Selling Agentic AI to Enterprises | Lessons from Ex CISO of X (Twitter) | Rinki Sethi

It's so great to be here, Abishek. Thanks for having me. I think I know you for now four years and I think since I've known you and just seeing your career journey, and I've known you for longer actually even before I met you, and you've had a phenomenal career journey. You've, you know, ran security at Twitter in its heyday, Bill.com, IBM, Palo Alto Networks. I don't know which other companies left you have managed budgets over a hundred million and now you are at one of the fastest growing security companies leading the strategy. And that's not all. You just started your own fund, Lockstep. Very excited about Lockstep. It's really, really amazing. And I think what's most interesting when I every time I meet you, it's like you're just getting started. How do you do all of this?

It's truly amazing. I'm very, very curious, you know, what you would be doing in the next few years. But before we get into that, I think you're one of very, very few people who have seen enterprise selling from various standpoints, right? You were at Palo Alto and these companies managing incredibly large budgets. Now you are at an actually security vendor and you are a founding partner. So you're seeing startups coming to you pitching every day. So I'm curious, Rinky, when you see these startups pitching or pitching to their end customers, what do you think the startups that get it right and the other ones struggle? Like do you see common patterns right off the bat when founders come to you?

Yeah, I feel like at the end of the day, we're all people, right? I'm not just a security person. I have so many dimensions to who I am. And I think like startups that get it right, they want to build a relationship. They understand it's a people-driven business. And you understand the person and then do you even understand what's important to me right now or are you just there to go pitch me your own technology? Right? Like do you understand the buyer's problem? I think founders who get enterprise buying, they understand like nobody wakes up wanting agentic AI. They wake up wanting fewer incidents, faster response, less operational drag, or fewer people on their team that are burned out right at 2 a.m. in the morning or whatever it is, and you want more time with your family and things like that. I think the teams that struggle lead with architecture or autonomy or intelligence before they can even explain where this fits into the existing enterprise workflow or budget or decision process. And if they can't clearly articulate who owns the problem, who signs the check, and who gets blamed if it goes wrong, they don't understand yet enterprise buying. And so I think it's really important to understand like who is your buyer? Like it's not always the CISO, right? The CISO might just be somebody you want a relationship with that understands what you're doing. Your buyer might be somebody on the team and so your conversations need to be accordingly. And I think startups that get it right, they really care about the problem, not just the solution they've built because solution will continue to evolve and change. And they care about the company that they're selling to and they've done the research, they've taken the time to understand what problems that company, that CISO, that CIO might be facing.

Yeah. I mean, even as a first-time founder, Abishek, I remember Gorav actually introduced us. I didn't even know what Bolster was and I didn't know we were a customer and he's like, 'Rinky, I want you to meet Abishek.' Well, that helps a lot when your peers or your employees or somebody's like, 'Hey, they're excited about a person and they're excited about certain technology.' And I remember when I first got to meet you, it was like I was expecting like, 'Oh, you're probably going to sell me so we expand or anything like that.' And we literally never talked about like our contract or what the product currently was doing. We kind of talked about trends and like where you were heading with the future, right? And that's where you and I connected and I wanted to have more conversations. I think we were supposed to have a 30-minute conversation that went an hour long. And that's what I love, right? Like at the end of the day, is this like somebody you consider like a visionary? Is this person going to solve my problem today? Are they also going to solve future problems for me? Is it someone I trust is going to build something really incredible? But do I feel like if I'm early in this, people are going to be like, 'Oh, Rinky was one of the first adopters of this tech when they're really, really big.' And then obviously like I think like other customer referrals, other people that I trust referring the company, I think that cuts through the noise. A lot of innovation and a lot of amazing innovation happening right now which I think is really exciting for practitioners like me. And so like the more that you get validation and the more again like that personal touch works. And then I'll say one more point is like founders reaching out can make all the difference too. Like it's not just the sales team, right? Like I want to get to know the, especially if it's a smaller company, like I definitely want to know what they're building and what the future looks like and I think most practitioners want that.

Yeah, it's so interesting. I think you're the first person that's asked me that question and I think back actually, I worked at PG&E and when you think about PG&E, I think the average age of the company at the time was like 55 and I was a college new grad at the time that came in. And so you're thinking about like elevator conversations were all about retirement and pension plans. I'm like sitting there, whatever, like what am I going to do? And this is before anybody even knew about cybersecurity. This was when it was called information protection over there. There was no CISO. But somehow our team had some young folks and they were like very much like if you think about a company that is very traditional software, very traditional like cybersecurity vendors that were there and there was a group of people I worked with that like brought in all these new companies. There was a leader that was very connected with innovation and so I got to very, very early on get to see kind of these innovative companies and what they were doing and you compare it to like what you had back then and you compare some of the newer tech that was coming out. I mean I can't tell you the user interfaces and how different it was and it was like why are we using this old stuff when you could be doing it so differently. And at that point I didn't even think about the risk. I just thought about man this is like way better product right and it's so much easier as a user that didn't know what they were doing to leverage these products. So to me like that was in my mind all the time and then I went on to actually more innovative companies and very, very traditional stack around cyber and I tried to bring in a new company. I actually failed at implementing it, the technology at the time. It was a new, it was a phishing testing program and it was like we completely flopped and I had this huge contract that basically I couldn't do anything with and it was a lot of problems in kind of how I deployed it and it was because I was used to what I was doing before realizing that I can't operate that way. So I have had the fails but here's the thing like even with the new tech and you failing you realize like man these guys are doing something different and you learn from your failures and like that makes you want to do more of it because then when the success that's happened and adopting some of these startups like you're like oh my gosh now everybody in the world uses this and I was like one of their first customers and kind of drove the path to innovation in that way and that's why I like taking bets on founders. I'll also say that I think we have to like, if we're going to beat the attackers at the game like we're going to have to work more efficiently and like being way more productive and we got to invest in early stage companies.

Yeah, like when I think about it in security and you're bringing on a product, like you're going to get usually the CISO, CIO, the person that brings in the demo is going to be so excited about it, right? And they're going to be like, 'Okay, let's go do something.' And then they're probably going to go have some internal meetings and they realize, 'Oh, legal is going to ask about liability, security's going to ask about risk, IT's going to ask or engineering is going to ask about integration, procurement is going to ask about pricing.' And you run into all these different things and then the business is asking why does this matter now. And I think founders really struggle when after the demo they're assuming that the momentum and that like excitement in the beginning is going to carry itself and you realize that in enterprise sales momentum must like almost actively be managed and you have to make sure that you're helping champion and navigate internal objections otherwise like this deal is just going to stall quietly, right? And I think it's really important to think about like what are you going to arm the team that you're working with at your buyer in terms of like, 'Hey, we should pull in these folks early. Let's like have them on the first calls. Let's make sure that you continue having the conversations that after the demo you don't let too much time go by before you touch back again and build that relationship and make sure that you're coming in knowing that it's not going to be easy for the buyer to go and bring in a product. Things have been really, really difficult especially with our regulatory pressures and so forth.

Yeah, I think like the data, the sharing data piece is a real, real challenge, right? And I think a lot of sellers, like a lot of vendors, the founders, they feel like, 'Oh, just give me this access to this data.' Well, I have to jump through hurdles to get you access to that data and why am I giving you access and you're so early and the risk that comes with it. And so like I think one, if what you're solving for is not compelling enough, why am I going to go jump through those hurdles? Like you better have sold me like that this is going to be so worth it for you that I actually want to give it a chance and be a design partner knowing that it's going to take some time to build this. But like if you can make some commitments to me that, 'Rinky, once you go and adopt this, your productivity is going to go X%. You're going to be able to like help your people have better careers.' You're able to make these commitments and I can start seeing it in the design partnership. All right, there are some of those like agreements between us. It all of a sudden makes it worth it jumping through those hoops because at the end of the day, that's like something I can also take to the board as a win and I can take it to our executives as a win that, 'Hey, we're trying something new that hasn't been done before but the opportunity is massive in what we might be able to do behind that.' And so like giving me the points on that right off the bat makes it so like I want to engage and be done.

Exactly. And like, you know, everybody's different and their risk appetite is different and the company's risk appetite is different. So understanding like can you find a use case where the data sharing might be minimal if they're more risk averse and like still show massive value, like how do you get to that point, right? Or can you do test data or something like that to be able to show value. So I think it's one, like I'm solving a problem that's real, I can feel it, and then like how you're solving it differently, and then like convince me like that I want to be the first one to like be a design partner and be part of that story.

I think a lot of people one get stuck on the early adopters are like at the C-level. I think a lot of C-levels are strategic. That's why we are C-levels and you're thinking about vision and you want to know the innovation and the trends. And you know one thing I'll say too is like when you talk to startups, startups are talking to everybody and so like you learn a lot from what your peers are doing just by talking to startups and understanding what others are doing out there, right? And so I think like a lot of times like as you're coming to us and we're kind of learning about that innovation that happens, it makes the security program within the company even stronger. But going back to your question around like, you know, how do you find people like this? I think sometimes your buyer is not just the C-level. It's folks that are actually facing the problem on the teams and they start becoming the champions. They make the C-level champions, right? That's actually really fun for us when the team comes and does that. And then I think like there's a lot of communities exist. I know we're running one at Lockstep for sure that where you have like, we want innovative CISOs. We want, we're all wanting to give back to the community and give back to the founders if nothing else at least giving feedback and engaging but investing like in the startup ecosystem. And I think there are actually more than you would believe that exist. I think how founders approach it is really important. Like you're not, like an innovative person can't necessarily be your buyer. Like think about a heavily regulated industry. The CISO or CIO there might not be, they still might love innovation, but they might not be able to be your buyer, but they may have incredible feedback. They may say, 'Hey, I'll look at you in the future when you're bigger.' Might be like a great adviser. And so I just think that like there's opportunities and you'll find those people if you're like really looking at how am I going to solve this problem in the most unique way and not just trying to make the sale.

Yeah. And I can share this as a, now being on the, like as a vendor too but also as a buyer, right? Like I don't think it's just one relationship. It's, you know, you meet people of all different like types and sometimes like even I'm very opinionated on where I think, you know, what company I think we need to go with even if my team is like going in a different direction, it's going to take a lot for them to convince me otherwise and vice versa. Sometimes I'm not like that opinionated and I'm learning from them. I think like in the case that you mentioned and this matters no matter what, like egos exist. And I think even as being at Upwind and selling, it's like no matter who you're working with, you're not just selling to that team or that one person. You're selling to the company and you're selling like to multiple stakeholders. And so I think it's really important like you're working bottoms up sometimes, but you also need to be working top down. A lot of times you work top down and then like you haven't brought the team, you know, is like they can throw a monkey wrench into it. And that's happened to me too where I'm very convicted and the team is absolutely not and they weren't brought along in the right way. Vendor didn't work with them properly and so it just didn't work out unfortunately. So it is a relationship business. You do have to be like at every layer be able to talk to folks in a different way and understand like what is it that you need to do to manage the egos or, you know, manage what's important to different stakeholders.

Not necessarily, but like, you know, it's funny because like, you know, it's funny when like Gorav doesn't put every founder in front of me, right? And it's like, and Gorav and I will chat a lot. He, like, I go to him and I've learned a ton. Like it's like, 'Gorav, tell me all the vendors in the space. Why do you like which ones?' I give him my strong points of view. We debate it, right? And we, and I believe that's what builds a better program from a security perspective. But a lot of, he also, like, I love talking to visionaries. I love people that are going to change my mind and the way I think. That's how I ended up at Upwind because it changed my philosophy on cybersecurity as a practitioner and I'm like, 'They're doing something different.' And so like that to me, and same with you, when I met with you, it's like you're doing something different back at Bolster in terms of what your vision was. And so like I love that kind of thing, right? And so like, but you try to sell me Bolster, I'm going to be like, 'Don't sell to me, Abishek, go to the team.' Like this is not like necessarily one of my top priorities. And then you'll say, 'Okay, like who do I talk to?' And you got to bring along these other folks, right? In this particular case, we're already a customer of Bolster but I know you were thinking about like the email security space at the time and I was like, 'Okay, I think it's super interesting.' Like, 'Okay, now get Gorav excited about it.' So I think it's that kind of thing, understanding that, right? Like I want to talk to you about vision but then you got to go convince my team they're going to like want to buy it and that means like they've got to think there's something very unique and are they going to save budget, are they going to like get something better, what is it?

Yeah. So like just the story was that I rolled out this phishing testing program back at eBay and it was PhishMe. And PhishMe was early days. They were selling mostly to banks and phishing testing was a common thing at banks but not in like tech, right? eBay I think might have been one of the first tech companies that was a PhishMe customer. We signed the deal. That was Rohit Balani who's a close friend who I'm going to see in a couple months. But we signed the deal with PhishMe. It was a big deal. And then it was time to roll it out and that was my responsibility. And I was doing a test with a small portion of the InfoSec team back then and I didn't tell anybody that the test was coming. I just did it and then someone must have not been having a good day. Thought they got scammed and made a big deal about it. Went all the way up to HR and HR called me and said, 'You pull a trick like that one more time and you'll get fired.' And it's like a funny story now because you're like, 'Okay, now it's like you just, this is part of the DNA of most companies do phishing testing. In fact, it's required at many companies.' But this is how it was back then. And I remember telling Rohit like, 'I can't, we have this huge contract, like I can't run this. I can't do this anymore. Like I'm hamstrung, right?' And he basically said, 'Okay, what else can we do for you then? Like I don't feel good about having taken this from you guys and not being able to deliver anything.' And we did some training, communications, and they helped me with all of that. And then I actually became a customer of theirs probably like at like five other companies after that that I went to. I was a customer at eBay, I was a customer at Palo Alto Networks. On and on and on. Every company I've been to, I brought it in. And so I think like, but it's because of the partnership that he had with me and like how we navigated a really difficult situation and it was bad for him too because that was supposed to be a case study for him on first non-banking company doing this and fortunately it totally flopped, right? But he just was a close friend through the process and I think we learned through it together too that, 'Hey, Rohit, you need to provide training for people like me on like, give me the communications templates and that train me. You can't just go and do this.' And so that was on us and we kind of built it together, right? And then that helped probably other customers as well as me in the future.