The Creator of Exposure Management w/ Jennifer Johnson (JJ). On Category Creation, IPOs, and the Future of Cyber Marketing in the AI Era

JJ, it is so nice to have you on the Noise to Signal podcast. You are one of the elite CMOs in cybersecurity. You were if I remember correctly, you were the CMO at Tanium, and then you were CMO at Tanneval. You didn't did a bunch of non-security companies and then you came back and you know became the CMO at CrowdStrike, one of the premier organizations for cybersecurity. And I came to know about you.

just around the time you were joining Tenable, I not I had not known much about you. And my recollection of my time at Tenable was I always saw you as, or at least the the really recollection I have is yeah as a category creator. You're somebody who creates categories, defines categories, and then goes from there. So my first question to you, JJ,

Do you still think yourself as a category creator first and a CMO second, or are you a CMO first and a category creator second? What's your thinking on that?

It's such a good. Well, first of all, thank you for having me. It's great to see you again. you know, I think I would have had a different answer for this seven or eight years ago than I do today. So, well, first and foremost, I've been a CMO, right, for now 15, almost 15 years. the the role that I played at Tenable, and I know we're gonna go into that a little bit more. I mean, I was already a CMO, but the role that I was really

You know, the mission, so to speak, of of joining was to really help Tenable build a superset category on, you know, using their their vulnerability management core as the foundation for building a bigger category that then we could, you know, you know, both reposition the company for larger growth, expand to the platform, go public. So my charter there was very much a category creation charter.

So if I was answering this question back at Tenable, I probably would have said, I am the CMO, but I am a category creator. Now here we go fast forward almost 10 years. and I'm really excited to talk about this story because it's like very rare when you can actually have a 10-year horizon in which you can actually talk about what happened and then look almost 10 years later and the story unfolds. So I'm super excited to have this conversation. But I think if I were to answer it today, I'm definitely a CMO and first. And I say that because

You know, I've built my whole career, you know, for the last fifteen years, you know, I've built my career about around being, you know, a CMO. and I did leave cyber for a period of time and I came back and I made a decision. I wanna be as the best CMO I can in the, you know, the best brand in cybersecurity possible. And so I'm really fortunate that I actually made it there to CrowdStrike, which I d which checks that box.

And so I am a CMO first. And I I think that you can use the skills of category creation to help drive your marketing strategy, like your like having a point of view, positioning, how do you build market awareness? How do you work with the analyst community? how do you drive growth? I mean, everything is in the spirit of of of course driving growth and and building market share and leadership. So I think a lot of the key the the principles apply. but I'm a CMO.

Awesome. And you know, the you know, when you came on when you came on and you know, I I recognize that you are a CMO first and a category creator second now. that's completely acceptable. but you know, my you know, when you came on and you were very big on this category creation play, and this word was so foreign to me, what is she talking about? Like what is this category? We are a vulnerability management player, like what other categories are are there? I'm curious, like somebody like you who has been

elite CMO in cybersecurity, what does what is what is the process to create a category?

Yeah. So so let me ask you I'm gonna answer that, but I wanna ask you a question. Were you w were you skeptical? Right? Because you're c you're con you came from a technical, you're in a technical background. You were an engineer, right? At Tenable? Okay, so what was your when someone said, we're gonna JJ's coming, we're gonna build a category, like was your initial

I can believe it. I Exactly, exactly.

My initial impression of well, this is another marketing campaign because you know the marketing people come and go all the time. In and this is this is something that I've seen in many organizations. It's one of the most fragile jobs in the industry. Right? Yeah especially in my previous job, you know, marketing, some marketing people come in a year or two and they're out. But then and but this word was never spoken of. Category creation was never spoken of, it was always

It was always spoken in the cons in the context of a campaign. We are going to launch a new campaign, we are going to do do X, we are going to do do Y. And so my mental model was this is another new campaign. This is a new campaign from a marketing perspective. So I didn't completely understand the category creation at that time, but in the fullness of time, I've realized what that really means because I guess one of your lasting legacies is the category still exists. And the company still exists and the company is still an exposure management company, which is like a completely redefined.

And I have come to appreciate what real category creation means compared to a marketing campaign. I don't know if I answered the question, but like that's my that's my like two two minute summary of what I thought of what it was because it was very confusing. It was almost like, from my perspective, it was almost like an identity crisis. You know, here's a new person that comes in, hey guys, thank you for your service. But we are an exposure management company from now on. And like, what is she talking about? We have a VM company.

Yeah. Yeah.

Yeah. Yeah. Yeah. So let okay, so I'll so thank you for that. so the first thing I'll say is, you know, there's so there's a book called Playbigger and Playbigger also you know, I worked they were they were a group of people that that wrote a book on category creation called Playbigger. and if you haven't read it, please read it. It's it's now, you know, ten plus years old, but it's a good read. and

So yeah.

The people who wrote the book also had an advisory. And I got to work with them and do some category creation with them between Tanium and Tenable. So when I went into Tenable, you know, I had this, you know, I kind of went through the the category design, you know, you know, crash course, right? Like, you know, immersive experience, right? And and and one of the concepts in in Playburger in the book and is around this concept of a of a magic triangle. And

A category is really the center of what brings together the company strategy, the product strategy, and the market strategy and the marketing strategy. And what I'd say is a a mar you have to have all three of those, right? And so so what do I mean by that? Like if you have a if you have the marketing strategy around a category, but you don't have the product strategy to to follow suit, then it becomes a marketing campaign because all it is is a message and a story, right? And so, you know, you have but if you think about

Yes.

the can't so a product strategy without the corresponding marketing strategy is a roadmap, right? And so if you take these things that seem like, you know, functional exercises, but you put them together, right? Like category creation, first and foremost, is it's it's about creating a new like creating and defining a new container in which you live where you are the best and only option, right? And the answer to this problem. And it all starts with with the problem. Now in Tenable's case, you know, Tenable was the

You know, the founder of a creator of Nessus, which in the vulnerability management world was the kind of the the the the first vulnerability scanner, if you will, probably one of still of the most ubiquitous tools deployed. It was, I think, the number three most ubiquitous security tools deployed when I was a tenable. and that kind of evolved from from scanning and vulnerability assessment to vulnerability management. but it still was tenable was still for the for the most part a a single product.

Mm. Yeah.

company. Now they were moving to a platform, but it was still a single product company in a single market, which had a nice TAM total adjustable market, but it was about a billion, billion and a half, right, at the time for for VM. and, you know, there there was, you know, fierce competition, right? It was Qualest, it was Rapid Seven, it was tenable. you know, this the three are still are still out there. and and and the company had, you know, wanted to to kind of push

Okay. Yeah.

Through like decent growth rates in VM, right? Growing, it was probably a low to mid double digit grower, right? you know, not 20%, I don't even think back then. So, you know, how do we accelerate the growth rate of the company? How do we continue to drive a, you know, a bigger narrative and category, which is gonna help us expand our total adjustable market?

The company was going from a single product to a platform. Well, that's a very natural fit for category creation because now all of a sudden you have multiple products. Well, how do they all come together? And under this kind of this broader platform story that allows you to tell a bigger story, solve a bigger problem, address a bigger TAM, but it also helps you navigate what you're gonna build. Right. And so, so that's kind of the key point here from like, you know, the the product and the market category coming together. The category is about like

What is the problem that we see that we're that in the market that needs to be solved? And then if we frame the problem the right way, how are we the best and only answer to solve it? And for Tenable, it was like going from a very technical compliance-driven conversation with VM, right? How where am I missing patches? You know, where do I have a misconfiguration? To a risk conversation. Where am I exposed? And like, where am I exposed across my entire tax surface? And then how do I quantify that risk?

For the so we can actually do something about it and address it as business risk. And like that's a very different conversation. And so then you start to think about well, tenable only had like one small piece of to of what they even have today, right? And so it it actually helps drive your product strategy, right? Like they didn't have all the answers, they didn't have all the capabilities, but it helped actually create a container which you could grow into.

Fascinating. The question I have in mind is like when you're doing this process, do you then also invent new words to define the categories? Like for for example, the the the example I have in mind is when Netflix was was coming up, they were calling digital the the c common word for what Netflix was doing was digital rentals and they said, No, no, we are doing s we are doing streaming. We are not digital rentals, we are streaming company. So when you go through z go through this category creation process, do you also envision

Because you I remember you you completely you know sidelin VM and the compliance and it was more and the exposure. You're not even talking about risk. Like you were you in there was a new taxonomy of words to use. So I'm curious, like is that also part of the plan that you define, position, use different words that keep people are not familiar with, regardless of whether it is tenable or not. But is that part of the thinking as part of the category creation?

Yeah, I mean like the the the problem, the kind of the from to, we were moving from a, you know, a point-in-time compliance audit conversation to a continuous risk conversation where cyber risk is business risk. So if you kind of use that as the framing, well, then you can kind of look at, well, you know, is vulnerability management that's always going to be the core, but is that really the the category? Is that honoring the new problem that we're solving? And the answer was no, because number one,

X two.

Vulnerability management was already a very well-defined, well-established category. There is an anchor, like sometimes you to change the words because people anchor you in something, right? And so that was kind of one impetus for it. But the other was if you're talking about risk, vulnerability is is a is a good word, but we were thinking, you know, what is another word that really captures from a business perspective what it is that we're we're trying to to to drive here? And it and the word exposure kind of came out out of that.

Yeah.

discussion, the word exposure was teased out of it. Now we had this debate whether, you know, w we wound up like if you go back to our our S1 of our IPO back in 2018, the first sentence of the business section said something to the effect of we are defining a an emerging category called cyber exposure. Now there was also like a debate, do we call it cyber exposure? Do we call it cyber exposure management? I mean it I my my point of view was it's a

It's a life cycle, it's a process, it's not a thing. So we should call it cyber exposure management. But we decided also we should keep cyber in front because we want people to understand that it's about cyber, cyber exposure, cyber risk. I actually didn't win that debate. So they we went with cyber exposure and ultimately Gartner, which I think Gartner did the right thing, which was actually drop the cyber and add it and and add management on it on on the back end of it. But the words matter. Yeah.

Well they added thread. They added the they added thread. well yeah, they added thread.

Yeah, well, it's exposure management, and now they're calling they're combining it with threat. So it's like C so there's exposure management and then there's CTEM, which is continuous threat and exposure management. That's actually also an interesting point because at the time there was VM vulnerability management, and Gartner had had defined this emerging category at the time called TVM, threat and vulnerability management, right? Which then there was also vulnerability risk management. That's what Forrester's version of it was. But

Yeah.

There was a conversation about, well, let's just call it what Gartner's calling it. When I said, if we call it what Gartner's calling it, we're already anchored into Gartner's definition of it. And and we might not even be the leader. So like let's shift it.

Quite so hold your thought. So hold hold your thought there, JJ. So my question to you is who is responsible for creating categories, the vendors or the analysts? This is like an eternal this is like an internal conflict because you know if you do what you did, then you become a category of one. And you then and you don't get any traction, it becomes it quickly fizzles. If it doesn't get any traction, it fizzles out into a marketing campaign. Right? You're the only vendor, you are self-promoting yourself. I say,

Yeah.

Yes.

Yes.

Yes, yes, yes.

We are X and then the world is like we don't know what X is, but we like Y. And then a Y is a very true and tested path. So so my first I guess my question is who is in your humble opinion, who's responsible for creating categories? Is it the vendors or is it the the the Gartners and the Foresters of the world?

Yes.

So, so this is a this is an answer where the the benefit of time has shifted my answer now that I've actually seen how the movie's played out, right? Gartner, I'll take you back though. Like I was, I was listening to a Gartner, the head of research at Gartner talk back in like 2014, and he had this slide, and I'll never forget it. And it was why your category isn't. I will never forget this slide. And it was like, you're to your exact point.

All these vendors, the analyst point of view is all these vendors want this new category, and they're the only ones in the category. Well, people don't buy categories on a market of one vendor. Gartner's perspective is our job is to create categories based on where we're seeing the market heading and there's critical mass. And so, you know, my point of view back when I was creating with Tenable creating exposure management was now exposure management, is Gartner's only

looking in the rearview mirror on this because they're only going to create a category when there's already like critical mass and established players. If you really want to chart the definition of something new, you need to be the first ones out there. And so only the vendors can do it. Now I I've I've I've shifted my perspective on that because look, at the end of the day, the the when exposure management really became a thing that now in cybersecurity, like

Every vendor that's in this space is using exposure management, including CrowdStrike. it that only really happened though because of Gardner. Like you tenable can't take credit for that. Because if it was just tenable and they would have continued just on that path, you know, maybe Qualas or Rapid Seven or, you know, a VM startup would have picked it up, but it wouldn't have had the critical mass that it I think it has now. And I think that really became, you know, that really happened. That inflection point was because of.

Yeah.

the analyst firms picking it up and and taking it and making it making it a thing, right? And so, you know, you need the analyst to actually, you know, build the category. You need the analysts. And, you know, some would say that Gartner's not going to just take something that a vendor does and just rinse and repeat it. They're going to put their own spin on it. Maybe they're going to change some of the words, like even Forrester called it VRM, vulnerability risk management, right? So that's fine. But the whole point is, you know, if they're

If if it's your point of view and your story and your criteria, which in the case of Gartner, it was a lot of like ver al almost verbatim what Tenable's point of view was on it. like that's really when the category went mainstream. So you do need the analysts.

So so I guess what you're saying is you seed your thoughts with the analysts so that they start to appreciate and if they acknowledge their your point of view, they talk to a bunch of their customers, and then you know there is like a critical mass which cre which is created, and then they're like, okay, fine, this looks like a category, let's call it a category, and then go from there. So given you know, given all the category creation discussion that is happening, let's switch to let's switch to the topic that is near and dear to both our hearts, which is exposure management.

So let me let me set the stage. I mean we've already discussed this this, but I want to share the the creation of exposure management category from my perspective. because Tenable is attributed as the company that is the creator, or at least a creator of exposure management category. But I saw it firsthand that you actually behind the scenes it was essentially you know JJ creating the category.

And g I'll give you my perspective how I saw it. You know, I was heading the research team at Tenneville, and I remember we are this is all pre-IPO, we're getting ready for we are getting ready for for the IPO, and you come in and the the the information we had about you, hey, this is a new flamboyant CML. You know, she did the she did the she did the

She was the CMO at Tinium, and your pitch was, hey, two second visibility, or something on those lines. So you basically crafted this narrative for Tinium that, you know, hey, we give you two second visibility. What do you have? And then you know none of your competitors had any answer because if they came back with one second, you know, it sounded like you you're just copying our message, right? So so you so you were brought on into Tenable as the new CMO, and there was a lot of hush hush, hey, JJ is doing something, JJ is doing something, JJ is building.

She's then she's positioning marketing, whatever it is. And we had no clue. We had no clue what is happening. And before before exposure management category existed, there were all these different terms for to describe what we were. We were VM company, a unified vulnerability management company, a risk-based vulnerability management company, a threat and vulnerability management company. there are some discussions about merging this into the SOAR category and all these fractional.

Things that were happening, no one really knew what were what was happening. And then you went into this deep dive, it almost like you went into some, you know, like a two-week, like, you know, like at least that's how it f that's that's how I saw it. You went into this two-week deep dive with your team, and then you come out and you do this all hands presentation. I was sitting in the front row, and you know, and this is where the big unveil, this is the big unveil that is happening.

And and you go through all the problems. And the way that the remember the reason I remember this so vividly is because it was also a very sensory experience. And I don't know if you planned this this way, or maybe it just you know it happened that way, but it was very sensory in the sense that when you were describing the problems, all the slides were black. There was no all slides were black and then the text was white. And then when you when you went to the solutioning aspect, the slides went white and the text was black. And I there was a moment in the presentation when the lights came on when you went into solutioning.

Right. So if we were in a dark room, we were in a dark room, all the slides were dark, and then suddenly when we get into the solution, the lights come on, as if there is like the dawn of a new era. Right? And for me, whoa, what just happened here? This is this is new. This is not what we are used to because most CMOs that came in before you, they were, you know, all they were they had the slides, they had the marketing campaign, they had all these different things that were happening, and you know, colors and images and color palette and typography and blah, blah, blah.

Know what that means, right? But not this, right? And so you did, and you come in, you unveil, and then you said, Hey guys, thank you for your service, but we are no longer a VM company, we are a cyber exposure company, or something along those lines. And that was the birth. And from my in my in my view, that is the birth of the exposure management category that existed. Now, the question I have for you, JJ: this is probably the most difficult thing to do for a new person to do, and basically tell the founders.

Mm-hmm.

Mm-hmm. Mm-hmm.

This is what we are, because you know the founders have built the company, they built the reputation, they built the product, they have a point of view on everything. And here's a new person that comes in. This is what I think we this is what I think it should be. And like this person is like two weeks old. What does she know about her business? Kind of a thing. You know what I mean? Like so there's a lot of tension that happens behind the scenes. Because you're new. Yeah, we granted you're a CMO, but like, you know, you still have to work with the founders. So the my first question is what was that process like?

Yeah.

Because I'm sure it was not as easy as it sounded like. You know, you probably had a lot of starts and stops going behind back and forth because I didn't know it. I it was like, you know, for us you we just saw it when you inveeled it. We never part of this thing, right? So so that's where I want to start. So it's a big, big monologue, but I wanted to start there so that you know the listeners have context of what was happening at Hannibal. So I'll give you the floor now.

Okay.

Yeah. So and I love I love hearing this from your perspective because I had no I I had no idea that anyone outside of the executive team even knew I was working on anything. So it's like it's so funny to hear it from your perspective. And and I'll get to the unveil, but it was all very intentional. So I'm glad that it it it had its desired impact. So we'll talk through that. But the first thing I'd say is, you know, the the the person who is the

I'm also gonna I'm gonna say it's the facilitator of the category creation for a reason because it wasn't just me going in and into a a dark room and and coming out with this brilliance, right? the the art of category design is actually like the the answer is always in the room, right? And like I I think with anything in in marketing, especially with this, is you have to ask the right questions to tease out the right answers, but you need to know when you hear it.

And and then you need to kind of take that and run with it. And so the first thing I did is I told it was a meet Iran, the CEO and the team, and I said, you know, we're gonna go through a process. Cause I think everyone in the executive team is like, what what what are okay, we know why we know what you do and why you're here, but like how are we getting from here to there? So I I I walked through the whole process and I said the first thing that I'm gonna do is I'm gonna give you all 10 questions.

And you can't show your work. You gotta, you have to answer those 10 questions and give it back to me. And I'm gonna synthesize the answers, and then we're all gonna get together and I'm gonna, and you'll understand why I'm doing this. So the ans the questions were: we're really teasing out what do you think the problem is that we're solving? Has the problem shifted since the first problem we when the company like company was founded on a problem? Has that problem shifted? And then what do you think the answer is? I just asked the question. And I got back.

Some things were the same, but in some of cases, I got 10 variations on the answer. So I got everyone together in a room and I showed them the results. And I said, look, I said, part of this is we have to we have to be aligned at this in this room with who we are and what category we're solving and and and the strategy. Because if we're not all aligned, this thing is is not gonna succeed. But I said, I also want to show it because it's not that this room isn't aligned, it's just everyone has a slightly different perspective. And so

When I showed people the differences and the answers, everyone was like, it was like a light bulb moment. And then I said, okay, let's take this. We debated, like, you know, we we went through and we debated them and and and through that conversation, teased out what do we think the problem is that we're solving? And so once I had that, then it's like, okay, now I'm gonna go and we're gonna work to the solution. Now, in the room, every voice mattered, but in the room, there were certain voices that that I'm not gonna say mattered more than others, but

held a little bit more weight. Now I think one of the advantages of when you're doing category creation is when you have the one of the founders or the founders in the room is usually that's where the answer sits and lies. Because, you know, in this case it was, you know, Renault and and Jack were, you know, still in the in the company. Renault in particular, who was the inventor of Nessus and the CTO, like he knew exactly where we needed to go. He had the vision. He needed somebody to help him articulate it and put it into a coherent story.

And so I worked very, very closely with Renault on teasing out the entire story and the vision, coming from this point of, you know, I know the problem we start we started the company around. That problem is now shifted and magnified, and we have to kind of solve it in a different way. And so Renault was really my my partner, you know, my partner in this category creation journey. But, you know, a meat as the CEO, who wasn't the founder, who had just come in a little bit before me as CEO.

That's coming.

You know, obviously he needed to be behind it because if he didn't, you know, this is a story that our company's rallying around, but this is also a st a story that we're gonna be go going public around. So if he's not rallied behind it, it's it's not gonna land. So, like Amit, you know what, while he didn't create, you know, he didn't create VM. He's obviously, if you know anything about Ameat's background, he had an extraordinary background in cybersecurity. So he had a lot of depth. And I worked with him to really get his input in, and I kind of went around.

The table and I kind of sat with everyone and teased out their piece. And Amit told me, like the one thing he always said to me is that he said, I ran such a masterful process because I got everyone aligned and everyone felt like they could see their input into it. So it wasn't like there was something being forced on the team. It was like everyone's input, everyone could see their impact in in it and therefore could get behind it. And

So I say that because the process of getting to the answer is not about the CMO or whoever's driving the process having all the answers. In fact, I don't think that's usually how it works. It's it's about bringing everybody along. And it's it's it's executive alignment, actually, is what it is. Because that's part of the reason that category endured is because everybody got around it, including Amit, and and planted the flag, not just me. That's that would have been a marketing campaign if it was just me.

planting the flag, then it would have you know, it would probably lived six six to nine months and then it would've just died on the vine.

The question I have is when you were when you were planting the flag, w in your mind, were you always thinking this is a new category, I'm gonna create a new category or were you just thinking, Hey, I just need a new framing for this company?

No, it was new category. It was a new category, which was which was going to create a new framing for the company. And it was going to create a container that would drive our company strategy, our product strategy, our MA strategy, our marketing strategy. Like I knew what my objective was as and and I I was not confused. This was not a marketing campaign initiative.

So

So, you know, it's clear that you are not confused, but it's it's clear to see that how the sales team could be confused because the sales team has been send selling this for 15 years before you came on board. And you come to the sales team, you give them a new slide deck, you give them everything. Hey, go tell your customers you're not a VM company, you're an exposure management company, we are a cyber exposure company. Was there any friction from the sales side? Because that's where, you know, I've seen this personally, the sales people get very used to.

Yes.

Yeah. Yeah.

there we are pitching and like you said, like you know, if I like in my previous roles, when I talked when I listened to the pitches from 15 salespeople, the fifteen sales pitches were completely different. Like regardless how much certification you do in terms of sales training, everyone pitches the company the they they want it, right? So here you are, you're hey, you know, we are repositioning, reframing, new category. So was there any because that's I believe that would be the biggest pushback is was from the sales team. Or was there was the are they just bought into the whole thing?

Yeah.

Yeah. Yeah, I mean if there's there's if there's gonna I don't want to say a skeptic, but if there's gonna be somebody in the room it it it it many times is sales and I understand why, right? And in in the in the the friction point here is if you're unveiling a category vision

By definition, it should be bigger than what you have today, because it's something you grow into. It make it it provides a rationale behind the decisions you make from that point forward, right? What you put in the product, new products you introduce, companies you might acquire. And, you know, sales needs to sell what's on the truck, right? That's how they're gonna get to their number. They live in a 90-day time horizon where category creation is in a multi-year time horizon, and reconciling those things is difficult. And so I think what

Really Yeah.

Yeah.

There was there, you know, there was a little bit of friction of like we are a VM company, we're selling VM, like why do we need to go do this? But I will tell you there were three things that that kind of overcame that friction. Number one is I made a I made a very strong point to unveil it the way that I did, with kind of some drama associated with it you talked about and like, but I wanted the whole team to like get excited and rally around it because it's momentum and inertia, right? If the whole company is around it, like it's easier for everybody to get on board.

Number two is we were going public. And like that's a prime use case for doing this because it's helping to to to articulate a a a bigger story and a bigger TAM. But it was also the that was the message that we put out to the world. So you know, sales can go off and talk about something totally different, but like we just went public on this topic in in this story, right? So like they kind of have to get on board with it. And the third was a meat. I will tell you, like.

Amit was very, you know, such such a great advocate, but he was very clear with the company, like this is who we are, this is our story, this is what we're selling, get on board. And and you know, he was not apologetic about that. And so, you know, I think those were the keys to success.

So, you know, one thing you talk about, DJ is obviously you got the alignment from the from the exec team. Were you also talking to the customers and like, you know, tr you know, like testing water so that you can bring that feedback back to the sales team? You talk to the customers, this you know, this is resonating, this is not resonating. Was that part of the equation? Because, you know, if you don't give that to the sales team, they're like, Who did you talk to?

Yeah. Yeah. Yeah.

Right. No, but great point. So we did talk to some customers as part of the vetting process that were on our customer advisory board. more of our forward leaning comp like customers that, you know, I worked with Renault and we kind of handpicked them. Now you could say, well, you're handpicking the ones that are, you know, visionaries that are gonna align, but it was more of well, no, I mean it's kind of that old saying, like if you would have asked someone if they wanted they they would have said, you know, they would have said they wanted a faster horse, not a not a car, right? You know, it's kind of the same thing.

Mm.

Yeah.

Yeah, yeah, yeah. Yeah.

is you have to understand the the what you're hearing, but the they might not always know what the answer is, right? Or you might show them an answer that they never even, you know, thought of or even articulate the problem in a way that they didn't know they had, right? and like the iPhone is the classic example of articulating a problem. No one was asking for an iPhone, right? They didn't know they had the problem, right? I think in this case it was

No.

Just listening to the customers of where we needed to go. And they might not have known what the answer was, but they were very good at articulating what the problem was. and so we did do some validation with that. And we validated the story with Gartner as well. Like, you know, they can agree, they could, you know, agree or disagree with the naming, which obviously we know what what happened there, but the story and and the strategy they were on board with.

So, JJ, you touched upon one thing that is super important is you know, this was all in the lead up to the IPO. This was all done in the lead up to the IPO. And then, you know, the thing that I, you know, the product strategy, the marketing strategy, the corporate strategy, all of this needs to come come together. Because before the exposure management category, you were like a single single product. I mean, you had multiple products, but the prominent product was was necessary. But then the thing that that that I took away.

Post the creation of the categories, we were all the acquisitions were also very centered around this strategy. You know, all the because we didn't have a really good operational technology piece of software. So then we went and bought like an OT player. And then you know they went and bought some other players. They're just so you helped paint this big vision, which was not clear at that time, and there are a lot of holes and gaps in the story, but then that helped Tenneville kind of.

you know, fill in the gaps after the thing was made. Was it something that you were intentional in when you were pitching this story that we go out right here as is now right now, but then we fill in the story later on? Yeah.

Yeah, I mean part of well, yeah, because part of the story was look, you have this attack surface and you have to be able to, you know, have the breath. We had like a breath message is you have to be able to understand your understand risk across your entire attack surface. By definition, that was one part of the story. So by definition, you have to cover the whole attack surface, right? And so we had, you know, there was IT, there was cloud, there was IoT and OT. Well, we didn't actually have technology that covered the

you know, the OT side of things, right? And so that's that's a a prime example of category strategy driving product and MA strategy. So let's go fill out the portfolio, right?

And it also it also helped you, I guess, in some ways increase the TAM before going IPO because you can now sell a bigger picture. We are not VM is part of our s use cases, but then we are going after the bigger category, which is exposure management.

That's right. That's right. That's right. It's the culmination of, you know, traditional VM plus cloud. Like CSPM was just kind of becoming a thing. That's one of the other things that Tenable and and most companies now have have that are in this space have in their portfolio. IT and OT. And then you think about all of the devices that have to get managed and all of the, you know, the the the products that are out there. And all of a sudden your TAM starts to expand, right? When you all of a sudden have like

All of these, you know, endpoints, all of these cloud workloads, all of these devices that have to be protected and have you have to build exposure around them. And then it's and then it's the other piece of that is how do you provide the depth of of analytics so that you're translating something that's technical to risk, right? How do you prioritize what needs to be fixed? How do you bring in the threat and the asset data to actually correlate all of that? How do you quantify risk? Like

There's there's a whole host of of TAM on that side, right? And you know, one of the other reasons we didn't wind up using the word risk, I think in our now that I'm going back to this in our naming is because we didn't want to be conflated with like GRC platforms, right? Like that was the other thing. You have to look at what else is all is around you in adjacent markets. Like we didn't want to be an RSA, Archer, right? I think that's it was Archer, right? or it is Archer, like the GRC platform, right? And so,

yeah.

It is our shape.

You know, that was a that was another consideration. So you don't want to get confused, like you have to build a a category in a container, but you don't want to be confused with other things. People are always going to try to put you. I mean, that's human nature. And like the way brains and the mind works is to put people in or things in categories. That's how your brain processes information.

Yeah. Yeah, it's pattern matching. What is this? When you see something new, what is this? Is this a dog or is this a cat or is it a cow? Right. It's like very primal, very primal thinking. and JJ, one of the measures of success would be, you know, you know, does the category outlive you? You know, you and your time at at Tennible. And if you look back, if you look back, the company is still an exposure management company.

That's right. That's right. That's right.

I mean it is little and it and you started as a category of one. and I think Tenable is still ranked the best exposure management company. And one of the I guess one of the dreams or one of the the best outcomes you could have, you become the category king. I you want you know, you don't want to just create the category, you want to be the king of that category. And in some respects, tenable is still the king of the category it created and

I I I realize you are saying, hey, I was more like a facilitator. I didn't create the category, but like if you if you just, you know, if you just if you just join the pieces, you know, if you just just listen to what you've described, it looks like you know, that was one of the most lasting impacts. A CMO or a somebody who's in the marketing f profession is probably the greatest highlight. I'm curious, you know, when you when you when you started, it was obviously a category of one, but did you ever that go back to RSA and then

see the explosion because if you go to RC now it's all about exposure management. I don't know. now it is that case, but you know, a year or two years later, did you see any changes in the way companies were positioning themselves post the big reveal?

Yeah. Well, yeah. In fact, after I had left Tenable, I remember when Gar Gartner published their first report. I don't know if it was a market guide or whatever it was, on on exposure management. And like I must have had fifty text messages and emails from people at Tenable going, my gosh, it's a real it's it's Gartner finally adopted it. What a moment. And like that was like that was a really I had I was I think I was actually not even working in cybersecurity at the time. And so I that was a

That was a a pretty cool moment for me. And then when I came back to cybersecurity, I remember the first RSA that I went to when I when I came back to a cyber company, it was plastered everywhere. Like, you know, even being gone for a few years and coming back, like that made all the difference. I couldn't believe it. I'm like I can't it was on the walls, on the booths, everywhere. I mean now now it's just, you know, everyone everyone it's it's yeah, it's nomenclature now. So

Yeah.

Now it is. As the creator of this category, what do you think is the future of this category? What's the future of exposure management from the creator of exposure management?

Yeah, I mean I think, you know, if if you think I think there's two things. I think even if you look at where Gartner's taking it now, it's there s I mean, CTEM has been around for a a a a decent period of time. But, you know, it's it's how do you bring threat and exposure together? Cl you know, I think, you know, cloud and exposure is a is a natural point. So I think it's about not exposure management in isolation, but it's how do you kind of bring different pieces of your portfolio together and different

like different context signals together to actually help, like the core premise of exposure management is still there, right? Understanding and reducing your your risk and your vulnerabilities, but how you get there in this world of more complexity, I think, you know, is going to bring more market convergence. So bringing different markets together to make exposure management, you know, even creating a superset over exposure management. I think the other piece of this is AI, Frontier AI. Look at

you know, what you know, with with anthropic bringing out methos, right? And now and and now the the vulnerability to exploit window, like that's completely shrunk and collapsed. And so what do you need? You need a way to be able to find and prioritize and fix these vulnerabilities fast because the zero day is going to be the the the norm now, right? And it's gonna be a lot and right and the volume is going to explode. And so

A zero hour, it would probably be a zero hour. Yeah.

I think it creates it it creates an urgency around why you need it. so that's another, you know, I I guess a tailwind for the category.

so let's talk about a new category that is coming up. You mentioned you mention AI. now the everything everywhere and everywhere you go, it's all about agentic and agent tick AI and agents doing the work. for a for a category creator like you, do you see this as a new category or is this a feature within the category? Because

Mm.

The way I think when I when I listen to all the noise that is out there, right? You know, jobs are going to get replaced or fifty percent of the jobs are going to get replaced and whatnot. And when I think about this, this is this sounds more like, you know, the accountants, you know, d you have to differentiate between tasks and the jobs. So if you look at like the accountants in nineteen fifties, they still did the work, but they used papers and pencils to do the work. Now they use Excel and they use Excel and

Claude with Excel, but the job still is there. The accountant as a job is still there. They're probably using different tools. So my my question is in this new world, which is agentec, if we if we were to put the category creator lens on this, do you see this evolving? You know, like you know, imagine this like twenty sixteen, twenty seventeen, your time at Tenable, you're brought in, hey, we need a new CMO. is this like a new category or a feature within the existing category?

Yeah, I mean I I I think about it, like I don't well first of all, everybody's using AI and like that like just there's AI washing as we know everywhere. They're just throwing agentic, you know, everywhere.

The agenting aspect of it.

Yeah, that's where the I mean, that you could see this as a gold you can see this as a gold mine for a marketer because because then it this is the time you have to differentiate. Because if everyone is who they are.

Well, it's all it is. It is. It's all it's creating a lot of noise, right? And so, you know, I I I think I think that AI will look every every technology shift creates a change in the way that work is done, the way you need to address a problem. So I think AI will be the impetus to create not just one category, but multiple categories. Like if I look at, you know, from CrowdStrike's lens, right, we pioneered endpoint detection and response.

Because you know, the the the world need had shifted with with endpoints, and how do you actually protect them in the age of the cloud with all the complexity, right? And so there was a new way, there was a new way to protect endpoints, leveraging the power of the cloud, and EDR you know came about, right? There's a there's a similar thing happening now with AI because every technological shift creates an expansion of the attack surface.

And therefore, you need a new way to protect that area of the tax surface, which then creates a new category. So AIDR is an an emerging category that is, you know, if you kind of apply the same principles to EDR, you can apply them to AIDR. That's just one example. There's other categories that will and are already being formed around, you know, using AI as the the impetus to it, whether it's being called agentic sense, whatever, AI, you know, whatever insert word, right?

But like, you know, Gartner is an example. they had, they previously you know, tracked the sim market, right? As a, and there's a SIM MQ. this year, they're actually splitting and they're creating probably, I don't know, I I don't think this is is private information, but for those of you that follow the market, there's still gonna be a sim MQ, but they're actually creating another MQ spawned off of the SIM market called an integrated SOC MQ. Now you could actually

Like I would argue that you could replace integrated with agentic, because it's a lot of the same like a lot of the same criteria. And it's it's really an a lot of the the AI criteria and requirements are kind of driving that integrated SOC, right? And so I look at that as I'm just gonna call it an agentic sock MQ for the sake of that. Like we have we talk about at CrowdStrike driving transformation through an agentic sock to stay ahead of the adversaries. I there's other, you know, companies out there that talk about it too. So I think that's an example of

you know, another example of of AI actually transforming a an existing market category into something different, but it's taking the basis of sim and actually creating a new market category, using that as the foundation.

So this is a big conflict I have in mind. I'm curious what you think about this. Do you think the future is very much human centered products where the humans are using the products or whether, you know, the agents are actually doing the work and then the customers are essentially buying outcomes? Like, you know, in I because the historically all these products are built with dashboards and alerts and like so that human gets engaged and he does the work. But the future looks like, at least to from my vantage point, the future looks like the agent just does the work.

You know, and it just delivers the outcomes for you, like whatever it the outcome could be. so whether whether it is agent tick sock, AI SOC, whatever it is, do you do you have you know, do you have a point of view on what that is? Like, you know, where the market is going to pull you from? Is it more to just deliver the outcome regardless of how the work gets done? Because recently when I think Salesforce came out and said, Hey, we are in headless CRM or something. We you know, the entire CRM is becoming headless. There is no UI. wow, that is a big

No.

You know, that's a big claim to make. I'm curious, what do you think?

Look, I I don't I don't think I think a Gentex still needs a human in the loop. And I think whether it's security I think even long term. I think even long term. Look, I think I think, you know, for at least the foreseeable future. I can't predict thirty, you know, twenty, thirty years in the future, but you know, you still need, you know, you still need humans for, you know

Mm. Is this the short term thing or even long term you think human?

novel like in the case of security, they're finding you know novel threats. Like you still need humans for that. You can agentify an entire workflow and like look over time, maybe will it get there? Maybe, but like the humans still require you still require human decision making. You still require human judgment. Like those are things that at least I don't think for the foreseeable future an agent will be able to replicate. In the world of marketing, I mean, you know, like I look at certain areas of marketing and like

I yeah, I can see a world in in an in the not so distant future where you can identify a large part of an entire work if not the entire workflow. But like I think you still need a human in the in the loop at varying points to validate and provide judgment. And you need someone who understands to know whether it's good or bad output. I I think you still need that. And I think there's other areas in it like creativity. I don't

W with is you know, like at some point A AI is gonna be really good and and can create great amazing creat creative graphics and treatments and all of that. But I can at least speak for our creative team at Crowd Strike, like there's no agent that's gonna replace the the the wonderful work that my team does anytime soon. So, you know, I you can apply that I I'm sure to to any, you know, any function, including security.

last topic, JJ. what's what's the role of marketing in the age of AI? How is that role changing? I mean my first question actually on to on that is are you Claude Pill yet? Are you are you are you are you Claude Pill yet? So how is the marketing changing the age of AI?

Yeah.

Yeah, I mean, so I think we went from, you know, every function, you know, was, you know, using a a chat well, today now every every person in marketing uses some form of a chatbot. And I think now it's like we've got multiple chatbots that are different for different and you know, different things, different models are are good for different I'd say individual tasks. That's kind of where it started, right? Like I wanna write a white paper, I'm gonna, you know, get a great first draft using AI. That's like basic at this point, right?

But we've got that, you know, every single team uses it to like automate tasks for productivity. I think now, and I'm excited about, you know, Claude Code, but also Claude Cowork, is how do you actually orchestrate? I think that's the next, you know, wave of orchestrating cross, you know, cross marketing and even cross-functional workflows end to end. Like we're looking at our entire campaign process from ideation all the way through.

you know, execution and measurement and everything in between, writing the briefs, creating the content, writing the the, you know, the create coming up with the ideation for the ads, like everything in between, all the approvals, all the workflows, like all of that is kind of where the next phase is. We also have this really cool dashboard for every product line that we have, we have a real time listening engine where it actually goes out and it's gonna it feeds back in real time sentiment about, you know, what

what it's seeing with us, what it's seeing with our competitors, where we need to lean into certain topics and it, you know, where we may need to bid higher on keywords. And it actually has an agent that will like automatically generate a first draft of content. Like you need you should go do thought leadership on this topic. Let me generate it for you. It's pretty cool. Like we're we're doing some really cool things. Now I'll say like I was just actually talking to someone about this last week, you know,

wow.

It's the it's not just the tech, it's the change management. So I think every marketing team should have people in their team that can help build the the technology, maybe forward deployed marketing engineers in marketing, and then also someone who can help drive the change management because it it is so much of you have to reimagine how you work and reinvent your process. And where do humans play? Where do the agents play? And what skills do you need as a human? Like this is transformation at its most.

Fundamental level.

But are you creating more content, more targeted ads using AI compared to what you were maybe a year or two years ago? Or is it essentially the same but the quality is better?

I think it's probably a little it's probably the latter. Like I don't think that like I don't want a I don't want content for the sake of content and I certainly don't want AI slop. I think it's how do you how do you accelerate the the the process of creating content? and how do you use AI as a thought partner to make sure that you getting you're super tight on the messaging according to the persona? You can make it super personalized. So I think the the

Mm.

the the real value isn't not just in the speed, but it's in the quality of the output, not producing more.

No, but is it much more targeted now? Because it's much more targeted because you have so much data to infer on so that you can appeal to the right audience at the right time, you know, especially this dashboard idea seems seems super cool. Are you then also hiring more people? Do you think there is more need for marketers or is that going to stay stable with you know augmented with AI tools?

Yes. Yes.

Yes.

Yes.

I think there's certain roles where, you know, an until until a until an agent can can plan an event, I'm saying that in in jest. Like there are certain certain roles where you still need people. and I think you still need people in roles that can be largely identified for the reasons we just talked about. It I think the the role of the human in those will and the role of the people will evolve and the skill sets required will evolve. How do you, you know, how do you manage AI and manage agents and be able to manage an an AI native.

process and workflow might be a a skill in the future here, that not too distant future that might be more, you know, in need and in demand than maybe some of the more traditional skills. So I think it's just gonna change what, you know, how we work, but also change like what the skills are that are required to do our jobs.

All right. GG, last question for the day. What's the next big category that you're creating?

Yeah.

creating a category not for work. Let's just say that yes. Yes. I'm not so so so TBD I have a a hobby. I have a hobby around interior design. You can see from my my background behind me. So I'm working on something in in in my spare time that's gonna help me you know harness my hobby so not work related

That's

It's it's funny it's funny that you have spare time. I didn't think you have any spare time.

I don't have any spare time. I'm laughing as I say that. There is no spare time. But AI is helping me do it. How about that? I wouldn't be able to move as fast if I didn't have AI.

Yeah.

JJ, this this has been an epic interview. Thank you. Thank you for coming on Noise to Signal. I really wanted to have this discussion with you because this entire series, Noise to Signal, would have been incomplete. Because I talk about AI, cyber and vulnerability management a lot on this on this channel. And then I felt like this would be incomplete without the exposure management discussion in the mix. So I'm grateful for you to coming on the on the show and I hope you finish your new category and then you come back on the show and we talk about that too.

Wonderful. Thank you so much for having me. It was really enjoyable. I love really, really enjoyed it. Thank you.

Hold on, hold on.