signs of Product Market Fit. We have a reproducible
go-to-market strategy and we have customers that like our products
and are successful and are alive. Right. And that could be, you know,
for a software company, which is like mostly 95% of companies you see
these days. Don't quote me on that number. I just made it up,
but it's like, that'll be like maybe 3 to 5 people.
Hard tech, like my brother-in-law is into like hard tech,
like hardware literally. And it's like, that takes a lot more energy and effort and
they have a manufacturing component to what they do. Right. And that requires
a different capital raise with different investors and different headcount and people and all that
kind of stuff. Yeah, this makes sense. So it's just kind of trying
to keep it as lean as you possibly can,
doing it with the minimum that is possible because
not only runway, but you said there, like you have to do
a pivot, big pivot and get everyone in the room, get everyone on board
really fast. Whereas if it's like, you know, we've felt it where like,
it's like the more people you have in the room, like more people there are,
like it's more nodes to like conversations and
stuff, right? It's always harder. It's like, what is Jeff Bezos's like
pizza thing? Like the pizza rule, don't have meetings that require more than an entire
pizza. Like you can't feed everyone in a room one box or two boxes,
some new rule. Yeah, I think it's two pizza rule or something. It's like,
which I think I was always surprised like how few people could be. I don't
know how few pieces would feed like that many people, to be honest. So I
could eat like almost the whole one myself. Oh yeah. Beautiful piece.
Yeah. Yeah. Yeah. But anyway, not many people.
Something that I've been thinking a lot about and like done a couple of
episodes on is, is Product Market Fit. How did you think about
it and kind of apply that like to Corgea?
It's a good question. I don't think Product Market Fit ever stops.
I think it's an evolution of what you keep defining your product to be.
My simplest measure of Product Market Fit is someone willing to pay you.
Like, is there someone willing to pay you for this? And then the question after
that, are there a lot of people willing to pay you for this?
Right? And in cybersecurity, and maybe a lot
of other dev tools, the advice you get is form design partnerships very early
on. And we never did that, which is very antithesis to like the
advice you see, because I would rather get a no than a maybe
from customers. And so we always approached it like going for the
jugular. Are you going to buy this or not? No. Why? Let's learn why
you won't buy this today rather than, oh, let's build a design partnership and
give you like work for free for the next 3 months and you help
us design this and we come up to some like version and
the problem is the quality of those,
the quality of your product is dictated by the quality of your design partner,
right? And so you end up like kind of locking yourself into this
cohort of customers that might not be good customers in the long term. Maybe they're
having you build some like really bespoke thing and you're like not getting good
signal. And so you think, okay, now I have like these 3, 4 design
partners. Let me hold onto them and let's go hunker down and go build this
product. And our version of this was like, let's just go talk to like a
lot of people and get a lot of nos to eventually figure out what the
systematic pattern is in the market. So I've probably spoken to like hundreds of
security teams at this point to like nail down exactly the problem space and
what we're building towards it. So we never went for the maybe, we went for
the no, no, no, no, no. And then the no started becoming yes, yes,
no, no, yes, yes. And then it. Started trending
up. Yes, yes, yes, yes, yes. So to be clear what you did
when you pivoted, you lined up conversations
with a specific ICP, like you were like
security engineers, application security engineers,
100%. Okay. And we, anyone to talk to us.
Okay. Anyone broadly within that. Okay. And then
you would say, we've built this thing. Would you buy it?
They'd be like, no. Or, okay, let's go back to the drawing board. They'd be
like, this is interesting, but I don't have budget for this. Okay, let's go
back to the drawing board and like try it again. And then they'd be like,
oh yeah, now we want a POC. Or like you would go talk to a
bunch of others and they would be like, oh, now we want a POC.
This is pretty interesting. Oh, let's go into POC. Would you buy? No, not really.
I now have to justify this with my like CISO. We don't have budget for
this. It'll go to next year. Okay. That means what we built isn't valuable
enough yet. Okay, let's go back to the drawing board and execute a little bit
more and then just keep iterating very rapidly,
very quickly. Like if you look at the Corgea changelogs, like we ship 2,
3 releases a week because of that. And so like,
you just have to like, just keep churning through like the problem,
but you have to have a good signal that this is a problem worth pursuing.
That your competition are doing a pretty shitty job or the alternatives to what the
customer is doing is pretty shitty. How did you know that?
Complaints. No one raves about their security tooling in AppSec.
No one's like, oh my God, I love my tooling.
I started asking this question to people, name one
tool you deeply love. Like you deeply love
and you're like, I can't live without this tool. And in AppSec, that doesn't exist.
Like I'm simplifying, but like I didn't get
like this visceral, I love this. So you talk to developers, they're like, oh,
I love Supabase or I love PostHog or I love Cursor.
You know what I mean? Like there's this sense of,
I don't know, is there a tool that you love,
Jack? Is there a tool that I love? You put me on the spot.
I mean, right now. I mean, who doesn't love Claude,
but yeah, right. Like Claude's amazing. Like super cool.
I love Mintlify for docs. Like I've written like other CMS.
Mintlify is great, especially for like developers.
Right. Um, I don't know. There's like lately I've not liked GitHub.
Like I'm really tired of GitHub and how slow like the pull request pages
have gotten. Like, and developers are very opinionated. You've interviewed a
ton of them. DevTools in AppSec, there aren't a lot of
loved products where application security engineers are like, this is deeply
thought through. I love it a lot. And so that's a sign that there's a
lot of weakness in the market. And so we started interviewing people and I have
a slide on one of my decks, 50 reasons people don't like their
AppSec tools and we counted them all.
And there is a ton of toil in application
security because you have to understand something about AppSec. There's a
1 to 100, 1 to 200 ratio of AppSec engineers to
software engineers. Wow. Like for every
application security engineer, you might have 100 developers they have to support.
So it's a, it's a like firestorm going on this poor AppSec
engineer or 2 or 3 of them. And they're struggling.,
right? So they're like having to do all the like compliance stuff, all the pen
test stuff, like security vulnerabilities. You should have Shai
Hulud coming out of nowhere, left field, like with
NPM attacks and malware and like threat modeling. And they're
like, then you get an incident and now they're having to triage the stuff.
They have no stability, right? Like the development cycle is
like, you have your sprints, you have bugs. That come
out, but like most dev jobs are largely
stable. AppSec is like, there's always something around the corner that's very threatening.
So like they're looking for their tools to scale,
right? And there isn't a lot of luck. So going back to like the early
Product Market Fit, like conversation to go back to the arc,
we, we, we weren't hearing that, like the tools that were
largely liked. Solved for a lot of the old problems, but they still didn't resolve
a lot of the root cause problems. And we kind of bucketed them into like
3 categories. Happy to talk to you about them and how we like
eventually bucketed them. But that was kind of
the, um, aha moment was we started as we kept pulling on this thread,
just discovering more and more systematic failures in
the tooling. And as we kind of took a new novel approach with how to
do this, we saw customer interest and conversions starting to
grow. And I have this other kind of interesting
rule that ties to this, like the majority of
your first meetings should convert into a
pilot. I would say maybe in 2 meetings,
60 to 80% of your conversations should convert into some pilot
or POC. And that's a very strong sign that you've built something like
very viscerally important. I'm guessing not from the very, very beginning
when you're just like, but this is, is this
like, this should be the case at some point or is this, it should be
the case from like day one? You know, I don't know. I mean, you see
some projects that go like bonkers banana, like ClaudeBot for some
reason on fire and you're like, I don't know why. I still don't
understand it fully and I don't think anyone still like has a full grasp on
it and maybe it's marketing, maybe it's Maybe it's Product Market Fit.
I don't know yet, but at some point, I think in your journey,
whether that's day one, like I once heard Paul Graham, someone asked him in the
audience, like, when did you guys feel like you got PMF at
YC? And he's like, day one, day one, we felt
PMF. And the YC model evolved, but never really changed to its
intent. It took us a while. Like I'll give you an example for Snyk,
for example, really popular, like security tool. I read online and
I think this is true, like it took them 18 months to get their first
$100,000 of revenue. Figma took 4
years. Some companies, first day.
So if you don't have it from, what's the
difference between, it's just not, I mean, I'm going to ask you an impossible question
probably here, but what's the difference between me
just slogging a dead horse
versus me needs to keep persisting because it's going to work
out. Is there any rules there or like?
I think the number one rule is making sure you
have optionality. Like you cannot predict the market. You cannot predict
that you will get PMF. You have a hunch and you follow
that hunch. Like a lot of, we started in
mid-2023, 2024, we were kind of like still in this discovery mode, like kind of
in beginning 2024 is when we really pivoted into what we're doing now. And we
started going after deals, but nothing was clicking, but we saw very good signs of
things. Now in 2025, everything like worked out. We started
selling like crazy and like. You know, we grew month over
month, like really good rates and we continued to grow on such a lean team
and all of that kind of stuff. But I'll tell you something like that seems
like, oh cool, Ahmad, you figured it out. You're such a smart guy. But like
also AI adoption was in our favor. 2023 is
when GPT-3.5 to 4 happened. And we're like, oh, this is now worth kind
of looking into. 3.5 was like very
hallucinogenic, like hallucinogenic friendly, if you want to use that term. Like if
you ask about me, it tells you Ahmad's a filmmaker,
like completely off its rocker, right? 4 came out and it's like, okay, now this
is interesting. And I saw a lot of enterprises started testing it. 2025,
we forget that was the year we coined vibe coding. That's when you
really had developer adoption in AI. And that helped us on the security
side because if developers are becoming more productive with AI, that means
security now has to become more productive with AI, protect all that code.
And so we survived long enough because we
didn't burn through a lot of money and had optionality and
kind of saw the writing on the wall. Like we had a thesis,
like AI generated code is going to be a large contributing to codebases.
Like we saw that in 2023 and we had a strong conviction that was going
to be the case. And because of that hypothesis, we were
like, we're just going to try and stick it out long enough and just keep
building into this space.
And we could have been completely wrong. The market could have taken another 3
years to like get to where we are. We could have ran out of money
in that meantime, right? And but throughout the entire
way, we just kept trying to sell what we had. We built something, we tried
to sell it, we got a no. We had something else, we tried to sell
it, we got a no. And we just kept trying to build till we eventually
started getting yeses. And those early customers have
been amazing. Like amazing early champions of the product,
like being referenceable customers. All of them have agreed to be reference
customers. And that was kind of the seed that kicked us off. I don't know
if that was the answer to the question you were— I think this
is, so I think that's actually a really interesting path.
And, you know, some, some like Adam Frankel has talked a lot
about doing like technical advisory boards and stuff like that. Yeah. Yeah.
I connected to the podcast. By the way. Oh yeah.
Okay. Amazing. Yeah. He's a really cool dude. Okay. He is
great. Then there's that whole like, you know, mom test stuff where
it's like, what are you currently, you know, what, what talking about like
what problems you had, like what, when did you last try and solve
it? Like how much, how have you tried to solve this problem? Oh,
you haven't. Okay. Interesting. But I feel like what you're
saying is You had a kind of a strong hunch on what a
problem, on a problem, I guess, from your own experience, conversations and
stuff, and the fact you felt that the tooling was bad. It's like kind of
your inherent founder belief. And then you validated
it by just going and trying to build iterative
versions and asking people if they'd pay for it. Is that Was that
accurate? Kind of a good summary of it. And that,
that it's ludicrous. It just feels like Sisyphus's plate. Like, are you— That's not ludicrous.
Yeah. I don't know if it's Sisyphus's plate, you know, like just pushing the boulder
up the hill and just keep strolling back. But that's
what happened to us till we eventually got the yeses. Well, I'm guessing when
they said no, they were telling you why, right? Like, so you're probably just trying
to address— It was a wealth of data. It was a wealth of data.
Like it was like, no, because we can't get budget for this or no,
because, you know, I have to, I don't, I don't see the business value enough
of this or no, because your competition is going to build
this feature someday in the next year. They promised us that. And so
we just kept digging into it. And we had this question at the bottom of
our, like at the top of our minds, is this
10x better than what they have today? Like,
is this 10x better than what the market has? And it was kind of maybe
like 2x better. And then we became 3x better and we became 5x better.
And then just keep like chipping away at the problem till it
became 10x better. And they were like, yeah, we want to convert. Now some customers
converted at like 5x better. Right.
And I always tell customers, this is the worst version of the product you're using
right now. Right. Like we just keep like digging into it more
and more and more and more. And they love it.
Like they know sometimes we'll tell them like, look, this feature is half
baked, but like we want you to try this half baked feature because no one's
in the market has tried this. And we want you to give us really early
feedback before we go invest into like 10 areas where we need to make it
like a fully baked product. And customer was like, yeah,
sure. Like just give me the version and like, I'll give you my honest opinions
on this. And I feel like, you know, what is it
Reid Hoffman that says? If you've, if you're not embarrassed by your first
version, then you've shipped too late. Yeah. Yeah. And so there's that kind
of attitude you have to have. Yeah. And actually one
question on this, if they say,
no, we wouldn't pay for that because I don't see the
value. How are you reacting to that? I guess, is there a pattern? Do you
see many people saying it's like, if you think about the diffusion of innovation curve,
you know, that famous bell curve. What is it? I don't have
the numbers off the top of my head. 1 point some percent or what is
it? Yeah, some small amount is the early adopters or whatever,
the innovators. And then here, let me even show
you like diffusion of innovation curve, like 2.5% are the innovators
and then the early adopters are roughly 13.5% of the market.
So you kind of have a 25%
chance. Around like hitting the nail on the head. Like when the early iPhone came
out, the people who waited in line, the 2.5% were the
people willing to wait in line for like
today. We remember the iPhone 1 did not have copy paste. The camera was
like a potato, but the early adopters were also
interested. They're like, let me wait for the innovators to like just go get it
and wait in line and I'll go pick it up maybe in like 3 months.,
right? Yeah. Yeah. But there was also like a very strong appetite for that market.
So if you really think about like the diffusion of innovation curve, you roughly
have a 25% hit rate of probability. If I have 10 conversations
and all of them are the same systematic no, then that's a pretty
strong signal that something is off here.
Because even you must have hit at least one innovator,
early adopter in that. List. And so,
yeah, if you probably, if even they're not interested. Now, obviously you have to,
you have to fit these people correctly. You're not going to go to your mom
and tell her to buy a cybersecurity tool, right? Like,
she's not part of that cohort of like the future of innovation, right?
She will never buy. So like, there's an element of like, are you going to
go to the federal government? Like with rare exceptions that happens,
but go buy my like early stage cybersecurity product with no FedRAMP
compliance. That's not a good fit, right? Yeah. So you were trying to
go after people that could have been at
least— Yeah. Okay. And then, but then I guess my question, the question I was
trying to ask is like, how, like,
you know, you're, you're iterating on this early
product version. Are you using the reasons that they say no
to like drive that? Or did you just have a very clear idea in your
head, like the product roadmap of this version,
and you're just testing it as you go? I think it's more art than
science. I don't think we had like a hard roadmap. Like I think
up to last year,
like maybe Q3 and 4 is when we really started having a
proper roadmap. And that's, we still interview customers through pain points,
like even our current customers, we meet with them on a weekly basis for many
of them. Like we will still meet our current customers who are alive to talk
to them about their larger security problems. And so I
don't think that ever ends. And I don't think your roadmap is like
set in stone. I think you have big broad brushstrokes and you continue to
peel this onion of problem space and. I'll even tell you,
like, I was putting together some material lately and my whole
positioning about what we are doing as a business and the product we're serving
our customers with is a completely different problem set than
I even imagined. Like, if you want, I can give you this like
interesting, like, like aha moments I've had recently. I don't know
if you're curious to dig into it because I think it talks about some of
that journey. But yeah, I think like ultimately, like you have to take
as much signal from customers and that
signal never ends and you are building things
sometimes. Like I was in the car the other day going to pick up my
son and I had this like realization. I'm like, we're building patterns in application
security no one has ever built. And so there is no
copy paste. These are complete new. Expectations of things we're imagining for
the first time to ever come into this. And it's not like we're the
cool company that's like doing the cool thing, right? Like, no, these are
problems that customers are having. And now we can apply whether AI or a
new pattern or a new thing to kind of solve for that problem. And that's
very cool. And so you can't just look at your competition and be like,
let me just copy their homework. You're kind of like, the only way I can
find out about this is through the quality conversations I have with my
customers and picking your customers is really important.
Yeah. How do you pick your customers? There's a really
famous story about Coupa where I used to work. Coupa was one of the
fastest growing SaaS companies until that measure is now broken by many
other companies in the AI era. And there was a really cool
thing in the former CEO's book that he
talked about why They ended the relationship
with Subway. So this company is like, and don't fact check me on
this, but like, I think like post Series A, maybe before B, or maybe
just raised the B, but they were desperate for customers. Like there wasn't like a,
like aha moment where like this was like escape velocity. So Subway was
their biggest customer. Yeah. Right. And they went and ended
the relationship mutually with Subway because they couldn't deliver both on what Subway wanted,
nor did they think what Subway wanted was the right pattern for
the industry. Hmm. And so they had to end it because it was not a
good direction that they were taking the company down. And so you have to be
very careful about some of those customers. Like some, like we tell customers, no,
we're not that kind of company for
you. Like we will, we are like just
last week, a customer asked us for a feature and I told them we
will not build this.
In a like customer-centric way for you. We will build this for all customers in
a pattern. And it is our job to be custodians of what good
practice is because product management is about seeing patterns in the
market and building for best practice, not building for a one
specific customer use case. Like you have to always ask this question,
are they doing something wrong?
And are trying to bend your will and the tool's will for
the wrong process and practice, or are
you uninformed and now learning something new that can scale to maybe a large
cohort of your customers? Maybe not, maybe not all customers will need it, but maybe
a significant portion, like 20, 30, 40, 50%, maybe 100% of customers will
need it. And so if that customer is kind of like a one-off and they're
like really asking for things you've never heard about either. They're doing something funky
or they're onto something and you have to quickly validate through
pattern recognition. Are all these other customers willing to join in or not? And I
guess that's just, uh, is that also just like an art kind
of thing? I think it comes back to like talking to a lot of people
and having a decent enough memory to remember what they all talk to you about.
But I think you start to see the patterns. I think you become an expert
in customer problems and pains. Like we just had
this really lovely like sales conversation where this customer opened this RFP. We don't know
if we're going to get into it, right? We applied for this RFP.
They invited us. We're one out of a dozen vendors, but a really good
sign that the conversation went well is they booked an hour and a half with
us. We spent 2 hours with them,
major American company, conversation overflowed. We were always
engaged talking about problems and how we're solving it and the why behind why
we designed. There's this like very deep, I understand their pains.
I really understand their pain. I see it day in and day out. Like I
can, I can tell you if you're on a current tool, what pains on that
current tool you're facing, I can even estimate how much you're paying for it and
what your developers don't like about it. Like we've gotten
that deep. Um, and I think you have to get into that deep. Like you
have to enjoy understanding your customer's pain
so much so that you can articulate it back at them and they're like,
Yes, that's my pain. That's what I'm currently
feeling. And you hit the nail on the head. Then it becomes, okay, what's your
manifestation of solving that pain? Why are you
10x better at solving this pain than my current
offering? And then that becomes very interesting. And if your
manifestation can live up to that expectation, you will have
customer delight. And we confuse a lot of customers. We are beating
competitors who are like making $300 million, $400 million
in revenue, been around for 20 years, and we're this much smaller startup that's
kicking them out. And one of them was so contentious, they tried to send a
board member to our customer to meet with them because they lost
the bake-off, right? And so it's interesting when you see that kind of stuff,
that means you're doing something right. That's amazing. Okay. So you
gotta be fluent in the problem and
being able to talk about that, understand their problems, know it inside out.
Last question. It's a big one. Startups are a
mind and execution game, nothing else. That's a quote.
That's your quote. Well, it's true. I mean, look again,
companies die by suicide, not by competition. And so
the quality of the founder's mindset really matters here.
Like you have to be very honest with
yourself and honest with your team. And you have to kill
your ego in many ways. Like I came into it, oh my God, this is
my third startup. I'm going to kick ass. Like I was
like very like in my own head and then you get very
humbled very quickly. And the fascinating thing about YC,
like I'm 36 now and you see
these 26-year-olds crushing it and you're like, there's a lot I need
to learn. And you have to catch yourself because the lows of a
startup are very low. Like you lose a big deal or you don't get
selected or you, you spend a year with no PMF and you're going through pivot
hell. Like we went through pivot hell. We talked to our friends who are doing
companies that are going through pivot hell and pivot hell is not
fun. Right. And it erodes your confidence in yourself in a
lot of ways. Like a lot of times I was like, I don't think I
can do this anymore. Like this is really, really,
really hard. And luckily I have an amazing wife and a great support system
and a lot of reasons to keep pushing on. And I know this for a
fact, like just keep your head down and just keep executing and eventually you'll figure
it out. Right. Maybe I mentioned Paul Graham a bit too much on this podcast,
but he's, you know, after he's done what he's done has probably synthesized a lot
of things. It's like a shark, like the cliché thing, like a shark needs to
move to circulate blood through its entire system,
right? It doesn't have a typical heart like we do. And so you have to
be a shark, just constantly moving and trying the
next thing because if you stop that,
you know, you will never reach that either early signs of PMF
or go-to-market fit. And that's the whole thing, right? Like it's a
mindset and execution game. I think that's true. That's the more actually like,
this is like denigrating my own podcast, but you know,
the stuff that there is useful stuff out there and all this stuff is useful,
but it's like, you got to do it. That's the, there's no substitute.
And it's like, you're, you could ignore every single lesson I
feel like and still succeed or follow it all and still
fail. And it's just like,
yeah, mindset and doing it. I don't
know. It's, it, it's this. Yeah. So yeah, I think you're
100% right. Your mindset, like if you think about it, the probabilities are
against you. Like what, 1 out of 10 startups succeeds,
whatever success means. So you have to have a really peachy view of
the world to actually go through the effort
of like needing to get there. And even if you don't, you kind of have
to force yourself to be like, I'm going to figure this out.
I have no option but to figure this out. The only way you
figure it out is you just have a shit ton of conversations
and just execute as fast as possible on trying things, right?
Like give people your tool, even if it's half baked, like get
the no, like there's no harm in getting the no. Honestly, that's just a wealth
of information. I would rather get the no. This is the thing that kills me
about VCs. Just give me the no and tell me why. Right. But instead
of the maybe, I would rather call you up like, you know, 6 months later
after we crush traction to prove you either wrong or right and
tell you, hey, that no you gave me, here's how we validated against
it. Right. And so that's the same thing with like startups is like get as
many nos as possible and then you can move on to the
next thing. Yeah. That's a. That's really good.
I agree. I think, yeah, you want to push
to know. Don't, yeah, get to know. Okay. I know
you got to dash. So where can people learn
more about Corgea? And also I
should say, we won't maybe go into it, but I may or may
not have had a security
Instant on scalingdevtools.com. And Corgea may or
may not have been very, very helpful for helping me
patch those, which may or may not be protected by the time this
comes out. Hopefully it will be. So yeah, it's a
great tool. People should check it out. Yeah, just check out Corgea.
So C-O-R-G-E-A. So we're the only cybersecurity company with a corgi as its
name. So if you look for Corgi cybersecurity company, you'll most likely bump into us.
Give it a try. We have a free tier and just honestly hit me up
on LinkedIn. And if you guys want to ever chat, I'm always
happy to. Yeah, I can vouch for
your interest in security-related topics and
digging into trying to find vulnerabilities.
It's pretty amazing. Yeah. Thanks everyone for listening. Thanks for coming on.
I was going to say also, the final point is that we
had discussed that at some point, I'm just putting it out,
a half-baked idea, DevTools people that like surfing
should do something at some point because we both like it. I know there
are others. I won't survive. I'm a terrible person at surfing, but we should do
something maybe in SF next time. Yeah. Okay,
cool. All right. Thanks everyone for listening.