Show Notes
Whether you’re one person or a multinational corporation, so much of our
personal information exists on the Internet. It has made data security an
absolute necessity, and that’s unlikely to change in the foreseeable future.
Fortunately, there is a data security startup called Fortanix that’s thinking
outside the box and offering a platform that keeps data protected even when
you’re on an untrustworthy network.
Fortanix CEO and co-founder Ambuj Kumar recently sat down with startup coach
Roland Siebelink on the Midstage Startup Momentum Podcast to discuss his
data-first, multi-cloud security startup. Naturally, the conversation moved
beyond what Fortanix does with Ambuj sharing the most important lessons he’s
learned as a first-time founder and CEO.
- The strategy Ambuj used for speaking with potential customers while developing his product.
- The keys to getting useful feedback from potential customers, even if it’s negative feedback.
- Why Fortanix is striving to sell its product to the top companies in the world.
- Why it’s important for CEOs to handle the first several sales that their startup makes.
- How it’s possible to build a successful company by attracting average talent.
- Why Ambuj doesn’t mind being told that he’s wrong about something.
Transcript
Roland Siebelink:Hello and welcome to the Midstage Startup Momentum
Podcast. My name is Roland Siebelink and I have with me today Ambuj Kumar, who
is the co-founder and CEO of Fortanix. Hello, Ambuj, thank you for joining us.
Ambuj Kumar:Thanks, Roland. Looking forward.
Roland Siebelink:Absolutely. Fortanix, tell us what do you do and what
difference do you make in the world for whom?
Ambuj Kumar:We are a data-first multi cloud security company. In today's
world, security and privacy are always top of mind for everybody, be it
individual or corporation. The question is "How do you keep your data secure in
the cloud as enterprises spread around the world?" We provide a data protection
platform where companies can keep their data protected, even when they are in an
untrusted network.
Roland Siebelink:Excellent. Very good. Security data protection, that's a
big ocean to try and boil. Where and what particular niche is Fortanix playing
compared to other categories, other companies that are perhaps already more
established in this field.
Ambuj Kumar:Good question. Most of the security companies today, they try
to keep your network, your firewalls, your infrastructure protected. Fortanix is
rather unique in that we took a view that you don't need a secure infrastructure
to keep your data secure. If you are, let's say a CISO of a large bank, you are
constantly worried about keeping your data protected, not your firewall
protected. And your firewall protection, your network security, is a means to an
end. And that end is data security. We took that shortcut and said: "Hey, even
if the infrastructure is compromised, what can we do to keep your data secure?"
And we call that decoupling security from infrastructure. It's a rather unique,
rather new perspective on security, where we are trying to say: "Hey, you don't
have to keep your network secure. You don't have to keep your firewall secure."
And try doing those things. Best practice is defense in depth. Keep doing what
you are doing, but in addition, augment those things by data protection. Even if
your firewall gets broken, somebody finds their way in your house, your data is
not a sitting duck.
Roland Siebelink:Okay. Excellent. It's another layer of security that gets
much more to the core of protecting data. That's how I understand it. Before we
go into how you've built Fortanix and how the company is doing, maybe we can
also delve a little bit into your own background, Ambuj. How did you come to
found the company and what were you doing before?
Ambuj Kumar:Yeah, good question. I was an engineer at Nvidia, where I built
some of the world's fastest chips. Now they are powering all the AI engines
everywhere. You can only connect the dots in hindsight. When I joined Nvidia, it
was maybe 500 employees, 400 employees. And it was maybe a $5 billion company.
Now Nvidia is a $500 billion company. At that time I got to work closely with
Jensen Huang, who is a legendary CEO now. But at that time, he wasn't known.
Working with him, I got to see how a $500 billion CEO operates their day, how
they react to various things, what is their reason and passion? That certainly,
as I find out now, turned out very, very influential for me.
And then I left Nvidia in 2010, about 10 years ago, to work for a company called
Cryptography Research Inc., a cybersecurity company. I was the chief architect
there. I worked there for five years. If you put those two things together, my
background in cryptography research and working for a company like Nvidia that
was one of most remarkable transformative companies in history. Those things
helped me as I was trying to find my own company, figure out what is wrong with
the world, and I found Fortanix.
Roland Siebelink:When did you found Fortanix and what was the early
history? How long did it take you to start seeing the first successes?
Ambuj Kumar:We founded Fortanix in 2016 summer. My viewpoint was that
coming from a hardware background at Nvidia and an encryption background at
Cryptography Research, I had knowledge that using hardware, you can keep your
data secure. And that was 2015-16 when privacy and security breaches started to
go through the roof. And they have not stopped. But I looked at various
solutions that other security startups were offering, and almost all of them had
some network bend to it.
They all tried to keep your firewall protected. They all tried to keep your
network protected. They all tried to keep your software protected, your systems
protected, your machines protected, your users protected. But nobody was working
at keeping your data protected. And to me, that looked really, really odd
because if the goal of security is to keep your data protected, why not do that?
And then when I started to dig deeper on why that is the key, it turns out that
we didn't have the technology to keep data secure if your infrastructure was not
secure. I built a new technology called Runtime Encryption to fix that. And if
you think about our data, our photos that we have on our mobile phones, if
somebody steals our phone, they don't get access to our data because all our
photos are encrypted with keys that we punch in.
Similarly, when we connect to our bank's website, all of that data that goes
from our browser to our bank server, it goes encrypted because of something
called SSL, TLS. But once the servers get the data and they start to process, at
that time, they become vulnerable because there was no way of keeping data
protected, encrypted during that process.
We created this new technology called Runtime Encryption. And in conjunction
with securing data at rest, in motion, and in use, now we can offer a platform
where your data is protected regardless of anything else. That was a rather
transformative idea that looked almost impossible to build.
We worked from fundamental principles, so we understood how CPUs work, your
machines boot, things like that. Using that, we started to build our product.
But it would take two to two and a half years until we had our product ready.
But we were ready for that because it was a really new approach and we didn't
have somebody to follow into it, so we knew what was coming, so we had planned
accordingly.
And in the meantime, we kept talking to different customers, prospective buyers,
always. We always knew that if we could build a product, then they would come.
All our energy was focused on building the product.
Roland Siebelink:Okay. Tell me a little bit more about that. You already
mentioned your core customer is the CISO, the chief information security
officer. Is it at larger companies typically that you go for?
Ambuj Kumar:Good question. When you are building your product, you want
fast validation. In the early days, you are talking to almost everybody, anybody
who is willing to talk to you. During the build-up phase, we did the same. But
then the time came to sell it. I wanted to always build a generational company,
something that would be known as my legacy and something that will last for
hundreds of years.
In that we said that, "Hey, when we start to sell, we will sell to the most
discerning, most advanced companies of the world." Companies that are the
hardest to sell to, especially if you are a rather unknown startup like
Fortanix. But we said that, "Hey, if we in our head believe that our product is
so differentiated, so unique, so hard to build, then why not go knock on those
doors where if we do get in, and it's extremely hard to get in, but once we get
in, it will bring a certain amount of legitimacy to us and it will make our life
easier.
For the first year or so, we exclusively focused on Fortune 500 companies.
That's where we started to get our foothold. And once we were there, then we
opened up the floodgate. We sell to the midmarket. We sell to anybody who has
business data that they want to predict and willing to do some cloud
transformation.
Roland Siebelink:Okay. Very good. The talking to customers before the
product was even ready, that's something I hear a lot. How did that go for you?
How did you even get the meetings and how are you able to build those
relationships to kickstart your go-to market once the product really was ready?
Ambuj Kumar:Yeah, good question. I feel that the world is always rooting
for a new hero, especially in the Silicon Valley or the tech world that we live
in, I think if you have the right ideas and you show a little bit of humility,
lots of people want to talk to you. Lots of people want to help you. At least
that was my experience. I didn't have any previous relationship. I was just
sending cold emails to lots of people on LinkedIn, on email and saying that,
"Hey, these are my ideas. Do you have half an hour to chat with me and just tell
me what I should be doing, not doing. Is this problem relevant to you, not
relevant to you? How much money you would pay and things like that. People are
surprisingly open.
Roland Siebelink:Okay, that's awesome. Many people with a similar
background - let's say core tech engineering background - feel a little bit
uncomfortable with that whole reach outside and get them to talk to customers
and doing sales all the time. How was that for you? Was it something you had
learned already or was it something you had to teach yourself?
Ambuj Kumar:I'd never sold a single thing before founding Fortanix, so it
was something I had to learn. But I feel that most people are afraid of being
told no. Or most people are afraid of figuring out that they are wrong. In my
case, I just take the polar opposite view. Building something that is useless or
doing something that doesn't make sense, I want to be told sooner than later.
Because my time is limited, my lifetime is limited. If it's a product that won't
go anywhere, I want to be told today.
When I talk to my customers, if I say, "Hey, I fixed this problem, that problem
for you." and they tell me that no, those are not the relevant problems, the
more pressing problems are here. I would rather have that knowledge. I was not
uncomfortable - even a tiny bit - in approaching people for feedback. Many times
people don't give you feedback because they don't understand your problem. They
don't understand the solution. Which is fine, you move on. You have 10 of those
conversations, five would be good conversations and maybe one of them would be a
transformative conversation.
Roland Siebelink:How do you distinguish between the feedback you just move
on from and the feedback that is so relevant that maybe you have to change your
vision?
Ambuj Kumar:You ask probing questions. If somebody says, "Hey, this
product, this product doesn't work for me" or "This is not a valid problem,"
Then you ask why that is. Maybe they'll say, "Hey, this is my company's
priority." Or they will try to push you away the moment you start to understand
their viewpoint. In my experience, I found those conversations to be not that
helpful. On the other hand, they said that, in my viewpoint, cloud security
needs to be data dominated, not network dominated. Then I'll ask why is that?
And then they'll say that, "Because in the cloud, networks are very ephemeral.
There's too many of them. I can't manage them." Then you've got something going.
You ask probing questions.
Roland Siebelink:Just for those that are trying to start on this journey
and talking to as many customers as possible, can you give us an indication how
many people you talk to and how often?
Ambuj Kumar:Yeah. I was very structured. You have so many of these
conversations, you try to mix things up, so I built an Excel sheet. I had a
schedule where I talked to this person, this person, this person. And for every
single meeting that I had, I documented the note. I feel that writing is an
understated skill and it's difficult. If I were to write, "Hey, what did I learn
from this meeting?" It puts pressure on me. It takes time and things like that.
But I was of the view that if I got somebody to spend a half an hour with me,
half an hour of my time, half an hour of setting it up, half an hour thinking
about it. Probably two hours, then it's worth spending 15 minutes for me to
document what I learned or didn't learn. Every single meeting I had, I
documented.
Roland Siebelink:Did you send back that note to the person? Just for
yourself?
Ambuj Kumar:Just myself so that I can remember who said what. And that was
very, very helpful. To give you some sense of how many customers I talked to,
probably I was talking to 30, 40 people a week.
Roland Siebelink:Wow. That's a lot, huh? How did you get anything else
done?
Ambuj Kumar:Most of these conversations are very, very short. Anybody who
has been in sales knows that at the top of the funnel, you care about volumes.
You are spending 50 of these meetings, 30 of those meetings are terminated
within the first five minutes because it's not a relevant audience.
Roland Siebelink:Oh, I like that. That's actually a great sales technique.
Get to the "No" very fast.
Ambuj Kumar:There are plenty of people who would help you and plenty of
people in your market. You don't need to waste your time on somebody who is not
because it's also disrespectful to them. If you have those meetings, 30 of them
are terminated within first five minutes; 20 of them, after 5-10 minutes, the
person on the other end, they will figure out that you are not as mature as they
thought, you are not as smart as they thought, you are not as relevant as they
thought. They will terminate the meeting. You are left with five, 10 good
conversations. If you are not having at least two half-an-hour-long
conversations every day, you are doing it wrong.
Roland Siebelink:Okay. Excellent. Thank you for illustrating that. I think
really understanding that it's a numbers game and that you can move beyond the
fear of rejection just by talking to more people. I think that's a seminal
insight for people who are not used to sales yet. Absolutely. Let's then talk a
little bit about once your product was ready and once you start scaling. What
happened to get started, moving things beyond just Ambuj and your co-founders?
Ambuj Kumar:Yeah. It's important for founders to do first sales themselves
because in doing so they will learn so many things. What you actually don't want
is that you have a super smart salesperson who goes and sells your product to
their past relationship or something. You don't want that. You would rather have
an average or below-average salesperson and your product sells by itself because
that's a repeatable process. The only way the founder can figure out which one
is the case, is being in the field yourself.
I will say that as a founder, it's important that you do 10-15 sales yourself.
Those 10-15 sales will teach you a lot. They will teach you whom to talk to,
what is the pricing, who is the target audience, what is your messaging, what
are common questions you will get, things like that. You are also building a
repository of those things. For example, every single time customers ask us,
"Hey, how are they different from XYZ? Will this work for this particular use
case?" We are documenting. Building our own knowledge base. And then later on,
when you hire salespeople, you can use that information to hire those people.
Roland Siebelink:How have you found yourself learning since the early
stages of talking to customers and then turning into a CEO of a 150-people
company? What have been some lessons that you yourself had to adopt and where do
you see yourself changing?
Ambuj Kumar:Lots of things. The way you manage yourself. Early days when
you don't have any customers is different from managing your first 10 people.
Then you start managing 20 people. Then maybe you start managing managers. And
then you start to manage an organization. They all require different skills.
Good thing is that there are plenty of books, plenty of videos, tutorials,
plenty of people who are willing to help you. You have a little bit of learning,
even a little bit of learning attitude. It's a constant journey. Everybody is
trying to get to the next one, but it doesn't really matter whether you are a
10-people company, whether you work for a hundred people, a thousand, ten
thousand. Everybody has a battle. All CEOs, all leaders are constantly trying to
learn and grow their organization. You are no different from anyone else.
Roland Siebelink:What have been your go-to resources, Ambuj, in learning
about managing people, managing managers, managing an organization? What have
been the most helpful resources? Which books or people or peer groups have you
relied upon?
Ambuj Kumar:I think for me it starts with defining the culture of your
company. You can build your company by attracting your top talent. You can also
build a company attracting average talent. You can build a company that is
passionate about solving cloud data security and privacy like we are, where
people get offended when somebody else gets breached. You can also build a
company where you are paying people lots of money. You can build a company where
your goal is world domination; everybody is centered on that. I think figuring
out those ethos, what are central fundamental traits that will attract people is
really, really fundamental because then you can use that to manage people.
There are plenty of books that I have read. Harvard business reviews are very
helpful. "No Asshole Rule" is a book that I found useful. Management by
Objectives is useful. OKR methodology is very useful. Those are some of the
things that I would recommend.
Roland Siebelink:Excellent. Looking back over those years since 2016, what
would you say have been the biggest - maybe surprising - achievements, where you
came much further than you would have thought?
Ambuj Kumar:You never know how far this will go. That is always there. And
I always wanted to build the world's largest security company. I will say that
our product turned out to be really, really powerful. In the early days when we
were doing lots of customer discussions, prospect discussions, I thought that it
would take a while before people would figure out how useful, powerful this
product is. As it turns out now, almost every single discussion we go into and
somebody gets exposed to our product, they end up purchasing our products sooner
than later.
Roland Siebelink:One last question, if there's one thing you would advise
founders coming behind you that are working on their companies right now, what
would it be?
Ambuj Kumar:I would say don't trust anyone - don't do something because
somebody else told you to do so. Have trust in yourself. If somebody says that
your idea is bad or your product is bad, you need to understand why. Without
that "why" that feedback is meaningless. Similarly, and much more importantly,
somebody says that your idea is great, your product is great, up until you know
why, that feedback is meaningless.
I find entrepreneurs, founders stumble a lot because somebody early on told
them, "Hey, this is their thing." The person moves on, VCs fund you. employees
join your company, and it's like a circle. The customer said that it was a good
idea, VCs fund you because the customer said so, employees join you because VCs
fund you. There is no one who understands why you are doing something. As a
founder, that is your fundamental job to make sure that you are building
something worth building.
Roland Siebelink:Okay. Excellent. Thank you so much. That's a great quote.
Finally, the real last question, if people want to figure out more about
Fortanix, where can they go and what do you need most from our audience? What
can they help you with?
Ambuj Kumar:Yeah, good question. We are always trying to hire good people.
Somebody excited about security, please join us.
Roland Siebelink:Is it technical people? Go-to market paper. What are you
looking for?
Ambuj Kumar:Everyone. We are in a hyper-growth phase. You can find more
about us at Fortanix.com. I'm also on LinkedIn.
Roland Siebelink:Perfect. And if any investors or other people want to be
in touch with Ambuj, I'm happy to provide an introduction as well. Thank you so
much, Ambuj, for joining us on the Midstage Startup Momentum Podcast. This has
been a great interview and thank you for sharing all your experience with our
audience.
Roland Siebelink talks all things tech startup and bring you interviews with tech cofounders
across the world.