Show Notes

We can all agree that software security is more important than ever. But even startups that specialize in security face challenges, especially for first-time founders. IriusRisk is a perfect example of that. This Spanish-born startup plans one step ahead by predicting security issues software may face before one line of code is written.

IriusRisk CEO and co-founder Stephen de Vries recently spoke with midstage startup coach Roland Siebelink on the Midstage Startup Momentum Podcast. About the challenges of being a first-time founder and the important lessons he’s learned along the way.

• Why starting out as a consultant agency has benefited IriusRisk.
• How IriusRisk developed a more serious channel strategy.
• How to know when it’s time to hire a game-changer in a particular department.
• How IriusRisk has managed to keep the CEO and VP of products separate roles.
• The best practices for inspiring employees from different departments.
• How Stephen has adapted from being on the technical side of things to being a CEO.

Transcript

Roland Siebelink:Hello and welcome to the Midstage Startup Momentum Podcast. My name is Roland Siebelink and my co-host is Carlos Founaud. And today, we have with you Stephen de Vries, who is the CEO and founder of IriusRisk. Hello, Stephen.

Stephen de Vries:Hello, Carlos and Roland. Great to be here.

Roland Siebelink:Excellent. Well, thank you for joining. IriusRisk was born in Spain. That's where Carlos discovered them. Carlos, where did you first hear of IriusRisk?

Carlos Founaud:Well, I first learned about them in Huesca, in the north of Spain. And what fascinated me was there were two people, Stephen and Cristina, working in Huesca. At the same time, they had a guy, I think in South Africa, another one in Brazil, something like that. But then the story of the name IriusRisk got me. They were telling me Irius is a famous vineyard here in Spain. And it was the first thing they could see through the window, and there was Irius and they just added risk to the name. And that's how I met him. They were our neighbors in Huesca.

Roland Siebelink:That's very, very awesome. The first startup that I know is named after a vineyard. That's amazing. Stephen, what does Irius do? How do you see your origin story from that vineyard in Spain and where you are now, based in Atlanta and all over the world? Tell us.

Stephen de Vries:Our focus area is software security called threat modeling, secure design. What we build is a platform that allows engineers, security architects, solution architects to easily find out what does a secure design of their application look like before they even start writing a line of code. Whereas most application security tools are focused on testing code or testing an application, we're focused one step earlier at the point where you're still designing conceptually what does this application look like? What technologies are you going to use? And based on that design, we can already predict some security issues or security weaknesses that you probably want to predict.

Roland Siebelink:That's awesome. And how did you move all the way from that vineyard in Spain to Atlanta? Now I want to know the full details.

Stephen de Vries:It kind of grew. Just like a vine, if you water it, it gives a good harvest, it's going to grow. We started off as a consultancy way back in 2008. My background is more on the technical side of doing pen tests and training for developers around secure design, secure development. Out of that, we started building the product in about 2014. We sold our first license that was big enough for us to stop consulting in about 2015. And from there, landed a few initial customers. Raised the seed round 2017. Hired our first salesperson around that time. And then raised our Series A with Paladin Capital and 360 Capital in about August last year. On the basis of that, we then moved to the US, which is where the majority of our customers are, and to the UK, primarily in London.

Roland Siebelink:That's awesome. Can you give us a little bit of a feel for how successful Irius has been so far? Maybe the number of customers or number of employees, or I don't even know, maybe even the hundreds of offices that you have already.

Stephen de Vries:These days everybody has virtual offices, right? We could have 10. We've got three official offices - well four - Huesca, Madrid, London, and Atlanta. We're 68 employees now. And we've grown more than 120% since last year. And our year-on-year growth is upwards of 110% year-on-year in terms of our monthly recurring revenue. It's been exciting. It's been a lot of hard work. But it's great that we've established some really good relationships with our customers and that our customers stay with us and keep renewing and keep expanding.

Carlos Founaud:What type of teams do you have? How do you split them?

Stephen de Vries:We have a technical team based in Spain. We have a small sales team in Spain. In the UK, we've got mostly sales, marketing, and customer success and support teams. And then over in the US, we have a purely sales team, East coast, West coast, and Atlanta.

Carlos Founaud:You have development mostly in Spain?

Stephen de Vries:That's right. We grew up that way. Even though I say it's in Spain, it's all over Spain. We grew up like that, working remotely. Carlos, when you met us many years ago, we had a developer in Brazil who's still with us, Rafael, great developer. And we hired a few more in Huesca. But then as we kept on hiring, we hired in Galicia in the North, in the South, in the East, in the West. We've ended up with a completely remote team, which has really worked out well during this COVID time. I think companies were quite challenged if they had not already established this remote working situation, it was a challenging time for them to adapt. And luckily, we'd already established that as part of our DNA. It was quite easy for us to adapt to that form of working.

Carlos Founaud:You told me your sales team is mostly in the UK and USA. What type of customers are you targeting?

Stephen de Vries:That's interesting. We have mostly a good response from the financial services sector, banking, insurance, FinTech, even some crypto blockchain companies. And I think that is really due to the characteristics of those companies and what they want from cybersecurity and what the cybersecurity challenges are. For our product, we're focused on engineering teams who are building software. If you want to be a customer of ours and want to get value out of our tool, you are typically going to care enough about cybersecurity that you want to invest in secure design. I think a lot of the companies, maybe in mid-market SMEs, they're just not at that level of maturity yet. They just want something working. They don't care if it's got a few security bugs here and there; it's not going to harm their business too much. Financial services, completely the opposite. They absolutely care about the security of the software that they build.

Roland Siebelink:What have been your big growth drivers? The things that have been really driving success for Irius. The things you really feel are some of your success factors, if you will.

Stephen de Vries:In terms of the market, what has happened is there's a lot more attention being paid to threat modeling and secure design as a concept. This concept started, I think, in about 2004. Microsoft published a book on it. They released a tool and methodology to help engineers think about what they're going to be building from a design perspective before they go and build it. It's not a new concept. It's been around for a while. But it hasn't had this amount of momentum before.

Roland Siebelink:Building on that a little bit, I would like to maybe hone in a little bit on what are the things you're doing right. The things you're doing well at IriusRisk to really take advantage of those trends and tailwinds. What are some of the things, the practices you've developed that you find keep working really well for you?

Stephen de Vries:I don't know if it's a practice as much as a value that we have as a company is to stay really close to our customers. And maybe this came out of the fact that we started off as a consultancy. We were always working with clients. And when we changed to a product company, that thread in our DNA stayed there. We do stay really close to our customers. We have regular meetups with them. We've got a great customer success team who helps them literally be successful with our product. That they want them to get value out of our product. I think that's one of the things we're doing well is staying close to the customer, listening to them, helping them with services where we can. And, of course, feeding their feedback back into the product. One of the other things we've also done is we've taken on a more serious channel strategy, which previously we had done on an ad hoc basis. If a partner phoned us, we showed them a demo. We showed them the product. But there wasn't really a push from our end down a channel strategy. We've now hired a channel manager and he has been focused only on that, only on establishing those relationships. And I think for me, as a first-time founder, is one of those things that I didn't really have an appreciation of how much work it is to actually establish those relationships with the channel. I just thought, "Well, you show them a demo once. They know what the product is, and they'll go and sell it if they see an opportunity. It doesn't work like that. There needs to be a relationship. There needs to be follow up of opportunities. And our channel manager is handling that at the moment.

Carlos Founaud:How do you manage the teams? You have sales and marketing teams that are growing, they're in the UK and USA, and then you have techies all around Spain. Usually, tech guys with marketing guys, sometimes there are some difficulties understanding. How do you manage the whole thing?

Stephen de Vries:As a company, we've got great heads of teams in place now. We have our chief revenue officer, our CRO, who oversees all of sales and marketing. He's got a lot of experience doing that, managing sales teams and marketing teams, which are quite different animals to technical teams. My background is more with the technical side, so I'm really glad that he's on board to help work with the sales and marketing teams. And the same is true also for the technical team because that team has grown now to a lot bigger than what it was. Our CTO and our global tech leads now take charge of all of those technical teams. I just sit back and go to the beach whenever I like and everybody else is running the company (That is a joke!).

Roland Siebelink:That's the one thing you cannot cut out of the podcast. Stephen, this chimes with some of the research that the people from Notion VC did in London, where they said one of the core things you can do to accelerate your growth is to hire a game-changer. Bring in somebody with experience in managing a team that you are not that experienced at, especially if they've done it in a fast growing startup before. Has that been your experience then as well? And if so, how did you actually accomplish that?

Stephen de Vries:Yes, that has been my experience. I think one of the challenges for many founders is you don't know what you don't know. When you think of a sales leader, you're just having your imagination. It's like a salesperson times two who manages other salespeople. But what that actually means when you hire a sales leader is that that sales leader can lead a team. They have established processes. They can motivate a team. They can get the team to be disciplined about their projected revenues that they're going to close that month. I think all of that are the benefits of hiring experts in their area and bringing them into the company. I'd absolutely agree with that. You absolutely need to hire game-changers in every department. At different stages of our growth, we've hired game-changers for that stage. And they've been great game-changers for that stage. Sometimes they've been game changers for much longer or sometimes they've only been good for that particular stage.

Roland Siebelink:Many people are great at, let's say zero to 5 million to five to 15 million or something like that. Often, they even want to stick with that. They may be around, do a great job for three years and then decide to move onto the next level, startup or something like that.

Stephen de Vries: Exactly. Somebody described it as if you're colonizing a new land. The first people that land are the pioneers. The pioneers go in, break new ground, hack the Bush, and establish a camp. But once you've got a hundred people in the camp, it's not a camp anymore; it starts becoming a town. Now the people you need are the town planners who can establish some rules and so on around the town. And the pioneers, onboard, they don't want to live in the town. They want to be pioneers.

Roland Siebelink:Two questions about hiring those game-changers because it's a topic we haven't necessarily discussed in other episodes that much yet. One, how do you prioritize where you need game-changers most and when? And second, where do you actually find them?

Stephen de Vries:Good questions. I think you have a gut feel around which area of the business needs attention. You always want to spend time, energy, and money in the problem area. If things are going well, you don't necessarily need to do much therapy. You need to spend on the weak areas so that the whole thing moves up and the whole thing is supported. I think first identifying where you are weak, and maybe you as an exec team of a company. What are the elements that are missing from your experience? That's probably where you need to hire. That's the experience that you need. How you go about it, we've used a number of different agencies. Sometimes we hire through our own networks, people we know through our technical advisory board members or our larger expanded networks. But sometimes you need to use agencies and get people there.

Carlos Founaud:How do you decide which are the new features you want to put in your product?

Stephen de Vries:Good question. The first thing you do is you hire another game-changing role, which is a VP of product. Rather than that being a decision that is made very lightly about what new feature comes in, a VP of product to understand how product work can put some structure behind it. They can talk to the customer success team and the customer support team. And they can find out what are the broad themes of problems that we are solving for our customers and which of those themes is the most priority theme. In our case, we make threat modeling easier, and let's say we make it faster. Between easier and faster, which is more important to our customers and which one of those two things is going to help us sell more licenses of the software. If it's easier, that's the aspect that we should focus on. Then any features related to making the software easier should get a higher priority than those related to making them faster or to make them more stable.

Roland Siebelink:They often say that the VP of products is like a mini CEO. Also, the hardest VP position to fill. What's been your experience with that?

Stephen de Vries:Yes, that has been a very hard position to fill.

Roland Siebelink:More concretely, maybe, once you did fill the position, how did you go about separating the CEO role from the VP of products role? And what challenges did you face in trying to do that?

Stephen de Vries:I don't know if they're completely separated yet. They've organically grown to be separate roles. I don't think it's down to establishing any clear cut criteria. We've never had a meeting that said, "Okay, this stuff is yours. This stuff is the CTOs. This stuff is the CEOs." That has never happened. The VP of product just started doing product stuff. If he was doing it, the CTO wasn't doing it, and I wasn't doing it. It just fell into place. I think it will continue doing so. Maybe as we grow, we may need to have more clearly delimited roles. But at the moment it just worked out.

Carlos Founaud:Let's say in three to five years’ time you go to IriusRisk's new headquarters, wherever they are, what do you see? How many people are there? How many customers? Where are they based? What is your dream?

Stephen de Vries:To be honest, I don't look that far into the future. I really don't know what this is going to become. And I remember when we had a meeting with a company that can do R&D grants. And we had this meeting in 2015 when we were just starting out. We just sold one or two licenses. We had revenues of a hundred thousand Euros. And this guy, an expert in finance, came out with his Excel sheets that said: "Okay, you've got a hundred thousand this year. You're going to grow this much, so in five years’ time, 2020, you're going to be upwards of 2 million Euros in revenue. And I laughed in his face. I said, "That's impossible. How can you possibly do that? Your Excel sheet is doing magic. You can put whatever number you like in there and come up with answers." It turns out it was true. But I didn't see that from that perspective. I'm more focused on what we're going to do this year. What are we going to do next year? And for me, that vision is more focused around what are we going to do with the product, what we're going to deliver to our customers. And once we do that, then we'll see where we are then and what five years out looks like.

Roland Siebelink:Okay. What do you use to inspire your employees about the big horizon you're pointing them to? This is the mountain we're climbing.

Stephen de Vries:I think that different teams get their inspiration from different challenges. The technical team has done a tremendous amount of work with our products. They enjoy their technical challenges, so as long as we give them the freedom to make technical decisions, to make important decisions - even if sometimes those are gonna harm the business in the short term. When they say something like "We're going to throw away this framework we've been using for the last three years and we're going to use a new JavaScript framework that's going to open doors for us but it's going to delay product release three or four months," that's something we need to support. And we need to say, "Yes, we need to do that." Not only for their own inspiration and motivation and for their own professional growth but also for the company's long-term. You can't keep making short-term decisions. You sometimes have to swallow a bitter pill because you know it's going to help you further in the long term. For the sales team, they're often motivated by the types of customers that we work with. When we land a good account, a big logo, everybody knows. I think that helps motivate them as well. To see this is the market opportunity. This type of customer is coming to us and using our software, that helps motivate them that they've got a big market opportunity in front of them. They can go and close some interesting deals as well.

Roland Siebelink:We have been recording for mostly 40 minutes now, maybe we can move to how can our listeners help IriusRisk most. Hearing a great growth story, a compelling plan for the near future, if not the far future yet. What can our listeners help you with the most? What do you need from them? Do you need job applicants? Do you need intros to investors? Do you need everyone in the world downloading your ROI calculator? What do you need?

Stephen de Vries:Well, that's an interesting one. Intros to investors are always helpful because we'll probably be raising mid-next-year our series B. It's always good to meet new partners. What the listeners could also do is they could try out our free community edition. It's linked to from our website. They can try out the threat modeling tool and see how it can help them design secure software. If that's a cloud-based application, or software-based application, or a mixture of the two, it'll help give them an idea on what are the kinds of security issues that are going to be facing before they start building that application. Of course, if they'd like to work with a startup who's growing rapidly and doing some interesting work in security design and threat modeling, please get in touch.

Carlos Founaud:Just to finish, you were a first time CEO, first time founder, tell me what have you learned?

Stephen de Vries:It's been an amazing experience for me personally because I never saw myself really, as a CEO of a company. I always saw myself more in the CTO role, more in a product-centric, technical role. And as I've been doing it more and more, I've been learning more and more, and I'm feeling more comfortable in this skin as the CEO of a company. All the things that go along with a non-technical part of a company: metrics, financials, raising capital, getting finance, the legal aspects, sales, marketing, all of that was new to me. It was all things that I had to learn on the job. I can go on and on, but that's the essence of it. Almost everything that's not technical, that's new and that stuff I learned while in this role.

Roland Siebelink:Stephen, if you could impart just one lesson to founders who are five years behind you, what would it be?

Stephen de Vries:Don't think that it's something that you need somebody else to get to do. You can do it yourself. And you can do it. If you're doubting whether you're right for the role, you're fine. You're right for the role. Go and do it and see what happens. I'm sure you'll find something in yourself that will pull you through.

Roland Siebelink:That's awesome. Very good closing words. Thank you so much, Stephen de Vries, the CEO and founder of IriusRisk. And thank you, Carlos, for joining us as a co-host this week on the Midstage Startup Momentum Podcast. Thank you, everyone, for listening.

Roland Siebelink talks all things tech startup and bring you interviews with tech cofounders across the world.