Show Notes

Whether you’re one person or a multinational corporation, so much of our personal information exists on the Internet. It has made data security an absolute necessity, and that’s unlikely to change in the foreseeable future. Fortunately, there is a data security startup called Fortanix that’s thinking outside the box and offering a platform that keeps data protected even when you’re on an untrustworthy network.

Fortanix CEO and co-founder Ambuj Kumar recently sat down with startup coach Roland Siebelink on the Midstage Startup Momentum Podcast to discuss his data-first, multi-cloud security startup. Naturally, the conversation moved beyond what Fortanix does with Ambuj sharing the most important lessons he’s learned as a first-time founder and CEO.

• The strategy Ambuj used for speaking with potential customers while developing his product.
• The keys to getting useful feedback from potential customers, even if it’s negative feedback.
• Why Fortanix is striving to sell its product to the top companies in the world.
• Why it’s important for CEOs to handle the first several sales that their startup makes.
• How it’s possible to build a successful company by attracting average talent.
• Why Ambuj doesn’t mind being told that he’s wrong about something.

Transcript

Roland Siebelink:Hello and welcome to the Midstage Startup Momentum Podcast. My name is Roland Siebelink and I have with me today Ambuj Kumar, who is the co-founder and CEO of Fortanix. Hello, Ambuj, thank you for joining us.

Ambuj Kumar:Thanks, Roland. Looking forward.

Roland Siebelink:Absolutely. Fortanix, tell us what do you do and what difference do you make in the world for whom?

Ambuj Kumar:We are a data-first multi cloud security company. In today's world, security and privacy are always top of mind for everybody, be it individual or corporation. The question is "How do you keep your data secure in the cloud as enterprises spread around the world?" We provide a data protection platform where companies can keep their data protected, even when they are in an untrusted network.

Roland Siebelink:Excellent. Very good. Security data protection, that's a big ocean to try and boil. Where and what particular niche is Fortanix playing compared to other categories, other companies that are perhaps already more established in this field.

Ambuj Kumar:Good question. Most of the security companies today, they try to keep your network, your firewalls, your infrastructure protected. Fortanix is rather unique in that we took a view that you don't need a secure infrastructure to keep your data secure. If you are, let's say a CISO of a large bank, you are constantly worried about keeping your data protected, not your firewall protected. And your firewall protection, your network security, is a means to an end. And that end is data security. We took that shortcut and said: "Hey, even if the infrastructure is compromised, what can we do to keep your data secure?" And we call that decoupling security from infrastructure. It's a rather unique, rather new perspective on security, where we are trying to say: "Hey, you don't have to keep your network secure. You don't have to keep your firewall secure." And try doing those things. Best practice is defense in depth. Keep doing what you are doing, but in addition, augment those things by data protection. Even if your firewall gets broken, somebody finds their way in your house, your data is not a sitting duck.

Roland Siebelink:Okay. Excellent. It's another layer of security that gets much more to the core of protecting data. That's how I understand it. Before we go into how you've built Fortanix and how the company is doing, maybe we can also delve a little bit into your own background, Ambuj. How did you come to found the company and what were you doing before?

Ambuj Kumar:Yeah, good question. I was an engineer at Nvidia, where I built some of the world's fastest chips. Now they are powering all the AI engines everywhere. You can only connect the dots in hindsight. When I joined Nvidia, it was maybe 500 employees, 400 employees. And it was maybe a $5 billion company. Now Nvidia is a $500 billion company. At that time I got to work closely with Jensen Huang, who is a legendary CEO now. But at that time, he wasn't known. Working with him, I got to see how a $500 billion CEO operates their day, how they react to various things, what is their reason and passion? That certainly, as I find out now, turned out very, very influential for me. And then I left Nvidia in 2010, about 10 years ago, to work for a company called Cryptography Research Inc., a cybersecurity company. I was the chief architect there. I worked there for five years. If you put those two things together, my background in cryptography research and working for a company like Nvidia that was one of most remarkable transformative companies in history. Those things helped me as I was trying to find my own company, figure out what is wrong with the world, and I found Fortanix.

Roland Siebelink:When did you found Fortanix and what was the early history? How long did it take you to start seeing the first successes?

Ambuj Kumar:We founded Fortanix in 2016 summer. My viewpoint was that coming from a hardware background at Nvidia and an encryption background at Cryptography Research, I had knowledge that using hardware, you can keep your data secure. And that was 2015-16 when privacy and security breaches started to go through the roof. And they have not stopped. But I looked at various solutions that other security startups were offering, and almost all of them had some network bend to it. They all tried to keep your firewall protected. They all tried to keep your network protected. They all tried to keep your software protected, your systems protected, your machines protected, your users protected. But nobody was working at keeping your data protected. And to me, that looked really, really odd because if the goal of security is to keep your data protected, why not do that? And then when I started to dig deeper on why that is the key, it turns out that we didn't have the technology to keep data secure if your infrastructure was not secure. I built a new technology called Runtime Encryption to fix that. And if you think about our data, our photos that we have on our mobile phones, if somebody steals our phone, they don't get access to our data because all our photos are encrypted with keys that we punch in. Similarly, when we connect to our bank's website, all of that data that goes from our browser to our bank server, it goes encrypted because of something called SSL, TLS. But once the servers get the data and they start to process, at that time, they become vulnerable because there was no way of keeping data protected, encrypted during that process. We created this new technology called Runtime Encryption. And in conjunction with securing data at rest, in motion, and in use, now we can offer a platform where your data is protected regardless of anything else. That was a rather transformative idea that looked almost impossible to build. We worked from fundamental principles, so we understood how CPUs work, your machines boot, things like that. Using that, we started to build our product. But it would take two to two and a half years until we had our product ready. But we were ready for that because it was a really new approach and we didn't have somebody to follow into it, so we knew what was coming, so we had planned accordingly. And in the meantime, we kept talking to different customers, prospective buyers, always. We always knew that if we could build a product, then they would come. All our energy was focused on building the product.

Roland Siebelink:Okay. Tell me a little bit more about that. You already mentioned your core customer is the CISO, the chief information security officer. Is it at larger companies typically that you go for?

Ambuj Kumar:Good question. When you are building your product, you want fast validation. In the early days, you are talking to almost everybody, anybody who is willing to talk to you. During the build-up phase, we did the same. But then the time came to sell it. I wanted to always build a generational company, something that would be known as my legacy and something that will last for hundreds of years. In that we said that, "Hey, when we start to sell, we will sell to the most discerning, most advanced companies of the world." Companies that are the hardest to sell to, especially if you are a rather unknown startup like Fortanix. But we said that, "Hey, if we in our head believe that our product is so differentiated, so unique, so hard to build, then why not go knock on those doors where if we do get in, and it's extremely hard to get in, but once we get in, it will bring a certain amount of legitimacy to us and it will make our life easier. For the first year or so, we exclusively focused on Fortune 500 companies. That's where we started to get our foothold. And once we were there, then we opened up the floodgate. We sell to the midmarket. We sell to anybody who has business data that they want to predict and willing to do some cloud transformation.

Roland Siebelink:Okay. Very good. The talking to customers before the product was even ready, that's something I hear a lot. How did that go for you? How did you even get the meetings and how are you able to build those relationships to kickstart your go-to market once the product really was ready?

Ambuj Kumar:Yeah, good question. I feel that the world is always rooting for a new hero, especially in the Silicon Valley or the tech world that we live in, I think if you have the right ideas and you show a little bit of humility, lots of people want to talk to you. Lots of people want to help you. At least that was my experience. I didn't have any previous relationship. I was just sending cold emails to lots of people on LinkedIn, on email and saying that, "Hey, these are my ideas. Do you have half an hour to chat with me and just tell me what I should be doing, not doing. Is this problem relevant to you, not relevant to you? How much money you would pay and things like that. People are surprisingly open.

Roland Siebelink:Okay, that's awesome. Many people with a similar background - let's say core tech engineering background - feel a little bit uncomfortable with that whole reach outside and get them to talk to customers and doing sales all the time. How was that for you? Was it something you had learned already or was it something you had to teach yourself?

Ambuj Kumar:I'd never sold a single thing before founding Fortanix, so it was something I had to learn. But I feel that most people are afraid of being told no. Or most people are afraid of figuring out that they are wrong. In my case, I just take the polar opposite view. Building something that is useless or doing something that doesn't make sense, I want to be told sooner than later. Because my time is limited, my lifetime is limited. If it's a product that won't go anywhere, I want to be told today. When I talk to my customers, if I say, "Hey, I fixed this problem, that problem for you." and they tell me that no, those are not the relevant problems, the more pressing problems are here. I would rather have that knowledge. I was not uncomfortable - even a tiny bit - in approaching people for feedback. Many times people don't give you feedback because they don't understand your problem. They don't understand the solution. Which is fine, you move on. You have 10 of those conversations, five would be good conversations and maybe one of them would be a transformative conversation.

Roland Siebelink:How do you distinguish between the feedback you just move on from and the feedback that is so relevant that maybe you have to change your vision?

Ambuj Kumar:You ask probing questions. If somebody says, "Hey, this product, this product doesn't work for me" or "This is not a valid problem," Then you ask why that is. Maybe they'll say, "Hey, this is my company's priority." Or they will try to push you away the moment you start to understand their viewpoint. In my experience, I found those conversations to be not that helpful. On the other hand, they said that, in my viewpoint, cloud security needs to be data dominated, not network dominated. Then I'll ask why is that? And then they'll say that, "Because in the cloud, networks are very ephemeral. There's too many of them. I can't manage them." Then you've got something going. You ask probing questions.

Roland Siebelink:Just for those that are trying to start on this journey and talking to as many customers as possible, can you give us an indication how many people you talk to and how often?

Ambuj Kumar:Yeah. I was very structured. You have so many of these conversations, you try to mix things up, so I built an Excel sheet. I had a schedule where I talked to this person, this person, this person. And for every single meeting that I had, I documented the note. I feel that writing is an understated skill and it's difficult. If I were to write, "Hey, what did I learn from this meeting?" It puts pressure on me. It takes time and things like that. But I was of the view that if I got somebody to spend a half an hour with me, half an hour of my time, half an hour of setting it up, half an hour thinking about it. Probably two hours, then it's worth spending 15 minutes for me to document what I learned or didn't learn. Every single meeting I had, I documented.

Roland Siebelink:Did you send back that note to the person? Just for yourself?

Ambuj Kumar:Just myself so that I can remember who said what. And that was very, very helpful. To give you some sense of how many customers I talked to, probably I was talking to 30, 40 people a week.

Roland Siebelink:Wow. That's a lot, huh? How did you get anything else done?

Ambuj Kumar:Most of these conversations are very, very short. Anybody who has been in sales knows that at the top of the funnel, you care about volumes. You are spending 50 of these meetings, 30 of those meetings are terminated within the first five minutes because it's not a relevant audience.

Roland Siebelink:Oh, I like that. That's actually a great sales technique. Get to the "No" very fast.

Ambuj Kumar:There are plenty of people who would help you and plenty of people in your market. You don't need to waste your time on somebody who is not because it's also disrespectful to them. If you have those meetings, 30 of them are terminated within first five minutes; 20 of them, after 5-10 minutes, the person on the other end, they will figure out that you are not as mature as they thought, you are not as smart as they thought, you are not as relevant as they thought. They will terminate the meeting. You are left with five, 10 good conversations. If you are not having at least two half-an-hour-long conversations every day, you are doing it wrong.

Roland Siebelink:Okay. Excellent. Thank you for illustrating that. I think really understanding that it's a numbers game and that you can move beyond the fear of rejection just by talking to more people. I think that's a seminal insight for people who are not used to sales yet. Absolutely. Let's then talk a little bit about once your product was ready and once you start scaling. What happened to get started, moving things beyond just Ambuj and your co-founders?

Ambuj Kumar:Yeah. It's important for founders to do first sales themselves because in doing so they will learn so many things. What you actually don't want is that you have a super smart salesperson who goes and sells your product to their past relationship or something. You don't want that. You would rather have an average or below-average salesperson and your product sells by itself because that's a repeatable process. The only way the founder can figure out which one is the case, is being in the field yourself. I will say that as a founder, it's important that you do 10-15 sales yourself. Those 10-15 sales will teach you a lot. They will teach you whom to talk to, what is the pricing, who is the target audience, what is your messaging, what are common questions you will get, things like that. You are also building a repository of those things. For example, every single time customers ask us, "Hey, how are they different from XYZ? Will this work for this particular use case?" We are documenting. Building our own knowledge base. And then later on, when you hire salespeople, you can use that information to hire those people.

Roland Siebelink:How have you found yourself learning since the early stages of talking to customers and then turning into a CEO of a 150-people company? What have been some lessons that you yourself had to adopt and where do you see yourself changing?

Ambuj Kumar:Lots of things. The way you manage yourself. Early days when you don't have any customers is different from managing your first 10 people. Then you start managing 20 people. Then maybe you start managing managers. And then you start to manage an organization. They all require different skills. Good thing is that there are plenty of books, plenty of videos, tutorials, plenty of people who are willing to help you. You have a little bit of learning, even a little bit of learning attitude. It's a constant journey. Everybody is trying to get to the next one, but it doesn't really matter whether you are a 10-people company, whether you work for a hundred people, a thousand, ten thousand. Everybody has a battle. All CEOs, all leaders are constantly trying to learn and grow their organization. You are no different from anyone else.

Roland Siebelink:What have been your go-to resources, Ambuj, in learning about managing people, managing managers, managing an organization? What have been the most helpful resources? Which books or people or peer groups have you relied upon?

Ambuj Kumar:I think for me it starts with defining the culture of your company. You can build your company by attracting your top talent. You can also build a company attracting average talent. You can build a company that is passionate about solving cloud data security and privacy like we are, where people get offended when somebody else gets breached. You can also build a company where you are paying people lots of money. You can build a company where your goal is world domination; everybody is centered on that. I think figuring out those ethos, what are central fundamental traits that will attract people is really, really fundamental because then you can use that to manage people. There are plenty of books that I have read. Harvard business reviews are very helpful. "No Asshole Rule" is a book that I found useful. Management by Objectives is useful. OKR methodology is very useful. Those are some of the things that I would recommend.

Roland Siebelink:Excellent. Looking back over those years since 2016, what would you say have been the biggest - maybe surprising - achievements, where you came much further than you would have thought?

Ambuj Kumar:You never know how far this will go. That is always there. And I always wanted to build the world's largest security company. I will say that our product turned out to be really, really powerful. In the early days when we were doing lots of customer discussions, prospect discussions, I thought that it would take a while before people would figure out how useful, powerful this product is. As it turns out now, almost every single discussion we go into and somebody gets exposed to our product, they end up purchasing our products sooner than later.

Roland Siebelink:One last question, if there's one thing you would advise founders coming behind you that are working on their companies right now, what would it be?

Ambuj Kumar:I would say don't trust anyone - don't do something because somebody else told you to do so. Have trust in yourself. If somebody says that your idea is bad or your product is bad, you need to understand why. Without that "why" that feedback is meaningless. Similarly, and much more importantly, somebody says that your idea is great, your product is great, up until you know why, that feedback is meaningless. I find entrepreneurs, founders stumble a lot because somebody early on told them, "Hey, this is their thing." The person moves on, VCs fund you. employees join your company, and it's like a circle. The customer said that it was a good idea, VCs fund you because the customer said so, employees join you because VCs fund you. There is no one who understands why you are doing something. As a founder, that is your fundamental job to make sure that you are building something worth building.

Roland Siebelink:Okay. Excellent. Thank you so much. That's a great quote. Finally, the real last question, if people want to figure out more about Fortanix, where can they go and what do you need most from our audience? What can they help you with?

Ambuj Kumar:Yeah, good question. We are always trying to hire good people. Somebody excited about security, please join us.

Roland Siebelink:Is it technical people? Go-to market paper. What are you looking for?

Ambuj Kumar:Everyone. We are in a hyper-growth phase. You can find more about us at Fortanix.com. I'm also on LinkedIn.

Roland Siebelink:Perfect. And if any investors or other people want to be in touch with Ambuj, I'm happy to provide an introduction as well. Thank you so much, Ambuj, for joining us on the Midstage Startup Momentum Podcast. This has been a great interview and thank you for sharing all your experience with our audience.

Roland Siebelink talks all things tech startup and bring you interviews with tech cofounders across the world.