Brandon Daniels: $160M Raised to Build the Future of Supply chain and Third-Party Risk Management

Hey thanks, it's good to speak with you.

Yeah, so as you mentioned, I'm the CEO of Exiger, which is one of the largest supply chain management and supply chain risk management software companies in the market. I have about 20 years of risk management experience as a practitioner. So I've done everything from work on the overhaul of the financial markets after the financial crisis in 2008, to help overhaul the life sciences market in the mid-2000s after there were a rash of new regulations that basically regulated how they were interacting with doctors and selling their products, specifically focused on off-label marketing, through to helping the federal government buy goods in the COVID-19 response effort, where we helped the government buy billions of dollars of products and avoid $500 million of fraud, waste, and abuse. So I'm a risk manager as a practitioner, but then I'm sort of a business transformation and entrepreneur at heart. So I've been a part of building a couple of different businesses. One was a company called CPA Global, which is today called Clarivate, and it's a $15 billion company and probably the largest IP and legal software company in the world. Another company that I built was a company called Clutch Group, now part of Mor8 Global. And then finally the company that I'm in today, which is Exiger. I've been here for about going on six years. I used to be the president before I became the CEO, and Mike C., my predecessor, handed the reins to me last year.

You know, I would not say that Mike Trasy, who was the former CEO of USIS, the former CEO of Marsh McLennan, the former CEO of Croll, ever gives anything to anyone. I think the plan was there was a requirement for succession. You know, Mike is... he's got four years of corporate experience there. There was a plan for succession, but I had to earn it, right? So I had to help build our technology business, make sure that we had good product-market fit in the markets that we were attacking, and I had to show the growth track record that we've had in order to take the CEO job.

No, no. 10-year-old Brandon definitely would have thought the technology part of the job was cool. He would have been impressed with the fact that I'd become a programmer first by hobby and then by practice, right? But I don't think 10-year-old Brandon would have really understood or been as interested in risk management. I kind of ended up in risk management through customers, right? So I was at LexisNexis, and one of my largest customers, a company called Medtronic, needed me to run a few of their investigations. I was on the legal side of the LexisNexis business. They needed us to deploy our software, and then they needed someone to help them really implement it and accelerate the parts of the case that our software could. I got put in place as a consultant, ended up really deep in the investigation in that one matter, and that really turned me into someone that loved combining risk management and investigatory skills with technology, and that's been my career ever since.

Well, so the first thing is the most interesting part for me is what it did to our business, right? So the COVID-19 response effort... we had been using our technology to help federal agencies, financial institutions, and corporates essentially do either reputational or cyber due diligence on vendors, right? And so the need was 100% focused on compliance. In the COVID-19 response effort, we got to unleash the full capability that we had built that assessed operational risk, that assessed financial health, that assessed your technical capability to actually deliver the supplies that the customer was procuring. We got to use the full breadth of the platform that we had built in real time, in a real, you know, sort of battle or mission-focused scenario, right? And so the most interesting thing was how relevant the technology was to this mission and to the fight where you're trying to stop forced labor, where you're trying to avoid adversarial finance, where you're trying to stop fraudulent or fake companies from siphoning money away from critical initiatives like buying PPE, medical devices, and pharma on the COVID-19 front lines. It was incredible to see how often we were actually finding companies that were not appropriate to buy from, either because they didn't have the technical capability, or they were reputationally problematic, or because they were literally just fraudulent companies stood up to take money away from the taxpayer. It was coming up more often than you'd think, right? So if we would vet a thousand vendors, there would be some cases where you'd have 10, 15, 20, 30 companies that you would exclude from the bid because they were so clearly unable and unprepared to deliver. So the first thing that struck me in the COVID-19 response effort is the demand or the requirement to conduct rapid due diligence on companies that you plan to do business with to make sure you're making good buying decisions was so critical and was so real. The second thing that came out in that process is the need to understand more than just the surface level of companies that you do business with, right? So very often you'd have a company that was a bona fide distributor, but they would be purchasing masks from a company that was three weeks ago just like an esthetician business, and they wouldn't even know that that potential supply was tainted or wouldn't meet the mask mandates or couldn't qualify as an N95. So the second thing that it did for our business is it helped us to not only understand how critical the need was, it helped us to understand a little bit more about our customers' use case, which is we need to pierce the veil not only on who we're buying from but who they're buying from and who they're buying from, so that we can see the problems that potentially sit at the bottom of the supply base. And so the ability to give customers supply chain visibility and to rapidly risk-assess vendors using open source data on the fly was born out of the COVID-19 response effort, right? Over the last three and a half years, everything that we've done was informed by that one mission set, Brett. So it was transformative for the company. A couple of things that were really interesting beneath the surface were the issues that we were able to call out. So as an example, back in March of 2020, you may remember everyone was talking about needing ventilators, right? And there was this huge push for companies to get into the ventilator market. Ford was talking about building ventilators, Bloom Energy was talking about getting into ventilators. They were starting to pull ventilators together from scrap parts, right? And one of the things that was really interesting is that a few companies released open-source schematics that any company could utilize to create ventilators to ramp up production. And everyone thought, okay, we're going to end up with 20,000 ventilators coming out from industry every month. When we did the analysis in the platform, so when we built out the ability to see the supply chains, when we did the analysis in the platform, what we saw was that the fact that everyone was trying to create the same ventilator actually created an inherent dependency in the supply chain where they were all trying to get one part, which is called a solenoid valve. It's essentially what allows you to attach to the ventilator the actual breathing tubes. That solenoid valve that was attached to that commodity ventilator was only made by one company in the world, and that company was a small company based in Italy, and that company based in Italy had essentially sent all of their employees home. So you basically have this negative externality from something that was extremely egalitarian for companies like Medtronic and ResMed to do, which is to release these open-source schematics that people could start trying to build themselves. You have this negative externality where this one company then becomes this critical supply chain dependency and no one knows it, right? So the other thing that it illuminated for us was the sort of frailty and the dependencies that we have in our supply chain that no one could see, no one knew about until we were in a crisis, and the requirement to change that, to add visibility. One of the other interesting things from the COVID-19 response effort was the amount of effort that went into securing the supply chains from a cyber perspective. I think one of the coolest things that the government did, and we were a part of sort of assessing all of the suppliers along the COVID supply chain logistics, one of the coolest things that the government did is actually we did the cyber assessments, and if we found a critical supplier in the logistics of the COVID-19 vaccines or medicines, they would actually reach out to them, and CISA and DHS would offer them services to help them increase the resilience of their cyber infrastructure to make sure that they could remain a part of the COVID-19 supply chain. I always thought that was an interesting way to sort of interact between a private entity and a public entity to reach out and ensure that you've got the expertise, the funding, the skill sets that you need to become cyber resilient. Basically, proactively mitigating risk for the company using open source data was another really cool example of something that was totally novel that we did in the COVID-19 response effort.

The answer is absolutely yes. So being a part of the Joint Acquisition Task Force, being a part of Operation Warp Speed, what it did was it set us apart from our competition because our competition was all in the sort of bidding process, in the pilot process at the very beginning of the COVID-19 response effort, right? They threw every technology in the world into the basket of tools that those Operation Warp Speed and Joint Acquisition Task Force product owners had available to them, right? And so when people saw our ability to quite literally due diligence on 11,000 companies and illuminate 30 markets and to support billions of dollars of transaction decision-making, that reverberated through the federal government. So we ended up getting a contract through GSA to support a federated information sharing utilization or use case for our software across the federal government for all of supply chain risk management. So we saw the federal government recognize the unique nature of what it was we were doing, utilizing open source data to get supply chain visibility, and we saw all of them come to the table and say, we need this in our weapon systems, we need this in our critical infrastructure, we need this in the things that we buy every day, right? And then the other thing was, at that moment in time, the Honorable Ellen Lord, who's the Under Secretary for A&S, had stood up with a couple of her key deputies, namely Jen Santos and Stacy Cummings and Katie Arrington. They had stood up the Industrial Base Council, and what they were quite literally doing was showcasing the data that we were producing every day on the markets, on the suppliers, on the buying trends, on the places where we could get reliable sourcing and ethical sourcing and where we couldn't, right? And so what we ended up seeing from that was a huge amount of growth because then those cloud companies that were involved in the Joint Acquisition Task Force and the Operation Warp Speed task force, they were all immediately privy to how our technology worked and how it was differentiated, so they became customers. The medical device, pharma, PE companies, all were getting our data, were a part of the procurement process that we were effectively supporting, and so then they became customers. The defense contractors that received funding because we identified that there were programs that they had that were at risk in the supply chain, they became customers. And so what we saw is the company ramp extremely quickly in supply chain and third-party risk management. I mean, we went from $10 million of ARR in 2019 in the third-party and supply chain space to a place where in the next 12 months we'll be at $100 million in AR, right? And so if you think about it, that kind of explosive growth only happens when people see how your technology, how your capability can meet a need in real time, right? It's a bit of a black swan moment, but it's also then sustaining and continuing that kind of delivery that then leads to expanded or explosive growth.

Yeah, in the first few years of the growth, or first couple of years of the growth, it was really focusing on the customer need in terms of our product development. So we had experts in the supply chain use cases, we had experts in the governance, risk, and compliance use cases, and we had built out a fantastic team of engineers to work with them to modify the use cases to that layer of expertise. But really, it was being led by our customers. So I'll give you an example. About three, maybe two and a half years ago, actually, we had a customer say, 'Hey, I love the operational risk, financial health, ownership control and influence, and reputational risk scoring that you do, but I really want to carve out for just ESG risks, so just environmental, social, and governance risks that we're encountering.' Right? And so what we did was we focused on a rapid, iterative, customer-informed development plan to carve out from our other risk scores the things that were specifically focused on environmental risk management or decarbonization or climate change, the things in the social bucket that were about forced labor or about health and safety or some of the other issues that are aligned with the S piece of ESG, and then looking at cyber and corporate director management for the governance side. We basically went on a six-month sprint with that customer, building and iterating with them, right? And so one of the things that we did was, as long as it was in the use case of third-party and supply chain management, we were pretty flexible on allowing our customers to bring us into new areas that allowed for additional share of wallet or allowed us to get new economic advantages or a better economic model. So during the first couple of years of growth, we really focused on customer demand. The second thing that we did to ensure that the growth was there is, as soon as we had that first bit of momentum, right? So we're talking late 2020, we had all this customer momentum from the Industrial Base Councils and the COVID-19 response effort. We started to immediately implement an expanded sales force. So we went from no BDRs to 10 BDRs, we doubled marketing spend. The thing that we had to do is we had to make sure we didn't lose that momentum that we were able to cultivate, because once you have momentum, you have to keep it, and it is very, very easy to lose it by not betting on yourself, right? So in addition to being customer-led in our product development, so we knew that what we were doing was adding value to the customer journey or use case, we also ensured that the momentum that we were seeing off the back of the COVID-19 response effort was being capitalized off of. And then the last thing was when we hit the recession, right? So you're walking into 2022, tech valuations have dropped precipitously, you've got this 70% year-on-year growth, 89% CAGR that you're trying to maintain. You're sitting there and you're thinking to yourself, well, I've got two options. I can either continue to invest in this scale and burn, or I can basically take a little bit of the foot off the gas off of growth and I can get to EBITDA positive on a sustainable basis so that I can just weather the storm, right? And what we did was we did a much, much finer review of our core SaaS metrics to actually dictate what we should do. And what we did was we identified that one, our data hosting, or actually our overall hosting costs, our data costs, and our essentially services costs like the open source services that we were using, that we had grown them on a consumption basis and hadn't reset them now that we had gotten to an economy of scale. So what we did was we shrunk our pool of hosting companies, shrunk our pool of data providers, and actually spent more with each of them, right? So we brought it down and focused our hosting on like AWS. We took our data vendors from 83 to 20, but bought more from the 20, and basically what it allowed us to do is to tap those costs so that as we scaled up in terms of revenue, we would get the delta between what had become cap costs that might have been at higher rates than previously feasible, but we got the benefit of cap costs as we continued to scale, and we knew that we would scale, and we knew that we could dilute it in unit economics, which has come to fruition. In fact, every net new dollar that Exiger adds in terms of software revenue equals 90-plus percent gross margin that falls to gross profit, right? So the unit economics that we've achieved by focusing on the elimination of waste in hosting and consolidating and building strategic partners on the open source data side has been phenomenal. The second thing is on services. There's a lot of work that can go into, like we were using a translation service as an example. There's a lot of work that can go into nuancing when you do or do not need a service, right? And we had just sort of taken this blunt instrument approach to translation as an example, and it was costing us a few million bucks a year. And what we did was we said, okay, the URLs that we're bringing in, the open source data that we're bringing in, we're going to build a cache of that, and all we're going to do is if that URL already exists in the cache and has already been translated, we're going to use that translation, right? And then we said, what we're also going to do is we're only going to put through the translate function data where translation is required for the core function of the product, right? So we don't need to translate names of companies, we already have that built into the way that we screen and match companies. So we made that one change, and it took it from two and a half to $3 million of translation all the way down to about $50,000 a year. So we first looked at our total cost of goods sold and OpEx, and we identified where there was waste that had come out just because we were 100% focused on scale and not focused on efficiency, and that ended up generating more margin. And then what we did is we said, now that we have that margin, we are going to invest it in sales and marketing because we have to push through the headwinds of the recession. So we still got to EBITDA positive, but what we did is we took all of the benefits of these efficiency initiatives and stuck it into sales and marketing to make sure that we could maintain our growth rates without trading our long-term sustainability. And that goes to your efficiency of funding point, right? Like we tried to self-fund essentially the doubling of our sales and marketing team from $10 to $20 million. We tried to self-fund it with efficiencies and waste removal, which we were able to do. And then what that allowed us to do is to say, okay, so we've invested this money, are we willing to take a hit on our sales efficiency numbers for the next year, live with the cash trough of taking on new reps, taking on BDRs, taking on marketing investments that aren't going to lead to MQLs until 2023? We hit the 'I believe' button on that, right? And it's accelerated our ARR capture significantly. We're $2 million ahead of our bookings targets for April. $2 million in bookings in excess of what our bookings target was. So we're $2 million ARR for April, and now that's all flowing through into the P&L and it's creating net new cash that again we can reinvest in the business, that we can put into product, that we can put into mechanisms to ramp. So you have to make trade-offs, right? And so what we did was we looked at our overall enterprise and we said, okay, we've got to focus on efficiency, generate new margin, then when we've got that new margin, we have to reinvest it into the sales and marketing area and say to ourselves, we're okay with a sales productivity issue in 2023 because we know that it'll have the benefit of ensuring that we maintain our growth rate, right? And what that has done for us is not only had that effect of maintaining the growth rate, but actually accelerated and seen higher benefits because our customers have largely put us in a non-discretionary bucket as a critical technology area. So we didn't see any headwinds as we anticipated, we started to outperform, which is a great result, right?

Yeah, so it's about 50-50. We've seen lots of defensive, sort of acyclical growth in the government, and the government is focused on one thing right now: it's getting our supply chains right. It's making sure that the products that they're buying are resilient, compliant, and cost-effective, right? And in the commercial space, we're seeing also continued acceleration because they're trying to solve the same challenge. So right now the ARR split is about 50-50.