Cybersecurity Builders

How StackHawk repositioned runtime testing as the essential layer when AI-generated code made static analysis unmanageable

Joni Klippert⁠ [https://www.linkedin.com/in/joniklippert/] didn't come from security. She came from DevOps — two companies, including VictorOps, which she joined as the first non-engineering hire and helped bring to market. At conferences like DevOps Days Enterprise, she kept running into the same frustrated security teams: they knew they couldn't keep up with the pace of software delivery, but their only move was to act as a gate. That observation, paired with her co-founder Scott Gerlach's decade of practitioner experience — including CISO at ⁠SendGrid⁠ [https://www.stackhawk.com] through its acquisition by Twilio — became StackHawk: a dynamic application security testing platform that puts runtime vulnerability testing directly into the CI/CD pipeline, built for the engineers writing the code. In this episode, Joni breaks down how she abandoned her original PLG thesis when enterprise came knocking, how AI-accelerated software delivery has created a structural problem for static analysis tools that benefits StackHawk, and why category definition in AppSec is less about analyst quadrants and more about being precise about what you test and how. TOPICS DISCUSSED * Why a DevOps founder built her third company in cybersecurity * The structural ceiling in engineering-led PLG deals — and what it signals about ICP * How StackHawk's first major enterprise logo arrived inbound and changed the GTM thesis * Rotating segment focus when market conditions compress SMB security budgets * Why AI-accelerated code delivery is a tailwind for runtime testing and a headwind for static analysis * Building a bridge product for aspirational enterprise buyers who aren't yet DevOps-native * Category definition when you don't fit cleanly into AppSec or API security * Working with analysts on emerging categories like DAST in the age of AI * The organizational misalignment between engineering velocity goals and AppSec team operating models // Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ [http://www.frontlines.io] The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ [http://www.globaltalent.co] // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM⁠ [https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM]

AI vs. AI: why Quantro Security is building defense for the era of AI-native offense

Mehul⁠ [https://www.linkedin.com/in/mehul-revankar/] spent over 20 years building cybersecurity products, including early time at Tenable where he watched the company scale from a scrappy startup to a billion-dollar platform. Now he's co-founding ⁠Quantro Security⁠ [https://quantro.security/], which just came out of stealth with an AI agent platform built specifically for cyber defense. The core thesis: AI has reduced the cost of building attacks to near zero, and static rules-based defense tools weren't built for what's coming. Topics Discussed: * How AI reduced the cost of exploit development and what that means for defenders * Why Quantro Security rejects CTEM, risk-based VM, and every existing category * The "user interface of record" positioning vs. the "system of record" frame most AI companies chase * Three competitive buckets: hyperscalers, siloed point tools, and internal build teams * Why agents should be prompting humans, not the other way around * The vision for a small elite security team managing 50 to 100 purpose-built AI agents Key Insights: * AI-native offense requires AI-native defense. Mehul's core thesis isn't speculative — it's built on what he watched happen to his own craft. Writing vulnerability exploits once required deep skill and months of work. AI collapsed that barrier. "So now an attacker can essentially build a functional exploit with just a prompt." The implication for defenders is direct: the tools built for the old pace won't be sufficient for the new one. * Rejecting every existing category. When Quantro came out of stealth, the obvious move was to slot into CTEM or risk-based vulnerability management. Mehul passed. "Are you a CTEM player? Are you a risk-based VM player? Are you VM player? Well, no, no, no, none of that." The existing categories imply replacing tools. Quantro's frame is different: become the connective layer on top of what customers already have. * User interface of record, not system of record. Most AI companies pitch replacing core platforms. Quantro's pitch is the opposite: "We don't replace the tools. We just make their existing tools much more, much more effective." Enterprises aren't ripping out entrenched infrastructure. They want ROI from what they've already bought. * The barbell competitive map. Mehul frames the landscape as a barbell: hyperscalers ("a mile wide, a millimeter deep") on one end, siloed point tools (deep in their own data, blind to organizational context) on the other. Quantro positions as the connective tissue between them. * The 50% false positive tax. When Mehul talks to security prospects, the same reality surfaces: "Almost 50 % of the time is triaging false positives, reaching out to the people." Asset ownership is unclear. Handoffs break down. None of it moves the risk needle. The agents absorb that work. // Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ [http://www.frontlines.io] The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ [http://www.globaltalent.co] // Topics Discussed:GTM Lessons For B2B Founders:Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM [https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM]

How Heka Global positioned web intelligence as a fourth fraud detection layer to avoid vendor comparison | Idan Bar-Dov

Identity fraud spiked 148% in 2025 as AI democratized identity fabrication. Financial institutions now face a fundamental question: Are you dealing with a real human? Heka Global is addressing this with web intelligence—analyzing digital footprints like connected applications rather than traditional signals. In this episode of BUILDERS, I sat down with Idan Bar-Dov⁠ [https://www.linkedin.com/in/idan-bar-dov/], Co-Founder & CEO of ⁠Heka Global⁠ [https://www.hekaglobal.com/], to explore how his company created a fourth layer in the anti-fraud stack and why legacy identity verification systems are becoming liabilities rather than assets. Topics Discussed:  * The emergence of "fraud as a service" and why consumer-facing attacks replaced traditional enterprise breaches  * How web intelligence works: validating identity through connected applications and digital footprints  * The anti-fraud tech stack: credit bureaus, biometrics, transaction analytics, and web intelligence as distinct layers  * Why heads of fraud expand budgets rather than replace vendors, and what causes solutions to get kicked out  * The partnership sales model: navigating vendor management complexity and red tape in financial institutions  * Why 10-person dinners and fraud simulations outperform traditional enterprise marketing  * How Barclays and Cornerback backing solved the chicken-and-egg problem for a data product  * Why specific fraud prevention messaging (account takeover, synthetic identities) beat investor credibility GTM Lessons For B2B Founders: * Target ICP based on liability exposure, not just industry fit: Heka narrowed beyond "financial institutions" to lenders who bear immediate losses from fraud—companies like LendingPoint, Avant, and Upstart. These buyers feel the pain acutely versus institutions with reimbursement terms who can deflect liability. Idan's insight: "We need the client to feel the pain just as much as we see it. That means we want them to see the liability." * Frame your product as a new stack layer, not a competitive replacement: Heka positioned web intelligence as the fourth distinct layer after credit bureaus, biometrics, and transaction analytics. This became their second pitch deck slide, showing logos of each category. The result: buyers stopped comparing Heka to existing vendors and started evaluating complementary value. * Abandon spray-and-pray for sub-1,000 TAM markets: Heka tested Lemlist flows with targeted LLM personalization and saw zero pipeline from it. Idan's take: "When you're selling to maybe a thousand financial institutions, that's it. You can be super specific when you target them." For enterprise plays with small addressable markets, allocate zero budget to automated outbound. Focus entirely on warm introductions, relationship nurturing, and becoming known to every relevant buyer through content and community. * Leverage investor networks to break data product cold-starts: Data products face a critical barrier—you need customer data to prove value, but need proven value to get customers. Heka solved this by bringing on Barclays and Cornerback as investors who vouched for the team's capability to "do magic and create a new layer." Their backing convinced risk-averse financial institutions to pilot. //  Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ [http://www.frontlines.io] The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ [http://www.globaltalent.co] // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM [https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM]

Why Portnox's CEO refuses to measure Net Promoter Score | Denny LeCompte

Portnox⁠ [http://www.portnox.com/] is an enterprise access control platform that eliminates passwords and enforces zero trust security. The company was bootstrapped for over a decade, plateauing at a few million in ARR before investors brought in ⁠Denny LeCompte⁠ [https://www.linkedin.com/in/dennylecompte/] as CEO four years ago. Since then, Portnox has grown 8x. But this episode isn't about that growth story. Denny, a former cognitive scientist and professor who taught psychometrics, uses his scientific background to systematically dismantle Net Promoter Score—explaining why it's methodologically flawed, how it misleads organizations, and which metrics actually correlate with business performance. This is a contrarian take grounded in measurement science, not marketing opinion. Topics Discussed: * The fundamental psychometric flaws in NPS: why single-item questionnaires are unreliable and why throwing out 7s and 8s violates basic statistical principles * How NPS scores fluctuate based on survey UI presentation independent of actual customer sentiment * Why NPS creates incentive structures that encourage gaming rather than improving customer outcomes * The case for gross revenue retention and net revenue retention as the only ungameable metrics that matter * How measuring human behavior changes that behavior (the Heisenberg principle applied to business metrics) * Why investors care about retention rates above 90% but don't ask about NPS scores GTM Lessons For B2B Founders: * Single-item questionnaires violate measurement principles: Denny's background in psychometrics immediately flagged NPS as unreliable. One-item measures lack the redundancy needed for reliability, and the methodology of throwing out middle responses (7s and 8s) then subtracting detractors from promoters is statistically nonsensical. At a previous company with thousands of data points, he observed NPS scores drop and rise based solely on how the survey rendered on the page—no business changes, just UI differences. * Compensation drives behavior more than metric accuracy: Portnox structures customer success compensation as 50% gross revenue retention and 50% net revenue retention. These are determined by finance and can't be manipulated. Denny had to rein in his CS team when they became overly focused on time-to-value because any number you give a team becomes their obsession. With NPS, teams game survey timing, cherry-pick recipients, and optimize for score rather than outcome. * Investors evaluate retention rates, not satisfaction surveys: When Denny presents gross retention above 90%, investors don't ask about NPS. Renewal behavior reveals actual satisfaction—customers voting with budget rather than survey responses. The test for any metric: "What are we doing differently if this number is up versus down?" If it doesn't drive distinct actions or reveal information not already visible in financials, eliminate it. * Question inherited practices ruthlessly: NPS gained adoption through Harvard Business Review credibility in 2003 and consulting firms building practices around it. The promise of "one number you need" appeals to executives wanting simple solutions. But herd behavior—"everyone else measures it"—perpetuates bad methodology. Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ [http://www.frontlines.io] The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ [http://www.globaltalent.co] // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here:⁠ https://open.spotify.com/show/53yCHlPLSMFimtv0riPyM [https://open.spotify.com/show/53yCHlPLSMFimtv0riPyM]

Joe Levy, CEO of Sophos: $1.5 Billion ARR and the Future of Cybersecurity at Scale

Sophos⁠ [https://www.sophos.com/en-us] represents one of cybersecurity's most vulnerable companies, founded in 1985 as an antivirus provider and now operating at massive scale with $1.5 billion in ARR and 5,700 global employees. Under CEO Joe Levy's leadership, the company has undergone a fundamental transformation from a traditional product-focused vendor to a services-driven platform that addresses core market failures in cybersecurity. In a recent episode of Category Visionaries, we sat down with ⁠Joe Levy⁠ [https://www.linkedin.com/in/joe-sophos/] to learn about the company's pivot to managed detection and response (MDR) services, their $860 million SecureWorks acquisition, and their vision for democratizing cybersecurity strategy across millions of organizations worldwide. Topics Discussed:  * Sophos's evolution from antivirus origins through multiple business model reinventions over four decades  * The strategic pivot to managed detection and response (MDR) services starting in 2018-2019 Building organizational support for major business model changes through experimental frameworks  * Managing channel partner relationships during service transformation with 25,000 global partners  * The $860 million SecureWorks acquisition and integration strategy to achieve category leadership  * Scale as a competitive advantage in cybersecurity platform operations  * The future vision of democratizing cybersecurity through "virtual CISO" services at massive scale GTM Lessons For B2B Founders: * Address systemic market failures through business model innovation: Joe identified that cybersecurity's core problem wasn't technology quality but post-sale execution. "As an industry we have been really good at buying and selling products, but we've never been good. In fact, we've been terrible at their implementation and their lifecycle management." This insight led to Sophos's services transformation. * Structure major strategic pivots as controlled experiments: When proposing the MDR services pivot, Joe framed it as a measurable experiment rather than a leap of faith. "The conversation primarily consisted of, I want to run an experiment. * Invest heavily in stakeholder alignment during business model transitions: The most challenging aspect wasn't technical but maintaining relationships with 25,000 channel partners who might view new services as competitive threats. * Shift sales focus from product features to guaranteed outcomes: Sophos had to retrain their sales organization for services selling. "The fundamental difference between selling a product and selling a service is... what the expectations of the outcome that service is going to provide for them." * Use strategic M&A to achieve immediate category leadership: Rather than relying solely on organic growth, Sophos accelerated their MDR strategy through the $860 million SecureWorks acquisition. "It technically makes us the largest MDR operator, pure play cybersecurity MDR operator... on the planet today." * Build scale as a defensible competitive advantage: Joe argues that scale is "an often overlooked but a critically important element when it comes to the selection of information technology vendors." In platform businesses handling massive data volumes and real-time operations, the ability to operate at scale becomes a key differentiator.   //  Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership.⁠ www.FrontLines.io⁠ [http://www.frontlines.io] The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe.⁠ www.GlobalTalent.co⁠ [http://www.globaltalent.co] // Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role.  Subscribe here:⁠ https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM [https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM]