Reinventing Vulnerability Management: Zafran's CPO on Finding Real Pain and Building Product in Cyber - Product Builder Podcast episode with Eyal David
00:34:31

Reinventing Vulnerability Management: Zafran's CPO on Finding Real Pain and Building Product in Cyber

Host: · Guest: Snir Havdala · About the host

In this episode

  • The real signal of pain isn't what a customer says but what he does — whether he opens up the company to you and introduces you to his team, and whether in the end he spends money.
  • Don't jump to a solution: understanding the real pain takes time, more than one conversation, and you need to put yourself in the user's shoes and understand their day-to-day before you build.
  • In a startup you sell the vision over and over — to each different stakeholder (architect, risk manager, CISO) you need to tell the same story differently, and then sell it internally into the company too.
  • Zafran's differentiation isn't just identifying the problem but actionability — telling you exactly which patch or firewall configuration change is most worthwhile to make right now, connected to the real risk.
  • Two critical product skills: a feedback loop (staying open to listen and knowing how to go back three steps) and creating internal consensus so the developers understand why each thing is being built.
  • The team's heterogeneity is an advantage — people who don't come from the cyber world bring a different voice of problem-solving; it's enough for them to know the domain's language to become superstars in product.

Listen to this episode

Listen on SpotifyListen on Apple PodcastsWatch on YouTube

Episode Description

Shnir Havdala is a co-founder and CPO at Zafran Security, an Israeli cyber startup (about 90 employees, a Series B round, almost 30 enterprise customers) that is reinventing the world of vulnerability management. In the conversation he explains the pain of organizations that are flooded with millions of vulnerabilities and can't patch in time, and how Zafran adds context (whether the vulnerability runs at runtime, which security controls already protect it) and actionability that lets you reduce risk using the tools the organization already has. Alongside this, Shnir shares product insights: distill the real pain before jumping to a solution, sell the vision again and again to every stakeholder, and build a feedback loop and internal consensus.

Read the full transcript
Full transcript with speakers and timestamps

Selected quotes

“When someone opens their wallet and pays, that's the best conviction; you know that what you built solves a real problem, because otherwise they wouldn't pay.”
— Shnir Havdala
“You really need to put yourself in the shoes of the person you're building the product for, to understand what hurts them, what they do day to day.”
— Shnir Havdala
“To understand what the real pain is — and that takes time, it's not one conversation and not two — and to take that pain and translate it.”
— Shnir Havdala

Questions & answers

What does the name Zafran mean and why was it chosen?

Saffron is an expensive spice, but mainly: in Persian 'zaf' means vulnerability and 'ran' means runtime — exactly the core of what the company does in the cyber world.

What problem does Zafran solve?

Organizations suffer from millions of vulnerabilities and can't patch everything in time, while attackers keep getting faster. Zafran changes the world of vulnerability management end to end by providing context and actionability.

How is Zafran different from other vulnerability-management products?

It adds deep context — whether the vulnerability is actually running at runtime, whether there's a PoC, and which security controls (antivirus, firewall, WAF) already protect it — and translates that into actionability: exactly what is most worthwhile to fix now to reduce risk, usually with the tools already present in the organization.

What does Shnir recommend to product managers who want to enter the cyber world from a different background?

Learn the language, the concepts, and a bit about products — it's important and not a luxury. Someone who brings good product processes and non-mainstream thinking from another world can become a superstar precisely thanks to the different perspective.

How does Shnir identify product sense in interviews?

He listens for whether the person talks in circles or is mission-driven and decisive, dives into examples of how they handled situations and why they chose as they did, and looks mainly for 'fire in the eyes' and determination — something that comes through in the conversation and is even contagious.

Cyber Vulnerability Management Zafran Security Product Management CPO Startup Enterprise Customer pain discovery

Related Episodes