Tarun (00:00):
Stop pitching. Just show what you have built. Let the product speak for itself. Welcome to Spotlight
Eric (00:06):
On a podcast about how companies are built from the people doing the building. One messy, exhilarating decision at a time. Welcome to Spotlight On, I'm your host Eric Wolford and I have with me Ta Taur, CEO, and founder of VA a Torun. Tell us a little bit about va. A
Tarun (00:26):
Great to be here. Thank you so much, Eric with VA a, we are building a identity security next generation identity security company and the company's about 200 people big. We're about five years old, about 200 customers across all Fortune 500, fortune hundred. And
Eric (00:44):
So you're very enterprise focused? Yes. You're a very big company.
Tarun (00:46):
Yes. Top down? Yes. Okay. Yes. 90% of the team is in the
Eric (00:49):
Us. Okay.
Tarun (00:50):
10% of our team is in Sylvania, Eastern Europe.
Eric (00:53):
Wow.
Tarun (00:53):
And
Eric (00:54):
Slovenia. Sylvania. Okay.
Tarun (00:56):
We'll come back to
Eric (00:56):
That. Let's talk a little bit about your origin story. I know you began working in some very large companies, but then at one point, this isn't your first startup, you did another startup. Don't tell me too much about that, but just what was it like doing your first startup and how is it different doing your second startup?
Tarun (01:15):
Look, I come from a very entrepreneurial background growing up as a kid and you right? My first job was writing assembly language code in a company called Seagate and from there into compact and I was very fortunate to be part of the data domain family and really saw what great scale looks like. And I have a great product.
Eric (01:34):
Market data domain was a great
Tarun (01:35):
Company and so it was very fortunate in 2014 as we were finishing that journey, I thought I would just join another company. But we ran into this idea and I didn't really know that we are starting a company and so say the first time being a founder from 2014 to 2018 really didn't know what it means to start a company and what means to build a
Speaker 3 (01:58):
Company,
Tarun (01:59):
But yet I learned so much and that company was acquired called DAOs. I was acquired by Rubrik in 2018, but I was very convinced that I want to go do this again because I learned so much how to build a team, how to raise money, how to think about product market, so on and so forth.
Eric (02:16):
Yeah. So what gave you impetus to start vesa?
Tarun (02:20):
Both of my co-founders and myself, we've been building data companies for scale, at scale, I should say from file systems to data management systems and data protection systems. And so when we were leaving 20 19, 20 20, the question we were thinking is what does it take to go secure access to data? We have so much security tooling in the world from network to endpoint to SaaS,
Speaker 4 (02:45):
Yet
Tarun (02:46):
There's a breach every week.
Speaker 4 (02:47):
Why
Tarun (02:48):
Is this happening? And so we started this company with those thesis that look, what does it mean to go secure access to data at those times, data security was a big, big theme back in 2020. And so we took that insight and this was my biggest learning applying the second time is even though we had our own insights and our beliefs that look, there's something broken here. We essentially took nine to 10 months, took that idea of insights and just met prospects. The first employee we hired was an SDR, not an engineer, not a designer, not a product manager. We went and hired an SDR and we said, Hey, it is a one pager pitch. Could you get me in front of five prospects a week? Product team, capital, everything is important, but the number one is market.
Eric (03:40):
Okay, I see. So understanding the customer's purchase need,
Tarun (03:44):
Correct. And understanding is this the why now? There's always problem to be solved. There is why now and why ways and why anything. But I believe the why now is the most important.
Eric (03:56):
Reflect on one of those conversations if you could with those early prospect customers before you had a product that helped influence and shape the product you were going to build. Describe one that was influential.
Tarun (04:07):
Yeah, no, I think this was about six to eight months and we were going down a path of building a data security platform where we wanted to go solve the problem of scanning and classification in the cloud. And this was a very large customer and they were like, look, why would you go solve this problem when there are end number of tools available to solve this problem? But I have this problem, I have these users who access data and I have no way to know who's accessing what. He said it in such simple ways.
Eric (04:38):
I see.
Tarun (04:39):
And this guy,
Eric (04:39):
So instead of securing the data, it's looking at the access to the data. That's who has access to the
Tarun (04:44):
Data. And we never thought that's a problem. And he was so nice. He actually wrote a two pager word document, this is what I do today and this is what would make my life better.
Eric (04:56):
Got it.
Tarun (04:57):
So given you're smart guys, can you go solve this problem? User and identity system has access to many, many systems in an organization who is doing what? Can I just get that baseline? Can you be that x-ray machine for me?
Speaker 4 (05:14):
Got it, got it.
Tarun (05:15):
And so I think that was the most exciting time in our journey where we looked at that and said, this makes so much sense. You get that. And we said,
Eric (05:25):
So such a simple question. Who has access to what
Tarun (05:28):
And who can take what action?
Eric (05:31):
Okay, so it's not just who has access to what, but what can they do?
Tarun (05:34):
What can they do? And so we said, okay, there's something here. And then we just took that thread and we just kept pulling that thread and we started, the next 10 conversations were about that problem statement.
Eric (05:47):
And what was the response?
Tarun (05:49):
That response that was very, very positive. And they were like, this is a real, real problem if you guys can go solve it.
Speaker 4 (05:56):
Got it.
Tarun (05:57):
And that led to having that, I call these moments as founding moments. You may start a company, but then you need these founding moments when there are many, many of them in the company building journey. And that was the founding moment for the company where we actually realized that that's pretty pivotal.
Eric (06:17):
You adjusted, you adjusted what you thought you were going to do a bit based
Tarun (06:20):
Upon. We pivoted
Eric (06:21):
Based upon the customer's feedback.
Tarun (06:23):
We pivoted in the first eight months that look, instead of solving the data security and the data governance and the data lineage problem, let's go solve the data access problem. And that became a founding moment for the company. And we said, okay, we're going to put our head down, build an MVP as fast as we can.
Eric (06:40):
You said you had founders, this is for everybody's benefit. Did you have one founder, two co-founders, Eric
Tarun (06:45):
With three of us. Rob Witcher who's our chief architect.
Eric (06:49):
Okay.
Tarun (06:49):
I've known Rob through the data domain times. He's a puzzle maker. And Lou, I met him at IBM research in Albert and I've known him also for 10, 12 years. Probably the most algorithmic CTO that I've met. Very smart, very
Eric (07:03):
Technical. So you had prior relationships,
Tarun (07:05):
Correct?
Eric (07:06):
This wasn't any founder dating arrangement by US venture capitalist?
Tarun (07:10):
No. Okay. Look, I believe for founders out there and entrepreneurs that this is such a special relationship not in year but decades enduring durable relationship that the only thing that matters is trust.
Eric (07:24):
And are you still together?
Tarun (07:25):
Yes. We'll be together for, there's always highs and lows, but yes, we'll always be together. These journeys actually bring you a lot more together.
Eric (07:36):
Yeah. Yeah. That's pretty cool. Okay, so you get your first funding, you start out to build the product. What was the first big uhoh as you went to build the product?
Tarun (07:46):
Very quickly, Eric? We realized from MVP into nine months or six months, this is a very large scale problem because the cardinality of this
Speaker 3 (07:55):
Problem,
Tarun (07:56):
You may only have 5,000 users in organization, but if you have access to 50 different systems with each permission and entitlements,
Speaker 4 (08:03):
I see
Tarun (08:03):
This is a large scale data problem.
Speaker 4 (08:05):
I see.
Tarun (08:06):
And one of the moments that came in our journey is like we actually need to go study how to build pagination and graph.
Speaker 4 (08:14):
I see.
Tarun (08:15):
We have never solved those hard technical problems. How do you visualize that at scale?
Speaker 4 (08:20):
I see.
Tarun (08:21):
And so what my co-founders and I ma and I specifically did, we found the best graph professor in us. Georgia Tech has the best graph PhDs. We found Professor Polo and we read 10 of his papers and we did 20 calls with him that hey, we want to understand how to do graph visualization at scale.
Speaker 4 (08:41):
That's great.
Tarun (08:41):
That's the problem. State we went to him and Professor Polo, he has written 22 papers. His students now are at Opendoor ai.
Eric (08:49):
Got it. Wow. That's really good. How in the world did you get pick one, let's go Blackstone. How did you get Blackstone? Who I presume now as a customer is that very
Tarun (08:59):
Customer and an investor.
Eric (09:00):
And an investor. Okay. So Blackstone's big name, big huge firm for sure. One of the leaders. How in the world did you persuade them or develop a product that they wanted? I describe that process.
Tarun (09:16):
We pitched it to Adam, the chief information security officer of Blackstone on a Zoom call who took a call from SDR and he said, this is great. And he said, there are three processes I want to go solve, access reviews, lifecycle management and access request. I said, great, Adam, where can we start? We cannot do 10. He said, I want you to go solve access review problem because third one, that's an end user business process and that's number one, immediate pain. So follow the pain. He said, Hey look, if you can take what you have built and wrap a workflow around it, you already have the metadata and the data set you need to build a workflow around it. Got it. So I can issue Recertifications off of Visa.
Eric (09:54):
Got it.
Tarun (09:55):
Then you have something,
Eric (09:56):
What was it that you think he saw in Visa early on that caused him to even want to lean in?
Tarun (10:00):
Some of the biggest customers we've been able to close and win Workday, capital One, Intuit, KKR Cargill. So the reason why we are able to close some of these very large enterprises is we are showing them something that they know implicitly but they've never been able to see. And I think every time we show them this entitlement view, the identity to entitlement map, that access path, their eyes, just like the
Eric (10:30):
Aha moments is what you're
Tarun (10:31):
Saying. I'll give you one more.
Eric (10:31):
It's only one of those founder moments. An
Tarun (10:33):
Yeah moments.
Eric (10:33):
It's an aha
Tarun (10:34):
Moment. I'll give you one more and this is actually, I always pull on this one. David Reky, the chief information security officer of Wind Resorts COVID 2022 on a Zoom call, takes a call from SDR, his videos off 25 minutes of a 30 minute call. That's all you get with a ciso. And I kept yapping and yapping and yapping pitching hard. I was alone. And I said, this is not working because you can see from a discussion. And I stopped sharing, stopped drawing. I actually brought out the demo and he immediately turned on the Zoom video and he said, could you just have started there
Eric (11:16):
Instead of
Tarun (11:16):
22 minutes?
Eric (11:19):
So that may lead us to one of your best learnings, but keep
Tarun (11:22):
Going. And this happened to me from there on Royal Bank of Canada, Adam Evans, the chief inflation security, I kept pitching to him.
Eric (11:32):
That's noting that's a great
Tarun (11:33):
Learning. And he's not responsing,
Eric (11:34):
You were excited about your pitch, but he was excited to see your product.
Tarun (11:38):
Yes.
Eric (11:39):
And that's my learning that in
Tarun (11:41):
The early days, stop pitching, just show what you have built, let the product speak for itself.
Eric (11:46):
So you're saying that that experience that you had with David was then transferable to future interactions you had
Tarun (11:54):
And
Eric (11:54):
Then it made you much more effective.
Tarun (11:56):
Absolutely.
Eric (11:56):
I'm sure when you take someone like JP Morgan or pick any of these others, the amount of potential places to deploy access control or permission visibility, who has access to what is vast? Describe to me a little bit the progression that some customers take. They start here and then they go here and then they just describe that Absolutely. The land and expand
Tarun (12:23):
Motion. Look, we are a land and expand business through and through. We have two lands or two lanes that we try to land. The first lane is what we call the x-ray machine, the visibility, intelligence and monitoring. And the second lane is identity governance. And so we land 70, 30, 80 20, 65, 35 depending on the quarter. And we try to land, customers will want to say, Hey, we want to apply this visibility for 10 to 15 systems, visa for Salesforce, visa for Snowflake, visa for file shares. And so that's the land and it's a very fast land for us. And our expansion, our enterprise NRR is 147% and all the reasons behind it. Our expansion,
Eric (13:11):
That's pretty big.
Tarun (13:12):
Our expansion in enterprise is we're expanding either adding now I want to add a hundred more integrations or I want to grow from human to non-human identities or we want to go from the visibility product to the workflow product. And so I think those three become our vectors for expansion. And so the framework we've been using, thanks to you, you've been coaching that is something new to something old and there is a lot of something new coming. Our go-to market motion is land and expand, buy mortal, go-to market. We are mid-market. And that's another thing I would suggest to follow entrepreneurs and founders is it's fun to work with the cooks and the Coca-Colas and the Adobes and the ServiceNow of the world iconic brands, but there is a lot more fun if you can have these two motions going in parallel.
Eric (14:06):
Got it. So a middle market and an enterprise motion,
Tarun (14:08):
Middle market and enterprise, if you can get these two motions going early, you'll get a lot of good feedback to come back to N Generic
Eric (14:14):
Probably while we're there. You might as well talk a bit about that. Can the same person do both or do you find you have to have different people focused on those two different motions?
Tarun (14:22):
Sales teams when it comes to selling, you need two different teams. The same individual who's selling to a Capital One is not an individual who will go sell to Robinhood. You need two different teams. You need to keep the messaging, positioning simple, what we call the lollipop slide. Here are the seven things you do very much use case based selling is the word we use. Case
Speaker 4 (14:42):
Based. Okay,
Tarun (14:43):
We solve seven problems, two problems we are very, very good at. And here are four more problems we want to solve. And give you very simplistic view. Like some commercial customers or mid market customers may only want to buy visa for Snowflake. That's okay. There's enough value there. And so I believe bimodal go to market is an important concept, especially in cyber.
Speaker 4 (15:10):
Especially
Eric (15:10):
In cyber.
(15:11):
Okay, that's very helpful. I'm going to go back on the timeline just a touch. I'm glad we moved forward, but let's go back just a touch to the point where you felt confident you had product market fit. When was that and what was kind of the signal to you that you thought you had had it for at least not MVB but at least act one, you know what I mean? Which would be the visibility product. When did you think, oh, I think we have product market fit, I want to go spend a lot more money?
Tarun (15:40):
It was late 2023, so three and a half years in our rep called from Chicago and his comment was that if I can sell in Chicago, we can sell this shit anyway. And that is when I realized the act one can sell on its own.
Speaker 4 (15:59):
I see.
Tarun (16:00):
And because I've realized,
Eric (16:03):
Oh, because he was selling in
Tarun (16:04):
Chicago by himself.
Eric (16:05):
He was selling by himself in Chicago and he was not a specially trained person. He was just a normal, just a rep, sales rep. And he was selling all by himself in a market that is Chicago, not definitely a competent market, but it's not like it was just techies. That's exactly
Tarun (16:23):
Right.
Eric (16:23):
And that is what gave you the feeling that I think I have product market,
Tarun (16:28):
Not only was he not selling, he was able to build very sustainable, durable pipeline out quarters.
Speaker 4 (16:33):
Got it.
Tarun (16:34):
And I think he was like, if I don't get a on this quarter third, it's coming in two quarters. That knack. I think only salespeople, good salespeople, great salespeople have
Speaker 4 (16:48):
I gotcha
Tarun (16:48):
That not only can I not sell this thing, but there continues, let me do 10 calls and if eight calls are moving to the second, to the third, to the fourth that you know have a repeatable motion.
Eric (17:00):
So given that you achieved that, what is it that now that you have product market fit, what did it mean you needed to do
Tarun (17:07):
In cyber? It's very important to have a very simplistic wedge because you don't want to be too disruptive to an existing ecosystem because nobody trusts you in cyber. And so we started with a visibility plane and what we realized three years in that hey, one school of thought says you have product market fit, let's just go as fast as we can. But what became very apparent to us is if you really want to go scale fast in our language, you want to do triple and doubles and doubles every year, you need to now go into a very well-defined budget.
Speaker 3 (17:46):
It's
Tarun (17:46):
Very in cyber, very important to go replace something and be better than what exists. Something new to the something already. And so that led to our act two. Our act two became the identity governance, identity visibility or identity risk to identity governance. And my all thanks goes to Intuit. They were the ones who said what you have is great. We wanted to go build identity governance,
Speaker 3 (18:12):
Fast
Tarun (18:13):
Forward four years, largest paying customer, they have the entire platform, they own the entire platform now four year plus customer for ours. And that became our act two. And I will be forever grateful to organizations like Blackstone and Intuit.
Eric (18:30):
How did you, you've described your reaction to finding product market fit with act one and its impact on your product vision and your product roadmap. What impact did realizing you had product market fit have on your go-to market and your expansions there? What did you think you needed to do?
Tarun (18:52):
Yeah, no, I think what we realized, a we need to go get sales teams fired up and up and running quickly. And so we've scaled our sales team close, close to 30 sellers now from eight. And I think when expansion is where we realized pick up these new things that are coming, the non-human identity, the identity we'll talk about in a shortly, that when you land land with the visibility and give them three options, next gen privilege, access management, next gen, identity governance, and you need to be good at one.
Speaker 3 (19:31):
You
Tarun (19:31):
Don't need to be good at all. And customers realize that. And what we learned, especially in identity, I'm not a network security guy. I'm not an endpoint security guy. What I learned in identity is organizations are looking for a platform. There is so much of segmentation and fragmentation in the existing identity market duo for MFA, Okta for single sign on CyberArk for Pam CrowdStrike for ITDR. Too much fragmentation. And we had to go very early on, we have seven shipping modules on a platform that became very important.
Eric (20:06):
I see. So customers were giving you that feedback that you needed to have a more broad product vision in order for them to select you as a strategic
Tarun (20:17):
Strategic vendor. Vendor. Yes. And for another thing that I've realized
Eric (20:21):
In inside, you couldn't have just rested on your laurels of visibility. You had to, in order to get that wonderful net dollar retention expansion percentage that you have, you had to expand the product portfolio.
Tarun (20:34):
Two stories. Two stories. This goes back to the founders as you said. Are you still guys still together? So I went to one of our customers and I said, Hey, the first opportunity we did with you was X and we want to do X plus 10. And he said, tell me if you want to do X plus 10, you need to replace something for me and then you can have x plus 10. And that happened a few times with me and I went to my co-founders and I said, we need to go build this new product and four months of intense debate. Imagine a startup, you want to just
Speaker 3 (21:06):
Go.
Tarun (21:07):
But I think that's where it comes from, that intellectual honesty, that intellectual bonding where we spent four months debating because we realized what we were about to go into.
Speaker 4 (21:21):
Got it.
Tarun (21:22):
This was not just let me build another extra machine. This is now we are going from an extra machine. Visa is going to be a platform for onboarding employees and that platform better be robust.
Eric (21:35):
I got you. That totally makes sense. Since we're on the topic, let's hit AI euphoria. That is everywhere in my world. In your world, describe to me how do you see in the world of identity and the world that you're in your opportunity to address all of these emerging identities that are
Tarun (22:00):
Agents? Yeah, no, I think, look, this is very fascinating. This is again, founding moment. We talked about we get founding moments in the company inherently we want to go apply AI in our products example rather than somebody typing a structured query. Now you do natural language. What does Eric has access to Google search. So I think that we are leveraging AI as fast as possible. Whether it is a graph, whether it is writing code, things like Cursor or Uni or many
Eric (22:28):
Other things, what's in the product and how you build the product are being impacted.
Tarun (22:32):
That's exactly, it's giving us a lot of leverage.
Eric (22:34):
People leadership, there were three of you. I'm sure being a leader of you and two founders was super fun and a certain style of leadership that was required. What has changed in you? What has been required of you to change to lead 200 people?
Tarun (22:51):
I had realized in my first journey how important it has when you want to scale. I use the word Dunbar number D-U-N-B-A-R 1 41 51 60 doesn't matter. You get to a point where the company goes a little bit into crisis three founders running with a hundred engineers and that breaks and it doesn't work the way you communicate, the way you talk on Slack, the way you do emails, the way you make phone calls, all of that doesn't
Speaker 4 (23:23):
Work.
Tarun (23:24):
And so you have to refound yourself and you go through refounding. And so I think three things that I have to your question, there are three things that have still learning and still a student.
Eric (23:37):
It's a work in progress,
Tarun (23:40):
It's a whip one. It just starts with patience. I think patience of when you hire somebody, it takes time. When you hire somebody when you're four, they can ramp faster. But when you are 150 people, a leader is going to take time and you just need
Speaker 4 (24:01):
Patience.
Tarun (24:02):
My second learning has been hire elite leaders. Take your time back. Channeling reference, not just one meeting, maybe six, nine meetings. Leaders, I'm talking about leaders is it's so very important to take the time.
Speaker 4 (24:20):
I see.
Tarun (24:21):
And you're looking for what I call first principles, systems, mindset, passionate problem solving mindset. Do they understand cybersecurity? Because here is the thing, another thing I've learned in cyber, you cannot hire an individual from Snowflake or a Datadog and say, can you be the leader for cybersecurity? Cybersecurity is a special art of selling and you need that mind. The third thing that I've learned is look, just managing your own emotions and your own intensity, if I can use that word, the way you would talk to your co-founders or the way you would talk to the first 10 employees is very different the way you talk to the rest of the leaders. And so I embraced, one of the things I did is very early in this journey, I had a leadership coach and she was awesome, but she's like, I'm retiring, I'm leaving for Boulder. And she helped me find my second leadership coach. And that gentleman has been transformative for me.
Eric (25:28):
Wow. That's very mature of you to sort of have some self-awareness to realize that as this company grew and scaled, that you would benefit from a leadership coach. And instead of pushing on it, you welcomed it in. How did you come to that kind of
Tarun (25:45):
Self-awareness? At end of day it's what you're going to work with some people and not the walls of a form, but with people. And I learned through some very hard lessons how important it's to find the right investors and the right board members and right partners beyond your employees. And so how I came to this conclusion is I remember somebody mentoring me is like, look, this opportunity is so massive for you. It's so massive that you
Eric (26:19):
Should give reinvent
Tarun (26:20):
Reinvention. We all have our own.
Eric (26:25):
The scale of the opportunity was so exciting that it caused you to reflect on yourself to go, maybe I need to,
Tarun (26:32):
I just also need to be
Eric (26:33):
Man up for this game.
Tarun (26:37):
That's a better word that I had to go through my own growth. And when I came to this realization that I'm not leading a 10, 20, 50 member remote team in Sylvania, we are leading
Eric (26:53):
A diverse group,
Tarun (26:55):
Elite leadership team. And this is just the fifth year, a 10th year we'll have the next elite leaders.
Eric (27:03):
I know you're just mid journey. I know there's still, there's a lot for you to learn. There's a lot that is in front of you. But for those who are two clicks behind you that are just starting to come up, you've gotten to your D round, you raised a hundred and something million recently, so I mean you've accomplished something right now by no means the end, but what's the advice you have for a person who's just starting? What is something that now that you've done it a second time, what would be
Tarun (27:32):
Something you'd even do differently this time? Just a lose your focused on the market. Be so dispassionate with your own ideas. We all start with some passions. I want to go build an electric car. Just be dispassionate, detach yourself. Don't get so wound up around your idea that that is the only idea. No, the only truth is with the customer and the market. You don't have the truth. Remind yourself and be humble to realize that. Number two is culture. I think it's so important. Not just values, virtues, behaviors. I'm just starting to realize that. And partly I think this is cover, Eric building a company in a home in a zoom for the last four years of our life was hard. Not only hard for culture, forget the heart. Yes. It was hard for the culture. The teams coming together, the teams marinating with each other. I think that was one of the reasons why data domain was iconic. We were together. Frank would come every Friday for a lunch meeting and he would give his speech. But I think that was,
Eric (28:45):
I'm
Tarun (28:45):
With you. It was the fact
Eric (28:47):
The company. That's really good dude.
Tarun (28:48):
And I think that was, I'm realizing how hard it is to
Eric (28:53):
Get culture
Tarun (28:54):
Right scale in a COVID company when you born COVID.
Eric (28:57):
That's really good.
Tarun (28:59):
And the third thing I would do differently is hire leaders. For stage fit, you can hire an elite leader, elite resume home runs, but stage fit is very important
Eric (29:17):
As a translation for the audience. Stage fit might mean that for an early stage, this person is perfect as a leader, but maybe mid journey, they may not be or they may be excellent for later stage, but definitely not great as an early stage. And you're saying add that to, it's not just is the person talented and can they do the job, but are they appropriate for the size, scale and the mission for the next two years or three years? That's exactly right. Now there are people who can go the whole way. Correct. But a lot of people, I hear what you're saying, are more stage appropriate
Tarun (29:51):
And you may still be a systems person.
Eric (29:52):
Yeah.
Tarun (29:53):
But you need systems for, it's very good. 500 people, not 5,000 people.
Eric (29:57):
Thank you very much Eric.
Tarun (29:59):
Thank you
Eric (29:59):
Much. I appreciate your time and keep going my friend. Thank you so
Tarun (30:02):
Much.
