Transcript: Reinventing Vulnerability Management: Zafran's CPO on Finding Real Pain and Building Product in Cyber

Eyal David: [00:00] Hi, this is Eyal. Welcome to Product Builder, the place for the most interesting product conversations. I'm the owner of Userflowzz, and among other things the host of this podcast, and my goal here is for us to improve our product skills together. If this is your first time here, I hope you enjoy it. And if you've already listened and gotten value, I'd really love it if you'd share the podcast with a friend. So come on, let's begin! Hi Shnir, how's it going? Hello, all good. Yes, with us is Shnir Havdala, who is a co-founder and CPO at Zafran Security. Right. Do you want to explain in a word what Zafran is, what the company's name is about? Sure.

Snir Havdala: [00:43] So all... beyond it being an expensive spice — there are customers who think we're a spice shop, so before you tell us that, it was... No, no, we're actually a cyber security product. So yes, we founded the company — me, Snaz and Ben, and Snaz is actually our CEO; she really has a very impressive story — she immigrated from Iran, and she influences the company's culture a lot, and I can tell you that 'zaf' in Persian means vulnerability, and 'ran' is runtime — you know, to be a cool cyber guy. So it's both an expensive spice, and also somewhat related to what... A lot related to what we do. Awesome, and actually my next question — so what does the company do? So basically Zafran comes to tackle the pain that today, organizations have tons and tons and tons of vulnerabilities, really millions, tens of millions, this pool keeps growing, and basically they can't patch everything in time — they simply can't. Go to a standard organization, that just can't keep up the pace, and attackers are getting faster in the end, right? Exploiting a vulnerability used to take months, and today it's a matter of days, and even less. So basically Zafran comes to take the world of vulnerability management and change it end to end, a field that isn't new — it's been around for a few years — but I think there's a great opportunity here for us,

Eyal David: [02:14] both to help our customers and for us as a company to innovate in this world. Cool, okay, so what's the company's status right now?

Snir Havdala: [02:22] We're about 90 people, a site in Israel, here in Tel Aviv, a site in the US that keeps growing, and a Series B — we've actually already succeeded with almost 30 customers, and we keep growing there, and I think you should know, beyond us building our product, our customers are mainly large enterprise customers, Fortune 500, Fortune 100, in the US; we have an Israeli customer base, but really most of the market is in the US, where we really manage to address their pains,

Eyal David: [03:00] and their needs there. Okay, alright, tell me, are you hiring right now? Yes, yes, definitely.

Snir Havdala: [03:06] What are you looking for? We're looking for developers, product in the US; hiring in the US is supposed to double itself,

Eyal David: [03:14] this coming year, whether it's sales, whether it's marketing — totally, we're hiring on all fronts. So tell us a bit about yourself, actually about the problem, or a bit about how you got to this position.

Snir Havdala: [03:23] Yes, so in the end, like, I started the... in the Talpiot program of the Air Force, there, actually, at the Hebrew University, I was there for three years studying physics and computer science, so really in a very very technical way, I actually come from a very technical background in general; I was in 8200 for about 10 years, and started at the rank of Major, really a variety of roles — I was a researcher, a developer — so that's how I arrive at the world of product, I come from a very very technical background, and... this transition was relatively natural for me, because in my last role in 8200 I was a section head, I was actually a product person, like, in the end, right — understanding the requirements, translating them into... execution, a queue of problems, and managing to do it while rallying everyone around me — above me, below me, beside me, and that's a lot of what product does, and basically when you go out to civilian life like that, after ten years, in the army, then you... who am I, what am I, right? And like... I think the role as product was very very natural for me, and it also really interested me to connect to the business world, to be a bit closer to sales, and I think product is a good balance between two days where you think about how to solve some technological problem, and two days where you're in front of the customer in the US doing a roadshow of... trying to sell the...

Eyal David: [04:59] something we built, so right now I'm enjoying the variety. That's exactly — just, you describe the problem, and that's exactly the difference, actually, between the army and what you do today, right? Is that something you always had, this business side, or did you actually add it over time — how was it? I think it grew over time,

Snir Havdala: [05:16] I think it's also... I think in the end it's the desire, you know, to see impact — in the end not to develop for the drawer, not to research for the drawer, but to see impact with what you do, a customer buys a product — that's the best signal that they're interested in it.

Eyal David: [05:36] So maybe tell us a bit about what you do and where it also touches the business side, because I'm sure it's not only in sales, right? Yes, so today the CPO is really a new thing,

Snir Havdala: [05:48] so as I said, I very much see my role as connected to the business side, because you know, in our world there are tons of advice-givers, and people who give you reviews of one kind or another, but as I said, when someone opens their wallet and pays, that's the best conviction; you know that what you built solves a real problem, because otherwise they wouldn't pay. So beyond that part, I think the desire, the ability to truly understand pain, and not to jump straight to a solution — to understand what the real pain is, and that takes time, and it's not one conversation and not... two conversations, and to take that pain and translate it, to understand that it's a pain that can be solved — because turning copper into gold hasn't succeeded yet, and once you understand and find the pain, then how do you build the relevant product and how do you build the relevant process, because there are tons of products that were built where the process surrounding them isn't relevant at all, and therefore they don't answer the need, so you really need to put yourself in the shoes of the person you're building the product for, to understand what hurts them, what they do day to day, and only when you understand the pain, the mini persona, the... all the things around it, I think you can talk about solutions and about how to approach building the product.

Eyal David: [07:15] That's it — you talked about someone who pays; I think someone who innovates is even stronger. So tell us — I assume you also interviewed a lot of people until you reached this holy grail where you started to actually understand what the problem is, tell us how it actually looks, how this stage looks where you distill over a period, and say, okay, this is the core pain.

Snir Havdala: [07:37] So first of all, this is a question that I think a lot of entrepreneurs and a lot of startups deal with, I think one of the important things is to know what to ask and how to ask, because many times, you know, especially depending on who you're talking to — Israelis are also different from Americans. Enterprise is a whole other thing, right. Enterprise is completely different. I think one objective thing that helped us understand was to ask, 'tell me, can I meet your team to talk about this?' And when you talk with a person and they're willing to open up for you... the house and introduce you to more people, then I think that's a good signal for, okay, so he's also selling us within his own company. So that was always — and when we got a no, we said, okay, so maybe it doesn't really hurt him. And everyone who said yes, 'come talk about it with my team lead' or 'come talk about it with someone in my company,' I think that was a really really good signal to distill that it genuinely hurts him.

Eyal David: [08:41] So you got — finding a champion is really the thing, and you have to run with it. Yes. And how does a partnership look — what kind of partnership, but it's not really a partnership, he has some problem, you arrive via some cold email, I'm just saying, some cold reach-out, or someone who connected you, and not necessarily you being the person he most wants to talk to right now. From that moment he introduces you to his friends, to his employees, and you keep him in the process and update him — you're distilling not just the problem, like, validating it — how does that look?

Snir Havdala: [09:11] So first of all, one of the things startup companies — co-founders — deal with many times is that they constantly need to sell, over and over again. You meet with a certain stakeholder, you tell him about the problem, tell him your path to solving this problem, and then he introduces you to the team, and it's again from scratch, again from scratch. And then the bigger the organization — and Zafran works with large organizations — sometimes he does it several times in front of several people. Say, right now I'm talking to the architect, so for a moment it's a different vibe. A much more focused vibe — on the technological side and on the deployment of the product. And then when I'm now talking with some risk manager in the organization, that conversation needs to be completely different; a CISO level is different. That is, you need to prepare yourself for many many mini — who's coming to the conversation now, hold on, who am I talking to — and also to manage to know how to tell the version of that same story, right. So constantly selling, selling anew, and remembering, hold on. And to be very determined around talking about the problem and not about the solution. And after that you also need to pour it inward into your company — why this is the most meaningful thing to do right now, right — what's easier, before we move on. So in the end, when you're at the company's size — the bigger the company gets — it already does things, there are already pillars of activity, okay this is what we do, and to open more business lines, more ideas, is much harder, because hold on. A certain path, and as a story — now, to come and say, hold on, we need to do something else now, or in addition — I think that's a statement that needs to be treated with great reverence. So that's something we think about not doing. And totally there are product people in general who are always busy, and to create some consensus and actually to work — right now this is what I heard, this is what I believe in, this is what I think is the right way to solve it. And to be very determined about this thing, and to manage to sell it both internally and externally. Here, maybe, a lack of awareness of the environment is good. You need to run with the flag, and there's a risk here, so in my opinion it's actually harder to come back with the thing and start to deliver it, to communicate it inward, and to say to the two additional partners, this is the thing — if they think that way less.

Eyal David: [11:37] I assume for you it happened less, because you were less afraid of it. So maybe really describe a bit how your day-to-day looks, so we understand a bit more also how...

Snir Havdala: [11:46] this activity looks — competitors, like, totally. So in the end it varies a lot; in the end, also, like, for two co-founders — one of the co-founders and the other of the CFO... but they're very very very close. So whether it's representing the company everywhere I go, whether it's even on this podcast, and whether it's trips to the US, evening events, conferences, meetings with the American site, trips to Europe, and also within Israel. Basically being the all-arounder of the company, who also really knows the product and knows how to tell about the present, the past, and the future. Cool. So, like me — so what does the company do, what's the solution? So today we deal with the problem that there are tons and tons and tons of vulnerabilities, tons of weaknesses, and tons and tons and tons of assets — we're talking about millions — and basically they can't patch in time. Tell me, what if I'm now a hospital, for example — how does that look? So imagine you have tons of systems, tons of — let's think — tons of machines, right, that have vulnerabilities in them and need to get an update, and now go figure out what's the most important thing to install and where it's most important to install it, and we're talking about thousands. And such an update takes you down, right, takes down the organization, you need to do a restart, and it's not always possible — you know, things work 24/7 — and what Zafran does, it does two significant things: one, it gives more context around this problem. We say: do these vulnerabilities have a patch available on them now, are they in runtime, meaning are they really running and not just on disk — with an application actually running. We give visibility, as the only company doing this in the market today, into the security controls you have in the organization. Antiviruses, firewalls, and application firewalls, and how much they affect the risk — of course tons and tons of context so you'll know what to focus on. And beyond that, we're also very very strong. Actionability. Zafran — I think what distinguishes it is not only telling you what the problem is (there are tons of products that do that), it's also telling you, okay, this you need to do now, this is the most worthwhile patch for you to make, this is the firewall configuration change that's most worthwhile to make — basically connecting the actionability to the risk. And I think that's why customers really really love us, because we're very very strong in actionability, and also internally, to make sure we're in line with what we planned. What happens and gets entrenched — and more than that, I think also creating... in the end, you know, developers in the country are far from sales in the United States, and the ability to connect between what you hear and what you see, and the sales body to the development body — and to connect in reverse, too, because sometimes there are really pains that R&D has and you need to know how to represent them in this story. So that's also something that happens — meaning the backbone between R&D and sales many times goes through product. How does it really look at your place — do developers get on sales calls, or is that you, everything? I think at our place it very much depends; we see people who really want to be in contact with the customers and the... new prospects, and it's a matter of choice. I say this in this regard because it sounds like you're in a place where you really want to delegate, because it sounds like you do a ton of things during your day, so basically you're really organized, so...

Eyal David: [15:13] okay, let's go back for a moment to the pain, because you touched on it and didn't touch on it, and I want to dig into it for a moment — with today's technology, with today's situation in the world, where do you see that for vulnerabilities this isn't going... like, how much is this going to intensify?

Snir Havdala: [15:27] I think already today we're in a situation where someone trying to solve this problem with the existing tools simply won't succeed — and it'll be even worse — so they'll feel it, yes, because... once, if it required real power to exploit some vulnerability — today, really, people pass it to one another, and it... like, someone in boxers in a warehouse — so you see the attackers managing to do this much faster, and also, in the end, the defenders have so much: they have on-prem, proof environments, data centers that they manage to install, there's the cloud, there's the whole topic of... application security in general — that's a different operation than classic infrastructure. So I think... it's becoming much, much, much more — vulnerabilities become faster, much harder to install on, right — not to mention products of... OT, they call it, but basically it means — I don't know — medical devices, things you really can't install on, like, it really becomes very very problematic, and you know, attackers don't care in this regard. Zafran brings, basically, the ability — there really is one — to use your firewall, your antivirus, your WAFs to really manage to reduce the risk in a really significant way. And does a situation happen where, say, they arrive at a customer and there aren't enough tools, and you need to get him to add a tool — like, do you also actually do... selling of additional tools — how does that look? Yes, so that's a good question — it comes to us from customers, meaning, what if I had, what if I replaced... this tool with this tool. I think Zafran, beyond — again, we're in vulnerability management, we're on the whole scale, meaning we also have the places where, say, here you need to patch, but notice the discourse — the discourse is completely different in nature, and it says, we hear this thing, I have no — I have no defense at all for the story, like, in that area I have a firewall, I have CrowdStrike, I have an EDR of some kind, an antivirus of some kind — here there's a point... Vulnerability management, which in a certain sense is a technical product manager, right — what does he do, he sees a vulnerability in some tool and then says, okay, this is critical, and then he sends — opens a ticket for it — someone needs to install, and then they tell him no, it can't be installed because of this and this and that, and then the discourse is like a discourse of procedure. And Zafran comes and basically gives these people so much context — we say, listen, this is a vulnerability that is in runtime, it has a PoC, there are no mitigating controls, nothing, you're simply exposed and you can see it from the internet — this is really a case to come to that person and say, if you don't fix this, it's truly a crime. Yes, so it's not only, you know, enablement of things — it's also telling a story and making people feel confident in how they see reality. Because that's what you cracked in those conversations — or that you cracked — I think you're a kind of secret weapon of these people. Totally. I think in the end, the more you're in the organization — security, and many times IT is the one that actually... it's really hard that you're in the security organization responsible for the company's security, and whoever's supposed to install the things is the IT body. Now, you know, they have other problems, justifiably, and by the way the world is advancing — sometimes it's also developers in general, and there too, security tells the developer, please stop what you're doing and update this thing. And here the case is important, here the case is important, the context is important, and Zafran brings context, I think at the highest level in the market today — both in terms of exploitability, and in terms of... and also in terms of mitigation control — it's a whole layer, we really go into configurations and we really see where you're protected and where not.

Eyal David: [19:38] And tell me, what's actually the metric that leads the company? It's clear to me, clear to me, the business metric — but how do you know at the feature level that you succeeded?

Snir Havdala: [19:46] Excellent question. I think in the end — I'll split it for now, a bit — so there are things that split roughly into two: there are things that every company, every cyber security product, needs to have — filters and, you know, user management, things like that — and this is something super important, because in these small things you manage to create a real experience that can stand on its own in the end; it's the usability. And we're very invested in this thing, in order to create a great experience even in things that were supposedly meant to be in every cyber security product — that's one thing. The second thing is really the features of Zafran that work, that we bring around this thing. I can tell you that beyond discovery, we have beta programs where, before we release something, we show it to a subset — a sample — of the customers, and we check, hold on, is this interesting, a bit of feedback, we manage to fix things during the beta program — it also makes people more engaged; when you tell him 'you're in my beta,' he's suddenly saying, okay, so I was chosen here for some mission. So that's one thing; the second thing. Our fund — fortunately for us, an amazing body that helps very very much with hearing and listening, in passing on the feedback — and part of the product work is an endless feedback loop in order... basically to make sure we're on track. With the UX, you know, in the end — I think at Zafran this is one of the compliments we get a lot about our product; all the enterprise companies that put us to the test — but...

Eyal David: [21:34] but yes, I think it's important in the experience. Cool. I want you to take me for a moment to talk about product people in general.

Snir Havdala: [21:42] First of all, what do you think are the most important product skills? A product person — two jump to my head: one is a feedback loop, constantly being in a state where you're open and hear feedback, because many times the moment you're a product person, you know, the power is with you, you can decide one thing or another and design, and many times it's a bit — the moment you've progressed from something, it's already a lot of hassle sometimes. I think the strengths — it's to be attentive and open, and to know how to go back three steps if needed, and to listen, and to keep your conviction about what we're doing both after the release and before the release of that feature — so to be in listening mode. And many times it's hard, it's hard particularly for technological people who come from a world of doing it themselves, and so you need even more... I say this to myself right now — even more to make the effort and to stop and, for a moment, to listen and be some kind of feedback loop. So I think that's one thing. And you need to create a culture of feedback, because especially if you want the business to campaign — then, hold on, one thing. And the second thing, I think, is to create consensus, because in the end I think the best delivery will be when the developers simply know what you — know the next version, what it's going to do, like, that it'll be clear why we do the things, that it'll be clear why this solution is right, that everything will be — you many times help by bringing a bit like 'here, look what a customer said now and why he needs this,' and I brought him onto a call and showed him the mockup and he said 'wow, this is exactly' — it really helps to connect. And you really manage to create consensus about why this is important, and my feeling is, when we had features that we really managed to, like, the whole company... like it was ours — a third of what it would be in many other places — and I think it's very important to create...

Eyal David: [23:54] this thing. It's good that you described a lot of what you want to be — maybe here you aspire — so okay, whoever wants to join Zafran needs to meet these things. And basically the second challenge I thought of is where you... After all, you're looking, I assume, for people with a cyber/military background. Is that something very hard to get today? We really aren't looking for those people — wow — we're also looking for them,

Snir Havdala: [24:16] but not only. I think Zafran really — we have a collection of people, whether it's someone who just got out of the army, people who were already many years in corporate, a few years in startups — we really have a mix, and that, by the way, is part of what creates culture: everyone brings the things they liked or didn't like from the places they worked at. But I think, look, I... there's something in the heterogeneity that in my eyes is amazing, because it allows that there's no one absolute truth, and not everyone grew up in the same kindergarten, the same neighborhood, and the same city — and precisely people who came not from the cyber security worlds, not from the cyber worlds, from Unit 8200, I think you see — the listener — a different voice of problem-solving, a different voice of understanding the user. And many times, precisely when you come from a background — again, I'm talking about myself — coming from a technological background, it's very significant — you're the manager and sure there's some solution, and sometimes that's not a good thing. So precisely, I think, product people who want to enter the cyber world — it's important to know the language — like, in the end it is important, and again, in my eyes it's not rocket science, but once you... know the language, know the concepts, know a bit of products — I think precisely the ability of someone who doesn't come from the field to come and be a superstar, because he knows product processes, because he knows how to build good products, because he brings thinking that's not mainstream — I think that's priceless.

Eyal David: [26:03] I'm very glad you said that. I'm really curious whether in the industry in general they give such an opportunity — it's funny, but I'm curious whether in cyber they give an opportunity like... in gaming, to someone who has experience from other worlds — it seems to me much harder. So how do you suggest bridging that? So look, I don't know about other companies, I can tell you that we...

Snir Havdala: [26:24] yes, experience is very important to us, but you know, we are open, and again, the world of concepts I said is important — I don't think it's a luxury, but totally...

Eyal David: [26:41] Actually, Eden from Wiz was here. In her first role she came to Wiz, so maybe it's worth listening to that — she gave great tips there about what she did; she simply locked herself in an apartment until she learned the concepts, yes yes yes, so that's worth it. Good, tell me, and what challenges do you actually deal with?

Snir Havdala: [27:00] You described a few — so I think that in the end, there's a site here in Israel that, as co-founder, I'm part of running, and in the end, you know, there are dozens of employees here, and first of all, to be attentive and beyond the department I manage — so, to build culture, to build a cross-Atlantic culture, that's also hard; there's a site in the US and also a few countries, so how do we grow with the company, and how do people who... it's amazing, because it all changes — people who arrived two years ago, suddenly today we're a slightly different company. So all of the company's growth — the site, and growing together with it, and being part of the culture and the vibe, and building it — I think that's a challenge at every stage. And I think the additional thing is actually the company's vision — where we're going in the end. Zafran, we're at... almost 30 customers, and how do we bring it to four thousand, what do we need to do for that to happen, in all respects — starting from the positioning to how we look in marketing, to the building of the product — so basically the scale that we're going through as a company, from selling to a limited number of customers to starting now, you know, to work with people who, at Zafran's seniority, who aren't me and Snaz — and that, too, is a huge thing, like, in the end founders know how to sell the product, but you know we can't be everywhere all the time, so to replicate yourself, I'll put it that way, okay?

Eyal David: [28:48] Wow, great challenges. I think it's probably also rooted — in order to reach four thousand, five thousand customers, it's really... to understand, also now, where this world is going. So I touched with you a bit on where the future is going, but it's quite a challenge from your perspective, even where my role, of security, will be in five years, right? It's quite a challenge. Do you have today, basically, some need to both satisfy the existing customers and also to want to win the new PoCs that come in, versus new initiatives — as you say, I need to look ahead to where this thing is going and where this industry is going, how do you look at it, really, with the business perspective all the time, between what's worth doing, what to defer...

Snir Havdala: [29:29] basically to the future? Is that a challenge at all? Hmm — totally. Zafran today is in a situation where there are already customers, and enterprise customers — if, again, we love our customers and want them to be happy, and their requirements — and on the other hand there's what we want to build and what new prospects want. So I think that's really the challenge, one of our biggest challenges — how do you manage to balance between all of this. And I think a good product team is a product team that will know how to say no when needed, and nevertheless to tell a story about how you manage to retain customers, how you manage to win the deal, and that's a big challenge. Look, obviously when a company grows, retaining customers and getting new business is really one of the most important things, and if there are all kinds of desires or impulses of innovation, then usually that's the reality — we live our world, because in the end we can't; the price of a customer... a huge enterprise — it's very hard, we don't want to pay the prices, it's not fun.

Eyal David: [30:53] Exactly. How do you really recommend to young product managers to start getting this understanding — I can prioritize all kinds of things, but I really go with what... Okay, I'll let you — I even ask you about this in interviews — how do you know how to discern whether a product manager

Snir Havdala: [31:12] has this sense of understanding what's worth doing? So yes, in the end, when you talk with a person in a conversation, I think — and everyone who comes to an interview at Zafran for product, I meet him — from the conversation you already understand whether we're going around in circles or whether we're mission-driven, decisive, so you hear it, you hear it when a person talks, I think I many times manage to — meaning how much it's roundabout and how much it's very purposeful; naturally we dive into examples, how did you handle this situation, why did you make the choice you made — but I think that when you meet a person and you meet a person with fire in their eyes, simply determined, that's something that comes up from the conversation with them, like you don't even need to — it's contagious, these things — so maybe that's my methodology.

Eyal David: [32:07] Interesting. Maybe it's worth finding where to learn such a thing, where to sharpen this ability, because it's both storytelling and really... this essence-versus-trivial thing — for that you probably need to understand the company very well, and basically what drives it, and maybe where its pains are. So I assume maybe people will turn to you and ask questions before ideas... Good, we're approaching the end here. In my opinion it was a fascinating interview; you gave a ton of advice, a lot of light also on the industry and on the company. In my opinion it was very interesting in this regard, and I'll ask you a question that we also usually ask here — what do you wish for yourself ten years from now?

Snir Havdala: [32:45] Wow, so in the end, you know, when the company grows and you already have a product line that you're doing — I think to keep innovating, to keep innovating; I think that's something that I would very very very much want to happen also ten years from now. Meaning, it's funny — today Zafran is at a point where there are the old companies that we basically tell, you need a new approach here — so I hope there won't be someone ten years from now who'll say that Zafran needs a new approach, but overall, to keep innovating, to keep being at the forefront of technology, to keep looking at the important problems — I think that's very hard, even take five years — but that's what I wish for myself. How nice. You gave a ton of suggestions here

Eyal David: [33:28] for young PMs, PMs in general, so it seems to me there's a lot to take from here, we'll linger on that — it was really fun. Tell me, and if people want to get in touch with you, how do they do it? LinkedIn, email — let's leave it at LinkedIn, we'll leave a link in the show notes. Awesome. Alright Shnir, it was fun, I'll invite you again in a year, we'll see where you actually stand. Alright, so I wish you lots of luck and bye for now. Thank you very much. Hey friends, thanks for listening. If you found this podcast valuable, you can subscribe, follow us, of course, for more episodes on Spotify, Apple Podcasts, or any other app. And of course, if you didn't find us on some app, I'd be happy if you wrote to us; we'd be very happy for five stars on every platform, and for you to follow us so that more listeners can be exposed to us and find the podcast. You can also find the previous episodes on any app or on the YouTube channel — we have links in the description. So until next time, come on, be efficient and bye bye.