00:40:33 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:33] S1: So, so a lot around how to build an ecosystem. Yeah. [00:40:39] S0: How to build an ecosystem, how to build trust with buyers, not be transactional. Um I would say are probably the two big things. [00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer?
00:40:49 · Siddhartha Ahluwalia, Varun Badhwar
[00:40:49] S1: And can you share an example of how at Endor, without selling, you are building trust with the buyer? [00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense.
00:40:55 · Varun Badhwar, Siddhartha Ahluwalia
[00:40:55] S0: Um I think the you know, the the examples I gave you going back to the Agent Security League. Um one of the core beliefs in this company is most of the content on our website is not gated. You know, I believe you want people to come learn and educate themselves and not have to fill a form to read your white paper. Um so I think we just have to believe, and then we believe heavily in this idea of a hand raiser. When they're ready, they will hit the speak to sales button, but you don't need to kind of have that everywhere in your website. So everything is gated, a webinar is gated, and this is gated, and that is gated. So I think that's one example. The second example is um, you know, we had invested initial days, we we probably need to go back to more on this thing called lean app sec, which was this idea of building a community for application security practitioners to communicate with and speak to and exchange ideas with each other. Um, that's another one. Another one is like all of my sales team and go to market team. Anytime a customer says, Well, we're trying to hire for these security people, well, we don't have a recruiting business, but we are generally very particular and trying to help our customers navigate those conversations because again, it builds long-term trust as a partner. We basically do things that allow us to be a partner, not a vendor to our customers, if that makes sense. [00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security?
00:42:18 · Siddhartha Ahluwalia, Varun Badhwar
[00:42:18] S1: And let's say who would be the other players in this market that you respect in app security and code security? [00:42:27] S0: Uh that's a that's a good question. Look, I think the um the question I think I I maybe answer that slightly differently is where are the most logical places that we can insert security that is most native to the experience? And I would say like GitHub comes up as an obvious answer, right? If if you could have security just be transparent, you don't even know it is there, it just works. Developers love GitHub. If you and I think GitHub had initially made some really good investments, you know, I think over the last year or so they're trying to figure out their strategy on some of these things. But I have a high degree of respect for GitHub for what they've delivered around that. Um, so I think that's one. Uh beyond that, I think without naming specific companies, I'll say there are there are some of them that have truly taken the pain of figuring out what are real developer problems. Let's not just build another compliance reporting tool. But like what are real problems in the workflow and solve them? And I think those companies that will tend to do well versus ones that'll put some checkboxes. [00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market?
00:43:38 · Siddhartha Ahluwalia, Varun Badhwar
[00:43:38] S1: So let's say now coding market is getting reimagined. Uh so what percentage of coding market would be the app security and the code security market? [00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along.
00:43:52 · Varun Badhwar, Siddhartha Ahluwalia
[00:43:52] S0: So it's a great question. And I kind of maybe go tie back to starting with the at the very top. Most companies security budget is about 6 to 8% of IT budget. Then kind of we use that same formula as we're defining cloud security to say, what should a company that spends a million dollars a year on AWS be spending for security of AWS? He said probably about the same. We solved this problem first at RedLock and Prisma Cloud. Then cloud providers started charging the same way for their internal security tooling built into their platform, 10%, X percent. So I think generally it's pretty safe to say if you apply the same formula forward, is that overall of your soft, of your STLC budget, about 10% should be security. Now the STLC is not just your GitHub license, because like I would argue with you, actually let's take GitHub as an example, very fascinating example. The GitHub Enterprise License costs about $25, give or take, as a number, right? Per developer per month. GitHub's own security product add-on to this costs about $50. So you can argue and say security is twice as much of value than the core GitHub. So I think it is value dependent, but overall, if you looked at IT budget, 10% of IT budget's usually security, so you can kind of play that, play that along. [00:45:29] S1: And do you imagine like how much people pay on cloud security and infra security, they would pay the same for code security and app security also? [00:45:41] S0: Probably more. Probably more. [00:45:44] S1: Why?