Haroon Meer welcome to the Noise 2 Signal podcast.
haroon meer (00:05.345) thanks for having me.
Harun, you're one of the you're one of the OGs. You know, you're one of the OGs in terms of you're the founders, founders. You built you're the CEO of thinkst you've built companies without any VC funding, you have scaled it to millions of dollars in ARR. And the reason I really wanted to have you on is because there is this new fight that I see in the cybersecurity cybersecurity ecosystem. There is on one half you have these real
Companies that have found the product market fit, they've they've worked really hard for years and years, built built a massive multi-million dollar ARR business. And on the other hand, you have for for lack of a better word, fake cybersecurity ecosystem where these products exist, but they don't have a product market fit. They they even you know even the customers could be fake customers. I mean, I grew up in a
company that was I was raised in a company where the the founders found the niche, they found the problem, they solved the problem better than anybody else, and they continue iterating on the product, scaled the product, took it to IPO and became a public company. And then but now there is this perversion of get rich quick schemes where the VCs find a hot market to invest in. They find the hot market, then they go and look for
engineers or inexperienced or founders to put the money on. They get them on board and then they pump a lot of marketing and sales ammunition behind the team, make it a number one team in the in the ecosystem. They get to the point where even like the customers are fake. We saw this with the Sunrise program where the customer the CISOs who are getting paid.
To buy the product. We have all these shenanigans that are happening in the cybersecurity ecosystem. So, this is why I really wanted to have you on. And this is especially the final episode of the season. So I'm really honored to have you on this episode and get your get your take on what you think of this the the perversion of the ecosystem that has happened. So let's I want to start the interview with your journey at thinkst Like you started this company way back.
haroon meer (02:00.157) Right.
in the early two thousands, I believe, right? And twenty ten and you s you you built something that did not exist before, or the category of product that did not exist really well. And then you scale this company to millions of dollars in ARR. So how did you get started with thinkst
haroon meer (02:30.676) Twenty ten, yeah.
haroon meer (02:45.662) So before Things I had two different careers. So I when I studied at university, I worked for ten years in the university, which gave me a chance to hack stuff without getting into trouble. Like I ended up at the university and they had all these Unix systems, all of that which needed admining. So I started and I worked at the university and got to learn stuff.
Mm.
haroon meer (03:12.028) And then in the early 2000s, security was just taking off. And I joined a small company called SensePost. There were five people who just got together doing pen testing, and I was the sixth person. And so for 10 years, we basically just did pen testing. Like we did network pen testing and then app pen testing. And because we were a small company in South Africa.
We got our leads by doing talks internationally. So we'd show up at Black Hat at DEF CON, and during the year when we did our testing, we'd know that we needed to do cool stuff so that we could do talks. And that's what we did. And and that worked great for us. Like, like for 10 years, we got to meet interesting people, we got to travel the world, we got to do interesting research. and
By about twenty ten, I think like most people who do pen testing, you start to figure out that you're not winning because you're particularly good. You're winning because the world is just really bad at defending. and w we sold Sense Post and and what I wanted to do was see if we could build a product and I wanted to see if I could help play defense instead of just pen testing.
and that's
And one thing one thing I didn't one thing I didn't highlight is you also built this in South Africa, like way out of away from Silicon Valley, where you know, apparently where all the action is, right? So talk talk talk us through like what was that journey like building something a successful startup in South Africa.
haroon meer (04:43.008) Right.
haroon meer (04:47.943) Yeah.
haroon meer (04:51.974) So yeah, it's it's a good question. Like like with SensePost, it worked pretty well for us because we were in this small enclosure. We popped up at Black Hat DEF CON whenever we were giving a talk, and then we went back to South Africa. so we got pretty used to insane travel, but but we also were kind of shielded from some of the almost the prima donna-ness that
That happens when you in the in the US. So like we'd do a talk, people at Black Cat would like it, but then you come home and write your report because that's what actually pays the bills. and and so that worked. And and when I was starting ThinkSt, we knew we want I knew we wanted to build a product, but I didn't know what product. And and so my initial thinking was I'd try building a product and if it got traction.
I then consider does it need funding? Do we need to hire that sort of stuff? But but one of my initial super naive ideas was I wanted to build lots of products. So so my thinking was we'd become a thing that just invents good products and spins them out, and we'll just keep inventing stuff. And and of course, the I call it naive now because even if you've got a good idea and overnight success takes
about five to ten years to happen. So that idea that I'd be building a new product every Tuesday was was a little optimistic. But but interestingly we never I never considered that we'd have to move to the US to make it happen. The world is small these days, the internet is small. If you put quality stuff out, people will find you.
But buying software in a different jurisdiction jurisdiction is always difficult. Like I have seen this personally, like and when you're trying to sell into like, you know, some of the countries like Philippines or India. Well, you know, do you have the government approval and all these things come up? How did you get there past that barrier?
haroon meer (06:50.056) Yeah. It's
haroon meer (06:55.612) It's it's it's a super interesting question really early on. So so I've given a quote elsewhere that says that like like i in the old days people used to think like you're technical but you don't know how to run a business, like give this to the business people. And and one of the things that I've totally internalized over time is like running a business is mostly just a series of hacks.
Yeah.
haroon meer (07:24.348) Like like there's a you need to get this product in front of people, how can you do it? There's a you need to ship this thing, how can you do it? There's a you need to sell this internationally, how do you do it? Like like it's just a different system with different hacks. and and and I mean that quite literally, like like jumping ahead slightly, like when we built Canary, we had to sh we chose to ship physical hardware.
Mm-hmm.
haroon meer (07:52.871) And of course, if you asked us how do you ship from South Africa to the US, like what permission do you need? What compliance do you need? At the time, we had no idea. Like, like the first prototype canaries, I 3D printed, we hand-solded. and when it came to shipping, we like I've got photographs where we we glued those boxes together and went to DHL and said, Can you ship this to this address in the US? And they did.
And and along the way, at some point you find out you need this permit, and then you go get the permit, or you find out and and mostly people over-index on on the things they don't know, but but very few of those are company killing events. yeah, exactly. And and so for the most of them.
Real real unsolvable problem. I get him.
haroon meer (08:47.686) You find out it's a problem and then you beat it. And and I think like like as an overarching thing for that, I think if you're building a product company, there's a few things you've got to focus on. Like, do you solve the problem you say you're gonna solve? And if you can nail that, everything else can be worked out. Like like I've got young specifically in security, like young founders who get told to speak to me.
And they tell me, like, they're doing this AI log incident response thing, and and they talk about their TAM and they talk about a bunch of things. And I say to them, Listen, I think this is interesting. Like, like, do you say you're gonna build a SAST with this low false positives? They say yes. I say, Well, okay, if you can do this thing that you say, we'll solve everything else. Like, like if you say, if you can do this thing that you're saying.
Guaranteed we'll get you funding. Like everyone's wants this thing. So so the first thing is they have to choose a good problem, right? Because sometimes they choose a problem that nobody cares about or only they think matters. But but if you choose a problem that matters, I'm gonna be a dast and I'm gonna kill false positives, cool. If you can do that, who can't get funding for that? Like like
Despite everything that I say about VCs, one of the great things about VCs is that they are super predictable. They want to invest in a product that wins. If you show you can insult VCs Monday to Saturday, and on Sunday, if you have a chance to make them money, they will give you a term sheet. Because that's what they in the game to do. And and so so I think lots of the time, if someone wants to build a product that wins.
Like does your product win is a is a central thing. And I I think people just overlook that because there's all this other noise around it.
There are two follow-up questions I have for you on this. You said your early your early, I guess, design partners or early customers came through all the talks that were you you were doing at Black Hat and DEF CON. These are one of the most difficult conferences to get in as a presenter. How did how did that happen in terms of like was the research really novel or was there an interesting angle of attack that you were taking to to get into
haroon meer (11:08.146) Right.
haroon meer (11:15.892) It's a good it's a good question. I think in honesty, we were early enough that it was easier. Like like I think things are harder these days. I I think yeah. I I think anyone who who reads smashing the stack today, like you can figure it out, right? You smash the stack, here's how you increase your pointer and and you put your shellcode there, and
Very hard, especially in Black Hair and DEF CON.
haroon meer (11:44.551) A kid who's trying to learn successful exploitation today, it's not going to be one frack paper. So so certainly early on we had the advantage, but I guess there was the compensating downside of not that much information being available. And and so for us, what we did is we worked like crazy to find things that we thought were novel. In fact, like while we did SensePost, we spoke at
Every black cat DEF CON like until I left Sense Post. And no no different topics every time. So so very specifically, we we had different topics every time. But one of the things we did is we were consistently certainly in the early days, you wouldn't go to my talk the way you'd go to a Halvar talk. Like like if you go to a Halvar talk, Halva
And was it the same topic or a different topic every time?
haroon meer (12:43.89) Guys who'd come with us in the company would go to a Helvar talk and barely understand what he's speaking about. Like he was talking about heap feng shui before it was cool. and our talks were always the sort of stuff people will go, Whoa, I didn't think you could do that. Like you could chain these four things and that thing happens. So, so for example, one of the talks that that I liked, like I think this was in 2005.
We while pen testing, we're pen testing a web application, and the only command execution we could get on that web server was to make the web server sleep. So you issue a sleep command, you see the web server takes long to get back to you. And so we're like, okay, can we make that a reliable channel? We build some tooling so that you get it to sleep one or sleep zero. So now you can run a command, convert it to binary.
Sleep the binary so that you can use sleep as a channel to get information out. and then when we got SQL injection going, now you could say, well, okay, let's tell the SQL server to sleep, put the or to run a command, put the command in a table, read the answer, sleep that answer, and now you get your results. and so we built all this tooling so that if you had a SQL injection.
Three layers deep into a network with no Exfil, you could still transfer binaries from your machine to their machine over DNS and over sleep. And why this is marginally interesting, like we built all that tooling. When we did the talk on timing, we then did a whole bunch of stuff like cross-site request timing, where you could load two frames and based on the timing of the frame, you could tell where the user had visited.
but that DNS thing that we then did for the SQL injection became the basis of the protocol we use currently for our canaries. When you drop a canary on someone's network, all the communication between the canary and the console goes via encrypted DNS. And effectively we took our DNS channel from that hack and used it as a protocol in Canary.
haroon meer (15:05.798) Yeah, it's it's why mostly I go back to business as a series of hacks. Like back then the question was, you wanna get into these CFPs, what are they looking for? What's novel? What works? We did those talks. Those talks worked. It's how I met Helva, it's how I met H. D. Moore. The guys from Hacking Exposed then asked us to write a chapter in one of their books.
on hacking web applications when nobody thought hacking web applications was cool. And and so mainly, yeah, like over a long enough timeline doing good stuff kind of pays off. And and that's what we did.
Yeah.
And why the name Tinkst?
haroon meer (15:54.901) mainly thinks was just a superlative of thinking. Like like initially our website had this tag phrase that said, no problem can withstand sustained thinking. and and genuinely, like after 10 years of pen testing, like like we got to do some really cool hacks, like most pen testers do. And and I was pretty convinced that if you took our
Mm-hmm.
haroon meer (16:24.788) hacker thinking, which we used to break into stuff, we could use it to work on difficult problems. And and so what I wanted to do was face some defensive problems and think the same way about it and see if we could build a business building solutions.
So, you know, you mentioned that the building thing still is a series of series of business hacks, right? Or basically a series of hacks that you, you know, basically targeted towards maybe go to market, maybe marketing, whatever it is. Even you're like your booth building is like a very hacky version of doing doing these things. you eventually got to a point where you had millions of dollars in ERR and you did you ever had the opportunity to take VC money and you still said no?
haroon meer (17:02.725) Sure.
haroon meer (17:15.196) Yeah, so so we had an opportunity pretty early on. So so we get offers all the time. Like VCs and P firms reach out all the time. But but we had a really good opportunity where one of the top VCs in the world reached out and said, Hey, can we chat to them? and I said, sure, like those guys despite the fact that I think VC often is bad for the ecosystem.
Some of the best products were built by people who then went on to become VCs. So when lots of those people talk, I listen to them. Like I've been reading Mark Andreessen stuff forever. I've got all of Ben Horowitz's books. there's tons of current VCs who I've admired from their product days.
The th the on that note, the thing I like about Mark is his recall memory is insane. He can read a book from nine it is he can re book read a book from nineteen hundreds and he can recall it as if he he just read it fifteen minutes ago. I don't know how he does it.
haroon meer (18:11.676) It's insane i
haroon meer (18:17.332) So no, he he's incredible. And and they often say that like you shouldn't meet your heroes. But but like at at some point I got a ping to say, like, would I do breakfast with Mark Andreessen? And I was like, Of course I'll do breakfast with Mark Andreessen. and he was every bit as impressive in person as you would think. And and I later met Ben Horowitz and he also like
They'd seen my previous talks, they'd talked to our customers, like sharp as anything, super impressive. And and of course, it's super flattering, right? Like like both those guys were heroes of mines and they knew our business and they liked our business. And yeah, so so we've had offers from from good VCs. We just didn't see
the benefit. We came pretty close to to taking an investment specifically from them but didn't because what we found and and this is very particular to us, we didn't find that they could introduce us to any customers that we couldn't connect to on our own. Like they tried, but but one of the reasons they initially tried to speak to us was because
I see.
haroon meer (19:41.545) They spoke to their portfolio companies and we were installed at most of their portfolio companies. And so they reached out to us saying, like, hey, every all our portfolios talk about you, like like what are you doing? and so yeah, it it turned out that i I think if you've been in this industry for a reasonable amount of time, you are two connections away from anyone you want to reach anyway.
en an i don't think that vc gives you that.
And do you think this was result of your, you know, grinding for ten years at Sens post that gave you that level of baseline to reach to these potential customers or?
haroon meer (20:23.068) I I I I think for sure it helped. like even when we started, right? Like I had a mix of people knew me from talks that I'd done, people knew me from SensePost. And so we were able I was able to reach out on day one and say to really good names, like like top security teams and say, Hey, we built this thing, would you try it? And they did. But but again
Like like friends of mine sometimes criticize me when when I go on my everyone can be a founder soapbox because they say, look, you could because you were in that position. And and like you can't test the counterfactual, but but the thing that I believe is in my version of the game, I had that thing, and so my hack was if I can build a nice enough product, I can reach that.
To use that yeah, you to use that skill.
haroon meer (21:19.814) And and if you were a new founder who didn't have that, then your first node is to do a presentation with HD more. I'm willing to bet if you found an interesting problem and DM'd HD to say, There's this problem, I pulled a solution, I just want you to see it. I guarantee you you'd get a Skype call with him. And if your product did what it said,
Then HD would say, this is a cool product. And instead of my two connections away, you are now three connections away. Because you've got HD as an intermediary. and and so yeah, I I think it's one of those things that you kind of figure out. yeah. So I think it helped, but I think it's not an insurmountable problem.
Think on my end the video is showing us frozen for you. Is it
haroon meer (22:20.048) no, so mine is fine, sorry. is it frozen currently still?
Okay. It's still shown as s frozen, so I don't know if you want
haroon meer (22:29.944) dang, sorry. you think I should shut down my streaming video in the background? No, I'm kidding, I'm not. so
If not we can continue because reverse side will typically take care of it. But
haroon meer (22:42.97) Okay. Yeah, no, on on my side both seem fine. Yeah.
good right so then we then as long as because then it will upload it so I'll take a note of this so that I can cut it out on my end. Haroon. the thing I wanted the now let's switch topic and get to the real meat of the discussion that I really wanted to have you on. is obviously you've built a real you have built a real product real company and the counter to that is the fake product and a fake company right the the the reason I wanted to have you on is
haroon meer (22:51.284) All good.
Cool.
haroon meer (23:02.932) Sure.
haroon meer (23:13.108) Sure.
get a sense from your point of view. As I mentioned in the intro, how do these some of these non I mean, I don't want them called fake products, but i you know, you know, in some ways that the products that haven't proven themselves get traction and eventually get sold. Like what is the business model? How does that model work? Because it has happened enough times where to s to to your point, everyone can be a founder and everyone can be a fake founder.
haroon meer (23:26.59) Sure.
haroon meer (23:36.755) Yeah.
too, right? So they can be, you know, as long as they're back by VC, they can they can play this play this game where they build a startup, build a bunch of funding, get sold, repeat, rins and repeat
haroon meer (23:42.484) Yeah.
haroon meer (23:49.885) Yeah. Yeah, so so there's multiple versions of it, right? Like like the one version is VCs have a very established playbook. And and the there's one of these that like I've mentioned fairly recently, I'm embarrassed that it took me so long to figure out. and that is the RSA big name game.
And and it it's not my thought. Many, many years ago, in the early 2000s, Dave Aitel spoke about RSA, the conference, and and he mentioned that RSA doesn't sell companies aren't selling products, people go to RSA to sell their companies. and I didn't pay much attention to it, but but fairly recently it I've realized that that this is why the big conferences have theme years.
So you go to RSA this year, go to Black Cat this year, and the show floor is filled with agentic AI security companies. And and this year, I feel it's it's very visibly marked because I think AI is gonna pose interesting problems, and I think agentic stuff's gonna pose interesting problems. But I'm willing to bet that as it stands today, we don't understand the problem well enough.
To have solutions or marketing around it. So the question is, and and this year I feel more confident than ever to say something like that. The problem is just too new. There are not thousands of companies who can say they are solving AgenTech anything, right? But but every company there, like the boots, were dominated by AI and AgenTech. And what you see there is a different game entirely at play.
And and if you take Dave's idea that that these companies are not selling products, because if you speak to any of those vendors, in ten minutes you'd know their product cannot solve this problem. Like they do not have a handle on this problem yet. So why are they saying that they do? And and the reason they're saying they do is because they are appealing to whoever buys companies, not to whoever buys products.
haroon meer (26:09.296) If they can show themselves to be the market leader in that segment, then someone who's looking to acquire the market leader in that segment will snap them up. And it just so happens that the big platform companies are constantly looking for who they should acquire. And the reason they're looking for who they should acquire is because they've got to do press releases that show that they are on top of their game.
So so right now, if you are CrowdStrike, Palo Alto, and not picking on them, Zscaler, all of those big guys, you need to show the market that you're on top of whatever the market thinks is the current problem. So currently everyone's screaming AIA Gentec. And Palo Alto can do something in that space, or they can buy the clear market leader in that space. And and so you end up with this very repeatable formula where
If there's a hot category, some founder who's respectable enough can raise from a respectable VC. They raise from the respectable VC, they build this company, they do their funding announcement, which gets them some headlines, they do a big booth, they throw a big party, they get acquired. The acquiring company gets a stock boost because they've now bought this company.
And three years later, nobody cares whether that category was real or not, because everyone made money. The founders made money, the VCs made money, the acquiring company made money. In truth, the
How? How did the acquiring how did the acquiring company made money? Because they didn't have any customers.
haroon meer (27:52.681) They get a stock boost. They get a stock boost when they say they bought the market leading AI company, their stock goes up. And that's what they are doing. They optimizing from quarter to quarter for stock bumps. And if in two years that thing just fades out as a product category, nobody really watches or nobody really cares. If you go back to the last, take the last 10 RSAs and take the themes, take
Okay.
haroon meer (28:22.066) big data, take SOAR, take BYOD, take micro segmentation. Like does anyone care whether those big vendors acquisitions in that space are doing anything? No. Like what they wanted was to be able to make that announcement.
And and look, along the way, some of them will use some of the people, but what you're seeing now is a fairly repeatable founder sells, exits like that, goes back, raises again, goes for his next go-round. And and that works. And in truth, the only people that are poorer for that is the ecosystem, because there's a lot of noise in the market, so there's a lot of junk, and the customers are confused and buy junk.
And the customers and the customers.
haroon meer (29:09.032) But I will say as an upside to all of this, like I don't think it's all doom and gloom. Like I've said before, I think it's crazy that we can exist in South Africa and build a product and sell it with millions in ARR. And that's also because of the time that we live in. Like like this would not have been possible 20 years ago.
But today it is, and we can do bottom-up sales. So so I think it's a it's a great time to be a founder. There's a lot of noise, and and if you look at some of that stuff, you can get dispirited because they made this big announcement or they exited for 600 million. But in part it's like, well, sure, if you want to play that game.
Yeah.
haroon meer (29:59.647) But if you want to build good things and make a difference or sell them, like that's also possible. you just have to play a different game.
So what you're saying is there are two game two ways to play this game. One is to build the real product, you know, grind it out, do the thing that you love, do it for a long time without really worrying about the outcome. Keep doing it as long as you can do it. So that is one part of the game. And there is the second game, which is very I guess, money centered, finance centered, ROI centered, where this is a hot category. Let's get to let's get this let's pump and get this to the next phase. You know, let's
You know, to for to for a lack of a better term, visify this. There is this now after the Wiz acquisition, every vendor is now every a key startup thinks of themselves as the next Wiz. And they the now I've seen crazy booths that are style like Wiz booths, like very different. You know, they started with this pink and blue, and now everyone is trying to do a mimic a version of the Wiz so that they can position themselves as the new Wiz, get acquired, get the stock bump.
haroon meer (30:42.492) Ha ha sup.
haroon meer (30:53.577) Yeah.
Everyone is happy, the customers are not happy. That's why they are less trust less. I guess you know now that you mention it is also there's probably a byproduct of it. Is the byproduct of this is is because is somebody like thinks to successful because there is so much lack of trust in the market. That something that has existed for a long period of time, the you automatically trust somebody because they've they've done the hard work.
haroon meer (31:32.264) Earn some trust.
And they've actually proven out in the long in the long in the long
haroon meer (31:40.093) Yeah, yeah, look, i I I think to to to that, like like I I have two thoughts when I hear that. One is the market like like customers have genuinely gotten used to really terrible products. So so like the buy is really low for for building useful products. And and so that's a good thing. But but there are other ways that the buy is really low also. Like like something
I this is a really stupid thing to say because it it exposes me slightly. But I didn't know till we started showing up at booths like RSA and Black Hat how many of those companies on the showroom floor didn't have 200 customers yet. Like like so so as a company like we've got like our free product is used by by
Hundreds of thousands of people, but but our paid product, like we've got like just under 3,000 customers. And and I think like that's a a reasonable number, like not an obscene number. But but like at some point early on we showed up and I found out that even these really big booths didn't have 500 customers yet. Like not and that's crazy.
Yes. How? Yeah.
haroon meer (32:58.184) Because well well here's the thing though, and and here's what's the the other side of that. If I was building a product today, like it seems like such a mammoth task to go up, like you said, against WUS, right? But if you told me, get 200 customers and you will make millions, that's doable. Like I can get 200 customers. Like, like again, if you think about it in terms of like how do you get 200 customers? Like
Get 10 a month and a year later you've got a hundred. And that's crazy. Like with a hundred customers. And and and so when I say the bar is low, like some of that stuff is just putting one foot in front of the other. Like if I can get 10 customers and keep them happy, they'll tell 10 other people, and that stuff's gonna grow. And and so like pick a non-stupid category, like pick something that needs solving.
Actually keep your promise and then don't die and and you'll do good stuff. And and then you get other benefits along the way. Like you start, you attract people who want to do things this way. Like sh the industry is full of like absolute mercenaries, but there's also lots of people who just want to do good work. And if you build a place that does good work, you'll attract those people.
So yeah, there there's lots of positives.
You know, the example the example that comes to mind is the nest thermostat. I mean the thermostats were like they are like old, bulky, crappy, qu it scheduling was like for took forever and then the nest thermostat comes along and it gets acquired for billions of dollars because d I mean it's like a old problem and no one even thought about it.
haroon meer (34:34.046) Sure.
haroon meer (34:44.66) Yeah.
haroon meer (34:49.01) Yeah. It's i i it's a crazy unplanned segue, but have you read Tony Fidel's book, Bold? So so Nest was built by Tony Fidel and he's got a book, yeah, and and he's got a book called Bold, which is probably the book that I've gifted the second most to people. you should you should read it or or I'll it's it's a great book.
No, I have any. The the iPhone guy.
Interesting. How did that?
haroon meer (35:15.674) and and he basically talks through this i he talks through a journey that is very similar to the one we've had, which is find the thing, love making it, put your heart into it, and you'll do well. i yeah, it's it's a great segue.
let's switch topics to the second, which is you know, you did you know, one of your business hacks, one of the business hacks was is to draw attention to a problem that many people didn't know existed. I'll give you and I'll set the context for this. So this I was building I was building my first product. the product was the product was really good, and the marketing team came comes to me and says, Hey, the product is good, but we need some awards.
haroon meer (35:52.308) Sure.
And I asked that person, what do you mean we need to well, we need to get some awards. So and and he said, Well, we can get the best innovator award. And how how do we get that award? Because my mindset was, well, you have to go and pitch to the reviewer, you have to give them access to the product, the guy's gonna review the product and he's gonna say, Hey, this doesn't this doesn't do X, Y, and Z. no, no, no, no. That's that's no longer needed now.
And you know, we can we can get get the award. And as I was going through this process, it was kind of disheartening that you know anybody can buy any product. And I I stumbled upon your I stumbled upon your video which you did with Adrian. I believe it was you you did the presentations with the presentation with Adrian and the the title of the presentation was The Products We Deserve.
haroon meer (36:41.442) Yeah.
haroon meer (36:47.762) Yeah, Adrian Cynabria. Yeah.
The products we deserve. And this is still I don't know if this problem is still relevant now, but I still thought at that time, that video with that presentation, one of the most epic presentations that I saw, and I showed it to my marketing team. I showed it to my marketing team. We are not doing any of this. You know, we are going to buy we are going to win we are going to win awards, but we are going to win them legitimately. So I want to set that that's so that's the stage I wanted to set in. Maybe give us context in terms of why you did what you did and what was the what was the process like.
haroon meer (37:08.702) Thanks.
haroon meer (37:12.884) Ha ha ha.
haroon meer (37:26.084) Sure. So so the presentation yeah, we we did a whole bunch of things on how we think products used to be built, with a whole bunch of fakery, so claiming headlines for raising rounds, bad marketing ideas like fake awards, spending all your time listening to analysts, there were a whole bunch of things. And we were saying, look, this isn't necessary if you want to build a great product.
And and we were saying like like we said all of that and then we said look, we got to where we are without doing all of those things, so another way is possible. And and we do that a lot where we try to like I feel a little bit almost like we have a responsibility to young founders to say it doesn't have to be that way. Like like a lot of what you hear about raising money.
Is written by VCs. And and so of course that's what you're gonna hear. And and I'm here to say you can build without that. You can read Secrets of Sand Hill Road and read early small exits and and you should inform yourself. Because again, like any series of hacks, know the system and know the rules so that you can you can play it. And and when we were doing Canary.
In the first when when we started Canary, at that time Deception was briefly a hot category. And there were like six funded companies that raised like up to about 50 million dollars each. And and so we got to really play the game with here's these funded guys, what works and what doesn't. And and one of the interesting things is early on, when I i it it's an interesting side story actually.
Which is at some point I had pitched TechCrunch. I pinged someone who had previously covered one of my black cat talks, so I had a relationship with him, and I pinged him and said, Hey, we're selling this deception product, we've got good customers, look slack, has publicly said they use us, we're a small South African company, surely there's a cool story here. and I got ghosted and
Yeah.
haroon meer (39:51.593) That week they ran a story on another deception company being funded by Y Combinator. And so I pinged him saying, like, what's the deal? I pitched you a deception company, he pitched you a dis. And the person was super open and said, They funded by YC. Like, who are you funded by? And I said, I've got Slack as a customer. And they said, Yeah, but they funded by YC. And and in that moment,
I came back and told Marco, I think we have to go raise. Like, like if these guys are able to walk into tech crunch like that, and we can't, like, we're gonna get killed. And and fortunately, in in the fullness of time, you see how those things that the VC money gets you gets you a little bit of attention, but it's not sustainable. So those all those companies that raise that money, they
Did the headlines, they did the funding announcement, they did the tech crunch articles. What they didn't do was make a product that customers liked and used. And so that just didn't work for them. anyway, back back to the thing. One of the things you see is lots of these companies had pages full of awards. And and there was one
That's the right way. Like you know, like Mitt Romney's binders of women, like you know the
haroon meer (41:15.156) Exactly. And and so so I never mentioned this before, but literally when when we were doing this talk, I went to one of our competitors in particular and looked at their page of awards and and told Adrian, Okay, let's investigate every one of these awards. Can we get that award? and for about half of them, it would direct you to a page that was not even functional anymore. So it's like top
hundred heading award you click on it you go to a thing that page doesn't exist there were about ten of them that were all the same cookie cutter site in fact if you pull their Google Ad words you can see they all the same company so one company sold this whole block of awards so you could see that whole thing was just complete trash a complete tire fire mess and and look the awards thing
I can see why people say like you need some kind of proof that your product works. And our alternative to that is get customers to say that you're good. And and again, there there are hacks. Like early on, we were wondering like how do you get customers to write on your website and say that they use you? And and quite often.
Ask the wish. Yeah.
haroon meer (42:39.006) People who put a customer logo on their website have given that customer a big enough discount on a big enough price tag that that customer agrees to have their logo used. Our product is relatively inexpensive. We can't discount our product enough to make it worth it for them to say something on our website. But it turns out if your product is good, security people will tweet about it.
Do a taste.
Ha ha ha.
haroon meer (43:09.084) And we don't tell them to tweet about it. We just made a page that collects the tweets that people tweet about us. And and so if you go to canary.love, we've just got a page full of people who've tweeted stuff about canary. And and again, that works really nicely because everyone recognizes the gruk and everyone recognizes like take your big name, Robert Graham.
Or Ben Nagi or and at some point all of these folks have seen Canary and said something nice and we get to clip that. So so I think real customer feedback over fake awards. The the good thing is I I think we played a part in in killing that fake award thing. Like like I know lots of people have have picked up arms.
You educated the market. You each yeah, you definitely edu at least it did it for me. You educated the market that these are not real awards, these are fake awards. You all you really need to do. And the f the funny thing is these awards would have like presentation ceremonies and backdrops and awards that look like Oscars. Like, you know, they have like you know, it feels like you won something so big that you're like the top innovator award or the top whichever category award.
haroon meer (44:07.463) And
haroon meer (44:17.876) Totally. It's
haroon meer (44:24.912) Yeah. Well literally this week I've got mail for awards that I've won and magazine covers that we on and and we j i there's an interesting thing in in security products in general. There are a lot of things that are done routinely that just make no sense. Like like the fake award thing, the the way people scan badges at conferences is another
mind-blowingly insane thing to me. Like like we've never understood it. And and again, like if you running your business and interested in building a big a good product, you can kind of see your way through the stupid things that don't help a customer or make your product better. And if you don't focus on those, yeah, it's it and and that stuff, yeah.
Then does it matter?
haroon meer (45:22.328) look, from that talk, I I also picked on analysts and and lots of friends warned me not to. It's it's still something that I that I've done, and I know a bunch of really big name analysts that really dislike us for it. But but I think the way analysts play a part in companies' products is just as fake as the fake awards.
And
haroon meer (45:51.323) I think it's
Let's let's let's let's get into that. But I want to quickly for the audience cla clarify what this presentation was if you've never heard of or read this presentation. You and your team spun up a fake CMO and the fake CMO the fake CMO got invited or at least was was invited or was as an anointed the best CMO of the year.
haroon meer (45:55.006) Sure.
And then this fake CMO was able to pay five thousand dollars or ten thousand dollars and pick up a bunch of awards. And by the end of it, he he th that this person did not exist. Like this was a completely fake person. A fake CMO.
haroon meer (46:16.766) Do one best.
haroon meer (46:26.83) Sure. Yeah, completely non-existent person. He picked up product awards for his product that didn't exist. people were Yeah. Yeah, and and look, you can you can do that now. Like the the product award stuff is is crazy fake. And and mainly my my plea here to young founders is
I think it was email marketing or something. I don't know what it was, but it was some email marketing or something.
haroon meer (46:54.8) You know that stuff is fake. Like like i i it's the same with the fake awards.
That's the problem, Haroon. That's the problem. No one knows they are fake unless and because until you educated the market, people didn't know, people just accepted this as the the
haroon meer (47:03.527) Yeah.
I I buy that. I I I tell you honestly, I I found like I found it hard to believe. It and I I know it's a it's a jump, but but my take on the analyst stuff is exactly the same. If you so so for people who don't know, big analyst companies will say nice things about your product and put you on a product radar. and they don't do it for money.
But they also sell a service advising these customers, advising these young product companies. And and so what ends up happening is you are incentivized to take out these like a Gartner subscription or Forester subscription or any one of these things. And in exchange for that subscription, you get time with those analysts. And there's lots of value because they speaking to your customers and
They offer you a bunch of stuff. But one of the things that's actually playing out there is they'll be kinder to you or listen to your listen to your product pitch more carefully because you happen to have a subscription with them. And so by extension, that also becomes a pay to play thing. Because if you don't pay the analyst, you less likely to get a favorable spot on a radar.
One thing I've also seen noticed is the there is an incentive for them to increase the radar. Though even though you might be an early startup, you show up as a lower quadrant of the you don't show up as you don't show up on the top of the quadrant, but you show up as the lower quadrant. But that is good enough for an early stage startup. Hey, we showed up on this radar. That is good enough for that. So so I've seen where they've increased the funnel of vendors that are part.
haroon meer (48:40.766) Sure.
haroon meer (48:52.475) Exactly.
part of the study or whatever, Q four report or Q one report.
haroon meer (49:02.232) Sure. And and now you're part of the study this year, and next year they reach out to you and say, Listen, do you want a subscription? It's just 200K. And i they're not saying it overtly, right? But what they're doing is now they're gonna speak to you and they're gonna share that study with you. And so if you just follow their 10 simple tips, you can move your way up that radar to become an established player. And and
There are lots of people who say, look, they really do have a lot of experience and they can help you. And and my take on it is: if some analyst at Gartner thinks he knows how to build the product that I'm building, he should go build that product. Because if he's got those answers, surely he can build the winning product in that category.
Or or the builder the pro the founder should not be building the product because the analyst knows more than him. So then this is the founder so should not be building that product.
haroon meer (50:00.207) Exactly. And and and so so I'll tell you a crazy thing because last year, last year or the year before, we spoke to some analysts who did a thing for deception and and they sent us their their documents saying here's what we're gonna publish, here's the radar, blah blah blah. And so I pinged them back and said, Listen, like we don't wanna change your results.
But like we'd previously not liked what we read. And we were questioning internally whether we should do one of these analyst interviews again. So we did it to see if the results get any better. But but we don't like how it came out. But here's my thing. Right now, I can't tell why I don't understand how this works. So I'm not trying to change your thing.
Can you explain to me like how this works? And I said, like, take these two companies, like you list them as the innovator in this space. And I say, take us, yeah, you've put us as they put us in in still a reasonable category. I said, so if you take us, look at our blog, like you will find 10 years of us inventing stuff and talking about it.
Or the leader. Or the leader.
haroon meer (51:22.982) I said, this big name comp vendor who plays in this space, you listed them as innovative. What have they done in this space? Like, can you show me on their blog? So he says, no, like it's not on the blog, you can't trust a blog. I'm like, okay, cool, I buy that. Here's our change log that's published on what's new. Even if it's fake, it shows you 10 years of multiple releases per quarter.
Let's go to this vendor's site, and their site is abandoned where like this vendor is in that product. They bought someone, they're in that category, but they've done nothing in that space. So I'm like, how do these guys make it? And and I'm not picking on them. I'm just saying I don't understand. If we've got a blog, yeah, with 10 years of innovation, how are they the leaders in this space?
I could.
Explain the process to me.
haroon meer (52:20.24) And at that point, the analyst says, Listen, you're right. Like we give it to them because they are big name and you can't go wrong. And and look, to their credit, they were very honest. And then I said, wait, hold on. I want to ask you something else. Because the analysts send you a checklist saying, Do you do this feature? Like, do you cover AI threats? And I say to them, Who chooses this?
Yeah.
haroon meer (52:47.08) Be because for example, a big thing for us was do you comply with a tech? The attack, do you map to the attack framework? Do you export to sticks? Yeah. And and my answer to them when they asked was I think anyone doing this is stupid. Like I don't think this is a necessary thing for my product. and and I'll yeah, I'll explain why.
Mm. The mitre attack. The mitre attack film.
It's too broad. It's too broad and it's too generic.
haroon meer (53:13.842) But yeah, I think this is not useful. And and what you see is there's a bunch of vendors now who all know they're gonna get dinged on the analyst report unless they can tick that box. So they're wasting their engineering time to tick that box so the analyst can give them a tick. And it doesn't make a difference to the product or the customer.
Pendant.
haroon meer (53:36.647) And and so I say to him, how do you all choose that? And they say, No, we go to all the vendors and ask them what they're working on this year. And so if all of them say they're working on mitre integration, then we'd list that as a necessary thing for this year. So I say, you see how this whole thing is circular. You talk about mitre integration, they all think they must do mitre integration to make you happy. You check if they've done mitre integration.
You guys have now built an integration that is stupid.
This
This this this story rigs so close to my heart. Is and I the reason is I was in a similar situation where you know I was b I was building letting the leading the VM product at one of my previous companies, and it was the most stupidest feature that as a product leader I had to build in the product because you know you're a VM company, you have to have mitre attack framework mapping to all your vulnerabilities. And I'm like,
Who consumes the vulnerability data data this way? I I don't know no no customer asked for it, never came in, but it was you know gun to my head, you have to implement it. And it's like, you know, there is this revulsion as a product leader leader that you have. I don't want to do this anymore. You know what I mean?
haroon meer (54:43.846) It's stupid. Yeah.
haroon meer (54:53.584) It's so that that thing exactly for me is a a huge part of the problem, but also a ray of hope for people who know the space. Because those founders who are following a formula don't know what really matters in the space. And as a a founder in the space who cares about the problem, you get to say
I don't think this matters. We're not gonna put it in. And short term, you're running the risk because look, everyone who thinks they Steve Jobs and they can keep their thing minimal, like at some point, Steve Jobs has antenna gate and says, we screwed that up. Like, like we need to fix this. And and you do the same, right? You make your choices and sometimes you're wrong and you go back and fix it and say, No, the mar like
Yeah.
haroon meer (55:50.633) The product does need this thing. But but I think being able to say we're not doing that because we don't think the product needs that is yeah, it's it it becomes a superpower if you can stick to your guns.
I want to transition to the next topic that I have in mind, which is how to do how do you do conferences really well. And the the and you write you I you write about this very very well. Like it is very crisp and it is it's something that appeals to it's something that appeals to me. And in in some respects I created the this this podcast noise to signal after going to one of these conferences. I
haroon meer (56:14.865) Ha
haroon meer (56:23.252) Thanks.
I announced my company and I went to RSA. Hey, you know, we just launched our company, come come visit our booth and whatnot. I I go to this conference, everyone is agentic AI security workflow. Like there is there is no there is no product or vendor that doesn't talk about this. I mean I I kid you not, I walked the RSA floor, there was literally a forest in one of the booths, and there was a jungle, and there was a cheetah, and there were trees.
haroon meer (57:01.748) Yeah, it's insane.
And then the the tagline was find your hidden exposure or some some some crappy tagline was there. And I s I thought to myself, like, how do we how do we how do we like create signal from all this noise? And that was the that led to the found creating of this for and my thinking was, how about we just talk to the OGs and the people who are actually building the real stuff and talk to them and get their point of view out rather than you know.
haroon meer (57:06.868) Yeah.
Like rather than all this fakery that goes around in terms of, you know, the the the product, the ecosystem and so on and so forth. And you write it you write really well about this. And you know, you you touched upon this is you said RSA is not the place where you go and you know, find your customers, you go there to sell your sell your company. So so the the the thing I want to talk about is what are some of the do's and don'ts when you do conference? You have a nice write-up, I'll link it in the show notes.
haroon meer (57:29.82) Right.
haroon meer (57:40.404) Thanks.
haroon meer (57:55.252) So yeah. So
But I want to first give the floor to you in terms of doing because you do this you you again, this is one of your business hacks. Like, you know, you where you figured out the right hack to do a conference booth really well.
haroon meer (58:01.748) Yeah.
Yeah, sure. So and again I'll tell you like the odd thing is I think there's a like there's the insanity that the market does and there's a super good path for founders like us who want to build good products. Like the young me cannot believe it, but we get incredible value from doing RSA and Black Hat.
Like like we now do about five of those conferences a year. We do Black Hat RSA, we do InfoSec Europe, and then we try two other conferences. Like we'll try Gartner, we'll try something in Australia. But but we go routinely, and routinely we get good value from it. And I think what matters though is what people consider good value from it. We use it as a chance to meet our customers.
So we end up like we've got thousands of customers who we never meet because our sales approach is really light touch. So we've got people who've been paying us hundreds of thousands over 10 years who we've never met. And so now they happen to be in town for Black Hat, they stop by the booth and they chat to us. and then the only people who we take to the booth are people who actively work on the product.
So if you come to the booth, like I'm there all day, Marco's our CTO, he's there all day, our engineers are there. So when you come to the booth, you get to see a demo and talk to the person who built feature X. Or if you really are interested in Y, you get to discuss it with us while we're building that. And and it it it's always strange to me because if you talk to any VC, they'll tell you like there's this.
haroon meer (59:59.017) Bunch of quotes on how the truth is not in your building. Like you must get out and meet your customers. So if they see a CEO who just stays in the building, they'll say, No, you need to go out and meet so many of your customers per week. If you are at a trade show, you have thousands of customers and potential customers walking past your logo all day. Why would a CEO not stand there and demo his product?
Like like it's insane to me. And and the way we've built Canary, like and again, there's a series of hacks, but one of them is the product has to impress you during installation. Because like people have a short attention span. Like while you're installing it, you at least have to see these people are not idiots. Like, at least to be able to say we should try this. And and so we
Can demo it really nicely. If someone watches a demo of Canary, there's a good chance they say we should at least try this out. So we see conferences as a chance to give demos to people. And for us, it's a chance to give demos or talk to our existing customers. And again, it doesn't have to be crazy expensive. And we use like like you're talking about a series of hacks. We use conferences for some really
Unusual hacks. We primarily a remote company. So I don't meet some of our engineers ever except when we go to a conference together. And so what those conferences are is a chance for them to see whether I am putting my money where my mouth is. Like, do I sit up in a suite or am I on the floor talking to the customers who I say are important? Like when we
Mehul (01:01:32.522) That's it.
haroon meer (01:01:53.173) put up our booth, like do we care how nice it looks because do we care about UX and how things look? Like like there's a bunch of stuff that you get to do really nicely. yeah, I I I can't tell you how how good those things can be if they done right.
Mehul (01:02:13.734) The the question I have in mind is is your entire team in South Africa or are you based across the world? Is the team across the world?
haroon meer (01:02:19.526) No, no. So so we've got people all over now. We've still a lot of our engineers are in South Africa. So we do have an office in Cape Town, an office in Gauteng, although I don't go into it. And and just to beat this thing to death, part of the reason I don't go into the office is because I enjoy working from home, but part of it is a genuine hack. Like when we started and when I wanted us to start going remote.
Mehul (01:02:42.738) Okay.
haroon meer (01:02:49.886) Part of my thinking was that if I went into the office, people would huddle around my table. But if I stayed remote, everyone would have to figure out how to work with me. And so they'd work well with other remote engineers. So so we've got people in the US, in Italy, in Germany, in India, in New Zealand. So so we're pretty distributed, but but we're a pretty small team.
Mehul (01:03:19.402) So one perverse thing that I've seen when when doing these conferences and booths is the executive shooting of the this sea levels where they don't even show up at the booth. And I agree with you, like if you're doing a booth, you have to be at the booth, you have to be like you have to show your passion, you have to show your product, like you should be like out there talking, getting feedback, your engineers are in the booth. But I've also seen I've seen like they will like in if you're at RSL they'd have a
haroon meer (01:03:31.954) Yeah, it's insane.
haroon meer (01:03:39.614) Sure.
Mehul (01:03:47.783) suite in in the W or some of these presidential rooms and then invite their customers and and do all this thing but not like not even visit the booth even once and you know you rant about this as well right where you know if you do
haroon meer (01:03:58.921) Yeah. Yeah. It's it's it's so crazy and and again it's so predictable. Like like the the sort of company that you're gonna end up building, like you have to decide what company you want, right? Like like when we built Canary, i and and again, like it's it's hard work building building a good company, but all of it is hard. Like if you want to build a company that chases money or chases
Insane growth, like you're gonna find it hard for different ways. And and for us, like building a product that matters, that works, has its own hard. And and so the things that you choose to revere in your company matter. So so, like in our company, people see that like we celebrate when we catch something big, we celebrate when a customer says, this was delightful.
We celebrate when someone comes to the booth and says, Your product saved me on day X. And so we're not saying one thing, but then sitting in a suite and drinking cocktails. Like everyone knows what makes us happy and what wins you cred in the company. and like you can have different things in a company to rally around, like some people have their
Mehul (01:05:05.874) And read some of the Yeah.
haroon meer (01:05:21.87) revenue number up on a board and everyone can see it tick over and and we just make customer love the thing that we revere and everyone works towards and it's yeah a nicer metric.
Mehul (01:05:36.127) And the the outcome of the the outcome of executives not being or the the people who are building and not being in the booth is this craziness around batch scanning. Like the incentives are scan more scan more badges. And I've seen like it's feels like a fish market. Like you go into this and they're like they're like try like tag into you and catch you and grab you and pull them in you and it's so crazy. The whole thing feels revolts it's revolts.
haroon meer (01:05:56.157) Is so that so it's no it's it's even stupider than that because what what happens after they scan your badges? So so for people who don't know, people they get booth stuff and lots of those booth staff know nothing about their product. They get told Exactly So so there's yeah, so so they put up a booth and they put up a gimmick.
Mehul (01:06:09.29) The base.
Mehul (01:06:17.79) And they're hired guns sometimes. They're hired people, like sure part time they've never been at this company before.
haroon meer (01:06:25.864) Like let's say the gimmick is a video game. Now they say, Yeah, come come see our Formula One car. Right. Now they say they pay these hired guns to scan the badge. And you and you think that's the end of it. But after the conference, they now have a stack of scanned badges of people who wanted to see a Formula One car. And now for the next three months, they are gonna pay people.
Mehul (01:06:28.36) Or a Formula One car or a Formula One car some random shit.
haroon meer (01:06:54.952) To spam those email addresses to try to get those people to see a demo, which means everyone's ignoring their mail for months, and none of it makes sense, right? So so we give canary t-shirts at our booth, and quite often someone will come up and say, you can scan my badge and I'll take a shirt. And we say to them: if you want a shirt, take a shirt. Don't also waste my time scanning your badge.
Mehul (01:07:21.695) Don't scan.
haroon meer (01:07:24.85) Because then next week I'm gonna mail you. Now you're wasting my time you taking my t-shirt now and wasting my time next week when I have to mail and assume that you want my product. Just take the shirt. I'm cool with that trade. Like wasting my time next week is stupid. So so this thing and and you see lots of things like that. we so as a company, we still do zero outbound sales. And and
Over the our ten years with the
Mehul (01:07:56.362) What do mean? What do you mean by zero outbound sales? Like what do you mean? You don't have a
haroon meer (01:07:59.535) We don't do we don't have any salesperson saying buy our product ever. Like like we don't have the position. so how it works is people mail people mail us and say, I heard about Canary, and we've got three people who then say, Hey, I can do a demo and show it to you. And some of them say, Okay, I'll sign up, or some of them say, Can we do a POC? and then we
Mehul (01:08:11.828) How do you do how do you
haroon meer (01:08:29.126) Let them do a POC. But we don't mail anyone saying
Mehul (01:08:30.514) That is insane. That that is insane. That is insane to get to like, my God, how? Wow, I need to learn your secret. Like, what is
haroon meer (01:08:40.02) So yeah, so so we literally don't have like the function doesn't exist. We don't we don't do that ever. And and in the past 10 years, we thrice tried it. And when we got on someone and said, Okay, tell us what you're gonna do, and they said, Okay, we're gonna spam this list. We're like, No, you're not spamming any you're not sending anyone an unsolicited mail.
To try our product, like that's not what we're gonna do. And every time we looked at what those outbound functions do, we just I don't like it. That's not how we're going to roll. And and so we just never have. And and like badge scanning, it seems to me horribly inefficient. Like, like I remember speaking to a guy and he had history with a really top product company, and and he told me like he's gonna mail these people.
Blah, blah, blah. And I said to him, like, why? Like, and and he says, no, like, look at this list. Like, here's this big name customer. And I'm like, okay, let's take that big name customer. If I were you and wanted to get that customer, here's what I would do. Like, let's speak to this guy who knows that person. Let's get an introduction because this guy loves us and he uses us. He'll introduce us there.
But but that's not how sales works. Like they do a largely spray and pray stuff, which again damages the ecosystem because now everyone hates getting mail from anyone because it's someone trying to sell them products they don't want. And and so, in like literally for us, we focus on people who've used us, we focus on sharing useful information, and
That useful stuff will get people to look at our stuff and see that we do useful things and hopefully they'll buy us. And again, we don't need 10 million customers, we need a few thousand. And and that keeps growing. And yeah, someday I like for all products specifically, I believe every company should run some canaries.
Mehul (01:10:45.332) Yeah, three thousand is good enough. Three thousand at a growing attack is
haroon meer (01:11:00.616) But I don't think there's a massive land grab and we have to get those people now before they all buy something else. Like if we stop being useful, they should stop buying us and we should try to make it useful so that they buy us.
Mehul (01:11:17.316) last topic for today, Haroon. yeah and l and this is pertinent to the times we live in and it's the latest trend of the era, which is AI. Like everything is centered around AI. what's your what's your take on the the AI trend that we are seeing? Are you using it? Do you have an opinion on AI? Where do you land where do you which side of the board do you come on?
haroon meer (01:11:29.876) Right.
haroon meer (01:11:39.059) Yeah.
Mehul (01:11:46.079) AI, whether it is AI offense, AI defense, where do you come in?
haroon meer (01:11:49.331) Yeah. Look, I I think it's certainly it's certainly industry changing. Like like there's a huge capability difference and it's an interesting time. But Patrick from from Risky Business was upset with me a little while back because I was telling him like
He has all these companies that come on that say we're using AI to do this and we're using AI to do that. And and and my take to him was I don't say we use Redis to do this or we use this technology to do that. Like no customer should care.
Like we solve their problem or we don't solve their problem. And if you happen to find a way to use an LLM or some machine learning to solve some problem, sell me on how you're solving that problem. But anyone who says we're using this technology, chances are they're trying to catch on to a current hype cycle that
And and and that gives a different thing. I I think right now so so I think all researchers should be fiddling with it. I think people should be knee deep playing with it. I think
It's an interesting time. like if technology has like S curves or whatever you use to to show different cycles, we're definitely in a time where there's a lot that's open. And and mostly I'm surprised how many people have such strong opinions while the ground is still so fluid. Like if you just take the open AI hugging face insanity that that just happened.
haroon meer (01:13:40.025) Like like even just looking at their black hat presentation, for sure OpenAI were horrible with some of the stuff they did. Like, like you look at some of what they it's like, surely you should have had better monitoring than that. But I think the people who were so quick to say, there's nothing new here, this is just another X, are
Also missing it. Like, like I looked at that and went, that's a pretty cool hack. Like, like if I was marking my pen testers for public report, compromising Artifactory and making a message board and collaborating, I'm like, yeah, that's cool. Like, like, like just attack-wise, that's
Mehul (01:14:24.22) It off interesting.
haroon meer (01:14:29.608) That's better than I expected from a bunch of clankers who are not even tasked with that as their primary task. And and so mainly, like like there's there's a quote I like from Marcus Aurelius, which is like, you don't have to have a strong opinion on this. Like you don't, you always have the option to not have an opinion. And and right now.
I think like we should be playing with the stuff, we should be seeing it. As we say this, we're about to release something on Canary that that we feel does really well at trapping agents. But but again, our take is people are now talking about this agent hack, and we've done this thing on Canary which traps agentic attackers. Here's why it works.
but but again I I wish InfoSec would concern itself with outcomes. Like like we build Canadian, we say we'll catch attackers. It doesn't matter what we built it on, or that we're using a DNS side channel, or that we local it what we say is drop us easily and we'll catch a thing. And if you have an agent, we'll catch an agent.
Mehul (01:15:36.723) You built it.
haroon meer (01:15:49.587) That's doing this thing. And and I think it's very easy to get distracted by we do big data or we do hybrid cloud or we do agentix sock or all of that stuff. And and those things are almost short sugar rushes because if you catch that wave, you catch some news cycles, you get some attention, but it's not the same as building a product that works.
Mehul (01:16:17.066) I wanted to on the hugging face OpenA I thing, I wanted to ask you a follow-up question. Do you think this was intentional? So let me give you some context. Like whenever I see a produced report that is very slight, has slides and charts and all this detailed explanation, and it happens like a week before with Black Hat or two weeks before Black Hat, like how? How did you like my first thought is how did you put it all together so crisply? And you had a guy who could present and talk at this.
haroon meer (01:16:28.818) Yeah.
Yeah.
haroon meer (01:16:35.644) Yeah.
I'm
haroon meer (01:16:43.091) I've seen
Mehul (01:16:45.552) in so so much detail. Like, you know, when you go and do a topic to prepare and rehearse, at least for me, when I do these things, I have to like rehearse it, I have to get it like to the pitch and everything. you think it's intentional to create the fear-mongering aspect of it?
haroon meer (01:16:47.399) Yeah.
haroon meer (01:16:51.058) Yeah. I I've I've seen some people
I I I've seen some people say it and and of course I've got no inside information on this, but but I'll tell you like my default and and my wife always scolds me because I'm also usually anti-conspiracy theory. And and even though recent days show us that some conspiracies are indeed yeah yeah. But but yeah, but but but generally my take on it is
Mehul (01:17:18.374) It is better to be a cosplay theorist in the recent thing. It is better to be a cosplay theorist than not.
haroon meer (01:17:29.332) Like like I think it's hard enough to make companies that succeed and and like people coming up with truly Machiavellian plans, like most companies can't figure out how to tie their shoelaces. Like like actually coming up with really incredible 4D chess.
It it's and and the other thing is it's it's too easy for that stuff to go wrong. I'll tell you when when I look at like what happened there, the thing that I see is you got a big company that's growing wildly, where A doesn't know what B is doing. Like they've got some great security people, right? Like you look at people they've been hiring, but I'm sure these people, but
Mehul (01:18:18.664) Yeah, Halware is now Halware is at Open AI now. Howver is is that open AI now?
haroon meer (01:18:23.166) But the question is, like Helva's there, Dave Vitel is there, the ex-C CISO of Palenter is there. so so they've got great people, but I'm guessing those people are in some corner doing one thing. And here you've got a bunch of research scientists who are testing something. And and so you can very easily see what happened happening when people are YOLOing stuff. Well when when Tesla was first
Mehul (01:18:26.846) The vitals there, yes.
haroon meer (01:18:52.52) Getting going, there was a time where someone did a report on how you could basically SSH into Teslas and like you'd be on their ECUs. Because early on, all the tech companies are freaking clown shoes, right? Like all of them are just cobbling together stuff, hoping it works. And like you hope that they as they get serious enough, they start taking security seriously.
But for sure there are large patches where it's still just a clown show. So so in a case like this, I'm much more likely to think it was a clown show that got exposed and now they'll they'll have to do stuff around it.
Mehul (01:19:40.354) last last question for the day, Haroon. How do you how d how what's your advice to young founders to beat these fake startups or big established companies? Any guidance and recommendations from your point, you know, d spending so much time in the trenches, fighting the big fight? What's your recommendation?
haroon meer (01:19:58.481) Yeah. So so mainly my recommendation is genuinely hopeful. It's like there's never been a better time to fight them because like there's lots of advantages that you have. Like you build good stuff. for a while when when I was younger, like people used to have the saying that like you can't just build a better mousetrap, like you have to
have distribution and you have to have marketing and you've got to get a real CEO. If you make something good that's useful, like you can find a hundred customers. And if you find a hundred customers, you can grow them to a thousand. And and like lots of the things that people fear, we still consider the tiny company, right? Like we've got 50 staff in total, most of which are engineers.
And and occasionally I'll still bump into someone who'll tell like, yeah, but what happens if if Google aims at your at your segment? And and like I used to say, like, well, they won't, like, you know, innovators' dilemma, like the big guy wants to flee and the small guy. But but then one day it occurred to me, like, let's say a really big company, let's say Cisco decided they wanted to play in Deception. Do you think they'll put 50 engineers on it?
I don't think so. Like like you can be really small and punch above your weight class because you focused and because you care about the problem. And you don't need like like VCs and VC talk have made people think that every game is a zero sum game. You're gonna get all the customers or you're gonna get you don't. You just have to get a hundred customers and then a thousand and then the thousand will become ten thousand.
And and mostly my advice to go full circle to your original topic is not for everyone, because some people want to play the VC game and buy their island before they're 30. But if you want to build a meaningful company, if you want to build a good product, and and I'm not a hippie, like I like nice things, and I've got a wife and a family. And and mainly my thing is that you can do a good product.
haroon meer (01:22:20.752) and still with in the marketplace. The the market has space for good products that are made with love that try to solve the problem. you just don't have to play the other game.
Mehul (01:22:35.805) Harun, this is a great point to end the interview. This has been an epic interview, worthy of a finale. This is the season finale. So thank you. Thank you for your time and sharing your thoughts. I'm super grateful for you to come on the Noise to Signal podcast. Thank you.
haroon meer (01:22:44.104) Thanks for having me.
haroon meer (01:22:52.414) Thanks so much for having me. It's been great.
Mehul (01:22:55.336) So don't go yet,