When you have spent nearly 40 million dollars building a system to solve a network security problem, I guarantee you will find it jarring when you start seeing it purchased for a usability feature you listed as 8th or 9th on the spec sheet.
The search for product market fit is something no textbook, podcast, consultant, or purportedly inspirational speaker can prepare you for. It is a search for a gut feeling buttressed by invariably faulty statistics.
From an engineer’s perspective, it is an exercise in searching for peaks on an unexplored surface whose topology shifts as a consequence of your actions. Just because you found a peak doesn’t mean it is the tallest, and just because a peak is tall does not mean you are going to find it.
A classic piece of advice is to let the customer tell you what they want. That is sound advice for people who have found a peak and are trying to climb it. But, by definition, customers have already found a product they like that you make. If you are searching for new peaks, do not just listen to your customers.
In our case, our initial customers cared about cybersecurity more than anything else. We built a system to prevent a nation state adversary from obtaining, and maintaining, target lock on an asset. Use Dispel, the value proposition went, and no one will know who you are, where you are, or what you are doing, unless you tell them. It took over 20 minutes to set up a secure link. Did it work? Yes. Was it easy? No. But the customers did not care, and they were the ones paying the bills.
Fortunately, we did care, because we used our own product internally every day. The customers certainly did not mind the improvement to connection times—no one enjoys going through a long and complex login process—but the improvements did not move the needle on purchase decisions. We pushed our connection time down to about a minute by 2018. Then we wandered off to deal with other things.
That time compression gave us, unknowingly, an edge in the remote access market: a relatively sleepy sector full of products with user interfaces from the 90s, connection times of 5 to 10 minutes, and infrastructure no longer viewed as secure in almost any cybersecurity circle. The race was on, we just didn’t know it yet.
We blindly carried on pitching our wares as a cybersecurity service throughout 2018 and early 2019. There were meetings that should have tipped us off, but we kept agreeing internally that no, the people we spoke to must have been focused on the connection time only because they had already heard the security pitch.
Scene: A water utility conference taking place in the basement of a hotel built in the early 80s. The coffee was bland, the ambience worse, and I was questioning the series of decisions that had led me to this moment in my life. Then it dawned on me. Why was I the only person in the entire room pitching cybersecurity? These folks didn’t care. I started to pitch us as a rapid remote access product. People started to listen. We were on to something.
A few weeks later, in Singapore, I did the same thing, but with a booth to back it up.
“What do you do?”
“Rapid Remote Access to Industrial IoT.”
“Show me.”
No one with money cared about the security. They cared about getting their people to their assets quickly, in spite of the security requirements.
We had found a new peak. Different buyers, different personalities, different values, and much much deeper pockets. It was the same product, just with a feature now moved to the top of the list.
In the two months since then, we have reduced the connection time from 30 seconds, to 12 seconds, to under 3 seconds. We have also found our closest competitor’s pricing and, to our chagrin, realized we have been pricing ours at 6.25% of theirs. I have no idea how they were getting away with that, but we’ve nudged our prices up so it’s an even 8%.
Now we are climbing two peaks: Cybersecurity for people who care, and Rapid Remote Access that is also secure, for those of you out there who just want to get stuff done. Same product, different positioning. It’s convenience, stupid.
Your systems should work, and your network should be protected with the strongest security possible. With Dispel, protect your network with Moving Target Defense.
Get your demo at https://dispel.io
