As Cybersecurity Vendors, Are We Making Things Better Than Before?

This is an updated repost from the Axonius Medium blog.

It’s funny how and when inspiration strikes. A few days ago, I was reading our 5-year-old one of her favorite books, “We Forgot Brock.” It’s a book I’ve read to hear dozens of times, but this time was different. When I got to the last page and saw the final sentence, it struck me in a way I haven’t been able to forget:

And everything was even better than before.

Context

The book “We Forgot Brock” is about a little boy and his imaginary, chopper-riding, beans and spaghetti-eating friend Brock. After a family trip to the fair, the boy falls asleep and wakes up to find that Brock is missing. After a tireless search, he finds that a little girl took Brock home to play with her imaginary friend Princess Sparkle Dust. They all decide to play together and become best friends, concluding in the line “and everything was even better than before.”

So What?

It’s certainly a nice message, and a good thing to teach to kids. It’s wholesome. There is no controversy. But why did it stick with me differently than the thousands of other cheesy lines in the other kid books I read?

It made me question the contribution that we in the cybersecurity industry — specifically marketers, salespeople, and product makers — are making, and whether we really are making everything better than before.

6 Rules to Judge if Everything is Better Than Before

When you think about any recent purchase and ask yourself whether it resulted in everything being even better than before, it seems like a pretty heavy question to answer. The subscription I bought for the webinar hosting platform will let me host webinars, but does it make everything better than before? Probably not.

But what would a cybersecurity product have to do to make someone feel like everything is even better than before? What requirements would a security product need to satisfy in order for someone to glowingly recommend the product? A few ideas:

1. Solve real problems. We’ve all seen solutions that are in search of a problem, but with a surplus of real problems, it seems unlikely that customers are interested in a vitamin when they need to stop the bleeding.
2. Reveal things I couldn’t see before. I don’t know what I don’t know. If a product can shine a light on things I didn’t even know existed, that’s magic.
3. Give me net new capabilities. What can I do tomorrow if I buy something that I simply could not do today? It’s nice to know something I didn’t know. It’s better to know and to be able to do something new that matters.
4. Get rid of manual work. We’ve all been bashed over the head with stats about the skills gap and the difficulty in filling security positions. Adding more products that require people to operate them just adds to the pile. Unless a product can eliminate manual work without requiring more resources, it’s tough to justify.
5. Don’t make me change too much. There are graveyards full of products that had amazing technology, but required a complete change in the way people work.
6. Let me compare to where I was. Show me how much I’ve improved with metrics that matter.

It would be easy to now go through the six rules and show how the Axonius Cybersecurity Asset Management platform applies to each. In fact, you are probably expecting that. That’s not where this is going.

Instead, while thinking through the 6 rules, I immediately thought about something I bought that I still recommend to anyone. Something that was worth every penny, and could only be described as magical. Something that has absolutely nothing to do with cybersecurity at all:

Dog Training.

This is Heidi the day we got her in December.

This is her 4 months later. That’s about a 40 pound difference. What you can’t see from the photo is that she was a crazy monster. She would eat shoes. She would try to bite us when we walked her. In 4 months, she went from cute puppy to destroyer of all things. It wasn’t great.

Then we heard about Riptide. Founded by a former police dog trainer, the company specializes in training big, strong, aggressive dogs. You bring your dog there, and 3 weeks later, the results are insane.

1. Solve real problems. We had a real problem on our hands. We had a smart and playful puppy that didn’t know the difference between nipping at another dog and biting humans. And although we had other dogs before, we just weren’t equipped with the tools to train this dog. We knew she was smart and sweet, but didn’t know how to reward the good and discourage the bad. And with a nearly 5 year-old, we had to solve the problem.
2. Reveal things I couldn’t see before. During the training, the trainer showed us things that we just didn’t see. Signs that Heidi needed to go outside. Signs that she didn’t have enough exercise. She was telegraphing every behavior, and we just didn’t have the visual vocabulary to know it. We left with a completely new set of cues that we could act on.
3. Give me net new capabilities. Just a few examples:
   1. Automatic “Sit” — whenever I walk Heidi, the second I stop, she sits and looks to me for a cue.
   2. “Free” — once I tell her “down”, she stays down until I give her the “free” command. People are amazed by this. 
   3. “Place” — if I tell Heidi “place”, she will stay in the exact same spot until I tell her “free”. If I needed to, she would stay in her “place” for hours.
4. Get rid of manual work. I’m fairly convinced that if I spent 8 hours per day, 7 days per week doing nothing but training her, I may be able to get her to do 25% of what I got from Riptide. But with a job, wife, and daughter, that wasn’t happening.
5. Don’t make me change too much. Rather than completely changing how I interact with her, Riptide gave small, but effective commands that made a huge difference. Always walk her on the left side. Always lead. Reward often. Challenge her to use her brain and solve problems.
6. Let me compare where I was. This one is easy, as I only need to look at the un-chewed shoes by the front door or my unbitten fingers. I jump out of bed excited to take her on her 6 a.m. walk. It’s a massive difference.

Although dog training and cybersecurity products seem vastly different, the result should be the same. The stakes are high, and we should always strive to make everything even better than before.