Cybersecurity Builders

Frontlines.io
  • 5.0 (1)
  • ENTREPRENEURSHIP
  • UPDATED BIWEEKLY

GTM conversations with founders building the future of cybersecurity technology.

  1. How StackHawk repositioned runtime testing as the essential layer when AI-generated code made static analysis unmanageable

    3D AGO

    How StackHawk repositioned runtime testing as the essential layer when AI-generated code made static analysis unmanageable

    Joni Klippert⁠ didn't come from security. She came from DevOps — two companies, including VictorOps, which she joined as the first non-engineering hire and helped bring to market. At conferences like DevOps Days Enterprise, she kept running into the same frustrated security teams: they knew they couldn't keep up with the pace of software delivery, but their only move was to act as a gate. That observation, paired with her co-founder Scott Gerlach's decade of practitioner experience — including CISO at ⁠SendGrid⁠ through its acquisition by Twilio — became StackHawk: a dynamic application security testing platform that puts runtime vulnerability testing directly into the CI/CD pipeline, built for the engineers writing the code. In this episode, Joni breaks down how she abandoned her original PLG thesis when enterprise came knocking, how AI-accelerated software delivery has created a structural problem for static analysis tools that benefits StackHawk, and why category definition in AppSec is less about analyst quadrants and more about being precise about what you test and how. TOPICS DISCUSSED Why a DevOps founder built her third company in cybersecurityThe structural ceiling in engineering-led PLG deals — and what it signals about ICPHow StackHawk's first major enterprise logo arrived inbound and changed the GTM thesisRotating segment focus when market conditions compress SMB security budgetsWhy AI-accelerated code delivery is a tailwind for runtime testing and a headwind for static analysisBuilding a bridge product for aspirational enterprise buyers who aren't yet DevOps-nativeCategory definition when you don't fit cleanly into AppSec or API securityWorking with analysts on emerging categories like DAST in the age of AIThe organizational misalignment between engineering velocity goals and AppSec team operating models// Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM⁠

    21 min
  2. AI vs. AI: why Quantro Security is building defense for the era of AI-native offense

    MAR 18

    AI vs. AI: why Quantro Security is building defense for the era of AI-native offense

    Mehul⁠ spent over 20 years building cybersecurity products, including early time at Tenable where he watched the company scale from a scrappy startup to a billion-dollar platform. Now he's co-founding ⁠Quantro Security⁠, which just came out of stealth with an AI agent platform built specifically for cyber defense. The core thesis: AI has reduced the cost of building attacks to near zero, and static rules-based defense tools weren't built for what's coming. Topics Discussed: How AI reduced the cost of exploit development and what that means for defenders Why Quantro Security rejects CTEM, risk-based VM, and every existing category The "user interface of record" positioning vs. the "system of record" frame most AI companies chase Three competitive buckets: hyperscalers, siloed point tools, and internal build teams Why agents should be prompting humans, not the other way around The vision for a small elite security team managing 50 to 100 purpose-built AI agents Key Insights: AI-native offense requires AI-native defense. Mehul's core thesis isn't speculative — it's built on what he watched happen to his own craft. Writing vulnerability exploits once required deep skill and months of work. AI collapsed that barrier. "So now an attacker can essentially build a functional exploit with just a prompt." The implication for defenders is direct: the tools built for the old pace won't be sufficient for the new one. Rejecting every existing category. When Quantro came out of stealth, the obvious move was to slot into CTEM or risk-based vulnerability management. Mehul passed. "Are you a CTEM player? Are you a risk-based VM player? Are you VM player? Well, no, no, no, none of that." The existing categories imply replacing tools. Quantro's frame is different: become the connective layer on top of what customers already have. User interface of record, not system of record. Most AI companies pitch replacing core platforms. Quantro's pitch is the opposite: "We don't replace the tools. We just make their existing tools much more, much more effective." Enterprises aren't ripping out entrenched infrastructure. They want ROI from what they've already bought. The barbell competitive map. Mehul frames the landscape as a barbell: hyperscalers ("a mile wide, a millimeter deep") on one end, siloed point tools (deep in their own data, blind to organizational context) on the other. Quantro positions as the connective tissue between them. The 50% false positive tax. When Mehul talks to security prospects, the same reality surfaces: "Almost 50 % of the time is triaging false positives, reaching out to the people." Asset ownership is unclear. Handoffs break down. None of it moves the risk needle. The agents absorb that work. // Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ // Topics Discussed:GTM Lessons For B2B Founders:Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM

    20 min
  3. How Heka Global positioned web intelligence as a fourth fraud detection layer to avoid vendor comparison | Idan Bar-Dov

    FEB 11

    How Heka Global positioned web intelligence as a fourth fraud detection layer to avoid vendor comparison | Idan Bar-Dov

    Identity fraud spiked 148% in 2025 as AI democratized identity fabrication. Financial institutions now face a fundamental question: Are you dealing with a real human? Heka Global is addressing this with web intelligence—analyzing digital footprints like connected applications rather than traditional signals. In this episode of BUILDERS, I sat down with Idan Bar-Dov⁠, Co-Founder & CEO of ⁠Heka Global⁠, to explore how his company created a fourth layer in the anti-fraud stack and why legacy identity verification systems are becoming liabilities rather than assets. Topics Discussed:  The emergence of "fraud as a service" and why consumer-facing attacks replaced traditional enterprise breaches How web intelligence works: validating identity through connected applications and digital footprints The anti-fraud tech stack: credit bureaus, biometrics, transaction analytics, and web intelligence as distinct layers Why heads of fraud expand budgets rather than replace vendors, and what causes solutions to get kicked out The partnership sales model: navigating vendor management complexity and red tape in financial institutions Why 10-person dinners and fraud simulations outperform traditional enterprise marketing How Barclays and Cornerback backing solved the chicken-and-egg problem for a data product Why specific fraud prevention messaging (account takeover, synthetic identities) beat investor credibility GTM Lessons For B2B Founders: Target ICP based on liability exposure, not just industry fit: Heka narrowed beyond "financial institutions" to lenders who bear immediate losses from fraud—companies like LendingPoint, Avant, and Upstart. These buyers feel the pain acutely versus institutions with reimbursement terms who can deflect liability. Idan's insight: "We need the client to feel the pain just as much as we see it. That means we want them to see the liability." Frame your product as a new stack layer, not a competitive replacement: Heka positioned web intelligence as the fourth distinct layer after credit bureaus, biometrics, and transaction analytics. This became their second pitch deck slide, showing logos of each category. The result: buyers stopped comparing Heka to existing vendors and started evaluating complementary value. Abandon spray-and-pray for sub-1,000 TAM markets: Heka tested Lemlist flows with targeted LLM personalization and saw zero pipeline from it. Idan's take: "When you're selling to maybe a thousand financial institutions, that's it. You can be super specific when you target them." For enterprise plays with small addressable markets, allocate zero budget to automated outbound. Focus entirely on warm introductions, relationship nurturing, and becoming known to every relevant buyer through content and community.Leverage investor networks to break data product cold-starts: Data products face a critical barrier—you need customer data to prove value, but need proven value to get customers. Heka solved this by bringing on Barclays and Cornerback as investors who vouched for the team's capability to "do magic and create a new layer." Their backing convinced risk-averse financial institutions to pilot. //  Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM

    24 min
  4. Why Portnox's CEO refuses to measure Net Promoter Score | Denny LeCompte

    FEB 11

    Why Portnox's CEO refuses to measure Net Promoter Score | Denny LeCompte

    Portnox⁠ is an enterprise access control platform that eliminates passwords and enforces zero trust security. The company was bootstrapped for over a decade, plateauing at a few million in ARR before investors brought in ⁠Denny LeCompte⁠ as CEO four years ago. Since then, Portnox has grown 8x. But this episode isn't about that growth story. Denny, a former cognitive scientist and professor who taught psychometrics, uses his scientific background to systematically dismantle Net Promoter Score—explaining why it's methodologically flawed, how it misleads organizations, and which metrics actually correlate with business performance. This is a contrarian take grounded in measurement science, not marketing opinion. Topics Discussed: The fundamental psychometric flaws in NPS: why single-item questionnaires are unreliable and why throwing out 7s and 8s violates basic statistical principlesHow NPS scores fluctuate based on survey UI presentation independent of actual customer sentimentWhy NPS creates incentive structures that encourage gaming rather than improving customer outcomesThe case for gross revenue retention and net revenue retention as the only ungameable metrics that matterHow measuring human behavior changes that behavior (the Heisenberg principle applied to business metrics)Why investors care about retention rates above 90% but don't ask about NPS scores GTM Lessons For B2B Founders: Single-item questionnaires violate measurement principles: Denny's background in psychometrics immediately flagged NPS as unreliable. One-item measures lack the redundancy needed for reliability, and the methodology of throwing out middle responses (7s and 8s) then subtracting detractors from promoters is statistically nonsensical. At a previous company with thousands of data points, he observed NPS scores drop and rise based solely on how the survey rendered on the page—no business changes, just UI differences. Compensation drives behavior more than metric accuracy: Portnox structures customer success compensation as 50% gross revenue retention and 50% net revenue retention. These are determined by finance and can't be manipulated. Denny had to rein in his CS team when they became overly focused on time-to-value because any number you give a team becomes their obsession. With NPS, teams game survey timing, cherry-pick recipients, and optimize for score rather than outcome. Investors evaluate retention rates, not satisfaction surveys: When Denny presents gross retention above 90%, investors don't ask about NPS. Renewal behavior reveals actual satisfaction—customers voting with budget rather than survey responses. The test for any metric: "What are we doing differently if this number is up versus down?" If it doesn't drive distinct actions or reveal information not already visible in financials, eliminate it. Question inherited practices ruthlessly: NPS gained adoption through Harvard Business Review credibility in 2003 and consulting firms building practices around it. The promise of "one number you need" appeals to executives wanting simple solutions. But herd behavior—"everyone else measures it"—perpetuates bad methodology. Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPLSMFimtv0riPyM

    18 min
  5. Joe Levy, CEO of Sophos: $1.5 Billion ARR and the Future of Cybersecurity at Scale

    11/25/2025

    Joe Levy, CEO of Sophos: $1.5 Billion ARR and the Future of Cybersecurity at Scale

    Sophos⁠ represents one of cybersecurity's most vulnerable companies, founded in 1985 as an antivirus provider and now operating at massive scale with $1.5 billion in ARR and 5,700 global employees. Under CEO Joe Levy's leadership, the company has undergone a fundamental transformation from a traditional product-focused vendor to a services-driven platform that addresses core market failures in cybersecurity. In a recent episode of Category Visionaries, we sat down with ⁠Joe Levy⁠ to learn about the company's pivot to managed detection and response (MDR) services, their $860 million SecureWorks acquisition, and their vision for democratizing cybersecurity strategy across millions of organizations worldwide. Topics Discussed:  Sophos's evolution from antivirus origins through multiple business model reinventions over four decades The strategic pivot to managed detection and response (MDR) services starting in 2018-2019 Building organizational support for major business model changes through experimental frameworks Managing channel partner relationships during service transformation with 25,000 global partners The $860 million SecureWorks acquisition and integration strategy to achieve category leadership Scale as a competitive advantage in cybersecurity platform operations The future vision of democratizing cybersecurity through "virtual CISO" services at massive scale GTM Lessons For B2B Founders: Address systemic market failures through business model innovation: Joe identified that cybersecurity's core problem wasn't technology quality but post-sale execution. "As an industry we have been really good at buying and selling products, but we've never been good. In fact, we've been terrible at their implementation and their lifecycle management." This insight led to Sophos's services transformation. Structure major strategic pivots as controlled experiments: When proposing the MDR services pivot, Joe framed it as a measurable experiment rather than a leap of faith. "The conversation primarily consisted of, I want to run an experiment. Invest heavily in stakeholder alignment during business model transitions: The most challenging aspect wasn't technical but maintaining relationships with 25,000 channel partners who might view new services as competitive threats. Shift sales focus from product features to guaranteed outcomes: Sophos had to retrain their sales organization for services selling. "The fundamental difference between selling a product and selling a service is... what the expectations of the outcome that service is going to provide for them." Use strategic M&A to achieve immediate category leadership: Rather than relying solely on organic growth, Sophos accelerated their MDR strategy through the $860 million SecureWorks acquisition. "It technically makes us the largest MDR operator, pure play cybersecurity MDR operator... on the planet today." Build scale as a defensible competitive advantage: Joe argues that scale is "an often overlooked but a critically important element when it comes to the selection of information technology vendors." In platform businesses handling massive data volumes and real-time operations, the ability to operate at scale becomes a key differentiator.   //  Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role.  Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM

    36 min
  6. How Wultra built category leadership as the only post-quantum provider for banking digital identity | Peter Dvorak

    11/17/2025

    How Wultra built category leadership as the only post-quantum provider for banking digital identity | Peter Dvorak

    Wultra⁠ provides post-quantum authentication for banks, fintechs, and governments—protecting digital identities from emerging quantum computing threats. In this episode, ⁠Peter Dvorak⁠ shares how he broke into the notoriously closed banking ecosystem by leveraging his early experience in mobile banking development. From navigating multi-stakeholder enterprise sales to positioning quantum-safe cryptography when the threat timeline remains uncertain (consensus: 2035, but could accelerate), Peter reveals the specific strategies required to sell mission-critical security infrastructure to regulated financial institutions. Topics Discussed: How post-quantum cryptography runs on classical computers while protecting against quantum threatsWhy European banking regulation drives global authentication standardsThe multi-stakeholder sales process: quantum threat teams, CISOs, CTOs, and digital product ownersConference strategy and analyst relationships (Gartner, KuppingerCole) for category positioningBanking budget cycles and why June/July approaches failBreaking the "who else is using this?" barrier with banking-specific proof pointsPositioning as the only post-quantum cryptography provider for digital identity in banking GTM Lessons For B2B Founders: Layer future-proofing onto immediate ROI: Post-quantum cryptography doesn't require quantum computers to function—it runs on classical infrastructure while providing superior security. Peter sells banks on moving from SMS OTP to mobile app authentication (tangible, immediate benefit) while positioning quantum resistance as migration insurance: "You won't have to rip-and-replace in three years."Give struggling departments concrete wins: Large banks have quantum threat teams tasked with replacing every piece of software by 2030-2035. Peter gives them measurable progress: "We move you from 5% to 10% completion on authentication and digital identity." These teams need defensible projects to justify their existence. Banking references are binary gatekeepers: Every bank asks "who else is using this?" Non-banking customers (telcos, gaming, lottery) don't count—banking regulation and systems are fundamentally different. The first banking customer is the hardest barrier. Once cleared, subsequent conversations become tractable. Respect the annual budget cycle: Banks allocate resources 12 months ahead. Approaching in Q2/Q3 means budgets are locked—even free POCs fail because internal resources are committed. Peter's pipeline strategy: build relationships and maintain visibility throughout the year, then activate when budget windows open. Map and sequence multi-stakeholder buys: Authentication purchases require alignment across quantum threat teams (if they exist), cybersecurity/compliance, CTO/CIO (infrastructure acceptance), and digital product owners (UX concerns affecting their KPIs). Start at director level—board executives are too removed from technical details. EU regulatory leadership creates expansion vectors: European regulations like PSD2 and strong authentication requirements get replicated in Southeast Asia, MENA, and other regions. Peter benefits from solving EU compliance first, then riding regulatory diffusion. The US remains fragmented with smaller regional banks still using username/password. // Sponsors:  Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role.  Subscribe here:⁠ ⁠ ⁠https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM

    18 min
  7. Funding the Future: Mike Janke, Co-Founder of Data Tribe

    11/09/2025

    Funding the Future: Mike Janke, Co-Founder of Data Tribe

    In today's episode of Category Visionaries, we speak with ⁠Mike Janke⁠, Co-founder of ⁠Data Tribe⁠, a venture capital firm driving change through a whole new approach to investing, about how a hyper-targeted and hands-on approach has helped them achieve a 96% success rate when it comes to guiding their partners to transformative market change and, ultimately, commercial viability. By carefully selecting only truly innovative startups and embedding deep in their operations, Data Tribe are making a name for themselves and their world-changing technologies. We also speak about Mike’s unorthodox entrance into the startup sector from a background in the military, what really excites him about the investment cycles he’s involved in, why so many of Data Tribe’s partners originate from the state-supported sector, and why there’s no real way to scale the Data Tribe hyper-focused approach to venture beyond a few hand-picked partners. Topics Discussed: Mike’s path to venture capital, from the military to being a six-time founder in the startup tech sector and beyondThe deluge of investment funding innovation in the state sector, and how Data Tribe helps build-out commercial viability beyond itHow Data Tribe ended up behind six of the World Economic Forum’s ‘technologies of the year.’Why Data Tribe focus on a small number of hand-selected partners, and what makes their approach impossible to scale furtherWhat makes for a good investment pitch, and why you should always leave it to the investor to set the valuationWhy category creation isn’t a panacea, and why an innovative technology will guarantee a new category if it’s truly transformative

    28 min
  8. How BlueRock identified three distinct buyer personas by asking "How would you describe what we do to your peers?" | Bob Tinker ($25M Raised)

    11/07/2025

    How BlueRock identified three distinct buyer personas by asking "How would you describe what we do to your peers?" | Bob Tinker ($25M Raised)

    BlueRock is building an agentic security fabric to protect organizations deploying AI agents and MCP workflows. With a $25 Million Series A, founder Bob Tinker is tackling what he sees as a 10x larger opportunity than mobile's enterprise disruption. Bob previously scaled MobileIron from zero to $150 million in five years and took it public in 2014. In this episode of Category Visionaries, Bob shares the strategic mistakes that cost MobileIron its category positioning, why go-to-market fit is the missing framework between PMF and scale, and how B2B marketing has fundamentally transformed in just 18 months. Topics Discussed: Taking a company public: the killer marketing event versus the unexpected team psychology challenges of daily stock volatilityWhy agentic AI workflows create unprecedented security challenges at the action and data layer, not just promptsThe strategic timing of category definition: MobileIron's cautionary tale of letting Gartner define you as "MDM" when customers bought for securityWhere enterprise buyers actually get advice now that Gartner's influence has diminishedAEO (Answer Engine Optimization) replacing SEO as the primary discovery mechanism for B2B solutionsWhy 1.0 categories have fundamentally unclear ICPs versus 2.0/3.0 products with crisp buyer personasThe "high urgency, low friction" framework for prioritizing what to build in nascent marketsGo-to-market fit: the repeatable growth recipe that unlocks scaling post-PMFUnlearning as competitive advantage for second-time founders GTM Lessons For B2B Founders: Time your category noun definition strategically: MobileIron focused exclusively on solving the problem (the verb) but waited too long to influence category nomenclature. Gartner labeled it "Mobile Device Management" when customer purchase drivers were security-focused, not management. Use customer language as category discovery, not invention: Bob's breakthrough on BlueRock positioning came from asking prospects: "How would you describe what we do to your peers?" One prospect distinguished their focus on "the action side - taking AI and taking action on data and tools" versus prompt inspection and AI firewalls. Engineer for the "high urgency, low friction" intersection: Bob's filtering criteria for BlueRock's roadmap requires both dimensions simultaneously. When a prospect revealed they were building their own MCP security tools - a signal of acute, unmet pain - they also asked BlueRock to add prompt security features. Accept ICP ambiguity as a feature, not bug, of 1.0 markets: In 2.0/3.0 categories, you can target "VP of Detection & Response" with precision. In 1.0 markets like agentic security, Bob finds buyers across three distinct orgs: agentic development teams building secure-by-default systems, product security teams inside engineering (not under the CISO), and traditional security organizations. Shift content strategy from SEO to AEO immediately: Bob identifies the clock speed of marketing change as "breathtaking" - what worked 18 months ago is obsolete. The specific shift: ranking above the fold in Google search is now irrelevant. Treat go-to-market fit as a distinct inflection point: Bob observed a consistent pattern across MobileIron, Box (Aaron Levie), Citrix (Mark Templeton), Palo Alto Networks (Mark McLaughlin), and SendGrid (Sameer Dholakia) - all hit PMF, hired salespeople aggressively, burned cash, and stalled growth while boards grew frustrated. Build community as primary discovery in fragmented buyer markets: Bob's most different GTM motion versus five years ago: "We're just out talking to prospects and customers - individual reach outs, hitting people up on LinkedIn, posting in discussion boards, engaging with the community." Practice systematic unlearning as second-time founder discipline: Bob's most personal insight: "What really got in my way wasn't what I needed to learn. It was what I needed to unlearn."

    31 min
See All (68)

About

GTM conversations with founders building the future of cybersecurity technology.

Information

  • Creator
    Frontlines.io
  • Years Active
    2025 - 2026
  • Episodes
    68
  • Rating
    Clean
  • Copyright
    © Frontlines.io
  • Show Website
    Cybersecurity Builders