77 months in: What I learned starting a cybersecurity company.

Author: Rob Black

We were growing fast.

It seemed like it would go on forever.

Business doesn’t work that way.

What made sense to us 18 months ago did not work in practice when we doubled in revenue.

I have learned a lot of things in the school of hard knocks that they did not teach me in business school.

Hiring in advance of a growing business works great. You have the people as your revenue can support them and your customers need them.

Hiring in advance when you are missing your revenue plan does NOT work though!

(Okay, they did teach me that part in business school. It is all of the other stuff that I needed to learn.)

The fundamental problem was that we had an unrealistic revenue plan. It turns out that a straight line revenue projection with rosy assumptions was not a good idea.

The end result was that we had to let some team members go in June.

It was painful for them and us. I vowed to be much better so that I would not have to do that again.

We are now at a perfect team size that can support our business needs.

What did I learn?

Transitioning from founder led sales is hard.

If the header above didn’t clue you in then I will say it here.

Transitioning from founder led sales is hard.

We hired a sales person at the end of last year and he had immediate success.

That was exciting so I focused my attention on other parts of the business.

Oops.

While we were still closing deals and probably some deals that I would have whiffed on because they required too much follow up, we probably lost some deals because I wasn’t appropriately involved.

Also, I had not systematized the sales process.

Beforehand, it was someone I know or was one step away from us, would contact me and I would talk to them, maybe send a follow up email or two and BOOM, they were a client.

It turns out that is not a great way to run a business.

We (Blane mainly) had been doing an amazing job of getting lots of marketing generated leads. We cleverly let many of them drop to the figurative floor.

We didn’t have a great follow up process for prospects who were interested but needed more attention and sales support to select us.

Since June, we have had a radical transformation of our entire sales process.

We are embodying the sales culture across the organization.

Meghan, in addition to her other duties, handles all inbound leads. She takes the first call with the prospect, plans additional calls with the right team member (me or Brad), and does follow up. It has been amazing how much more efficient we are now with sales leads.

Lucy has done an amazing job of defining our sales processes and helping to smooth out some of the wrinkles.

Brad, as mentioned, now takes follow up calls and sometimes decides to involve me.

Leveraging the team has allowed me to much more effectively use my time while still being able to swoop in to speak to a prospective customer. I get involved at the right moment to make the biggest impact on the process.

It is a team approach to sales that has been working great, efficiently connecting with prospects and scalably working.

Improving your SOW creation process yields large returns.

The Statement of Work (SOW) has been one of the biggest challenges for me throughout Fractional CISO’s history. I have spent hundreds of hours both on the template and editing the many client versions.

We have a version now that is pretty good. We continually make tweaks but it is largely the same it has been for a year or so.

When I walk through it with prospects now, I generally get, “the SOW lines up with what you told us on the last call.”

It was NOT easy getting to that spot.

Until recently, I had a lot of challenges customizing our SOW. But I addressed 80% with automation. See the full story here: https://fractionalciso.com/you-can-automate-more-than-you-think/

Sometimes, a bigger team isn’t more effective.

People get pretty excited when you tell them the number of employees in a company.

In general, it should correspond to how much revenue you are taking in.

Team size, however, does not indicate if you could be MORE successful with fewer people getting the same amount of work done at the same quality level.

Do you know the good part of running a company with fewer employees? Less management headache and possibly higher margin!

After our reduction this year, I have been looking to be more and more efficient with our existing team to be able to best service our clients.

That takes us to…

Artificial Intelligence (AI) will be a game changer.

AI has super obvious applications for security and compliance. We are experimenting with using AI to assist us with some of the activities we do every day:

Cyber insurance evaluation
Vendor assessments
Procedure writing

We have a ton of ideas.

One of the things that is holding us back, is that we are concerned about our client data ending up as training data for a public LLM.

We are experimenting using AWS Bedrock which allows us to control the model. The data is never fed back to the AI model company. We control it. Additionally, we are considering running ephemeral models – giving them the prompts and training data each time and then tearing down the instance.

We don’t know if our process will be effective but we owe it to our clients to find a solution that will help us deliver our services without jeopardizing their data.

Also, if we were to find a good solution, we would share the results enabling our clients to best protect their customers.

If you are not experimenting with AI, you should be. No matter your use case.

Reflection is important.

This is my sixth in a long-running series of articles where I reflect on lessons I’ve learned starting and running Fractional CISO. I like to write these every once in a while to synthesize my latest thoughts on the business.

I love looking back at these articles. They show where we were at a given place in time.

Check out the rest!

Want to get great cybersecurity content delivered to your inbox? Click here to sign up for our monthly newsletter, Tales from the Click.

Rob Black, CISSP

Rob founded Fractional CISO in 2017 and has helped dozens of companies improve their security posture as a vCISO. He consults, speaks, and writes on IoT and security. Rob has held product security and corporate security leadership positions at PTC ThingWorx, Axeda and RSA Security. He received his MBA from the Kellogg School of Management and holds two Bachelor of Science degrees from Washington University in St. Louis in Computer Science and System Science and Engineering. He is also a Certified Information Systems Security Professional (CISSP).