Turning a Continuous Improvement Mindset Into Successful KPIs

When growing and scaling sales teams, stasis can set in even quicker than a sales leader might realize. That’s why Marty Sanders, head of American sales at cybersecurity leader Vectra, prioritizes continuous improvement as a strategy and goal for every member of his organization.

During this episode of Growth Hacks, the trio discuss how Marty hires sales leaders that are hyper focused on growth, and how Vectra supports their employees with a culture that allows them to excel. Marty also walks us through how his new hires generated 50% of revenue in just six months…and how they cut their sales cycle by more than half along the way.

Here’s what you will learn:

  • Why Vectra treats recruitment with the same focus they do dealmaking and sales
  • How to recruit and hire talent that has an improvement-focused mindset
  • The strategy behind implementing a culture of continuous improvement
  • How Vectra shortened its sales cycle while growing revenue generated by new hires

To hear more on this, settle back and press play.

Please find the transcript below, which has been edited.

Kunal Mehta: In today’s episode, we have a special guest, Marty Sanders. Now a little bit about Marty.

He started his career at EMC, where he eventually led a division from a hundred million in revenue to a billion in three years. After that amazing run, he became CEO of a Tony Robbins company that focused on doubling sales in 24 months or less. He went on to work for one of our venture advisors here at TCV, Mark Smith, at a fast-growing company called Rubrik.  Now he’s at the helm of America Sales at Vectra, who is a leader in cybersecurity and a TCV-backed company. And I’m sure you’re going to share some incredible best practices. Welcome, Marty Sanders.

Marty Sanders: Thanks, Kunal. So great to be here.

Katja Gagen: Awesome. Marty, where does this podcast find you today?

Marty Sanders: Got off the plane a couple hours ago from Chicago and I’m looking around and I think I’m back in my home in Scottsdale, Arizona.

Kunal Mehta: Well, Marty, I got to tell you my first day at TCV, I walked off at jetway and I was greeted by these incredible superheroes. And I remember thinking, this is just incredible branding. I loved it. I loved how they had a superhero for cloud, network, data center, but then I realized it was Vectra, a TCV-backed company, and they’ve kind of cracked the code on simplifying cybersecurity. Maybe you can give us your quick pitch on Vectra.

Marty Sanders: Absolutely. I do get excited every day here at Vectra because we’re fighting bad guys. We’re helping companies prevent the serious damages that come from cyber-crime. What Vectra does is we provide peace of mind that your mission-critical assets are protected from cyber-crimes, like ransomware and supply chain. And we do it by detecting adversaries and responding to adversaries at speed. Thanks to our superior AI and ML platform.

Katja Gagen: That’s interesting Marty. So, what is most important prevention or adapting as quickly as possible? And since we hear about ransomware and security breaches every day in the news, has demand gone through the roof for Vectra’s solutions?

Marty Sanders: Thankfully they have, but you know, sadly it’s because crime is getting very, very bad. And one of the challenges that companies have today is they’re spending way too much on trying to prevent and stop and block threats that can’t be blocked. So, the new wave companies who are doing a great job defending themselves against ransomware and supply chain are focused on detection and responding to adversarial threats versus prevention. Because eventually somebody is going to get in. So, it’s all about identifying them and getting them out as soon as possible.

There’s about a 300% uptick in ransomware I saw in the Washington Post recently. We are seeing a significant uptick in early indicators of ransomware amongst our current customers. But the good news is we are seeing the early indicators of ransomware with our current customers, thus being able to identify and respond to that. That’s why our customers are out of the headlines.

Katja Gagen: Right. And obviously cybersecurity is a really hot topic and being ahead of the game is key to fight the bad guys, so to speak, right? How do you find good talent in an industry that is in short supply? And what are your secrets for hiring and for ramping people quickly?

Marty Sanders: There’s a lot to unpack there, Katja, and I will tell you it’s tough and it’s never been tougher. But we’re having great success, despite all those headwinds. And part of it is a culture and treating recruiting with the same level of focus that you treat any large transaction or large deal in the forecast.

And it starts at the top, making sure that I carve out time to do recruiting and leveraging my network and tools on LinkedIn. Then it goes down a level to my managers. So, when I’m inspecting their business, it’s not just a forecast and pipeline review. It’s also a review of their recruiting activities.

So that’s really important to us, that we treat recruiting like we treat multi-million-dollar deals. The second thing that we’ve done is we’re a lot more efficient in our recruiting and we’re getting a lot better predictable results by using a personality DNA test from company called OMG. What we’re able to do is very quickly after we identify a candidate — do a 10-minute interview — we ask them to take this test and, you know, if they fail the test, we don’t move on. It gives us back a lot of time because it’s customized for us, and it’s able to take into consideration the skills and the wills that makes sense for the candidate and it makes sense for us here at Vectra and we don’t have any exceptions. You pass the test, or we don’t move on.

Kunal Mehta: Marty, I love, just the science that you apply in terms of hiring. We spend so much time training sales reps on qualification. Whether it’s through MEDDPICC or MEDDIC or whatever, you’re using the same approach on hiring. Maybe you can give us a little bit more color about how you apply that process to hiring?

Marty Sanders: Absolutely, because now we’ve done a good job at sourcing candidates, and we get somebody that passes the test. There’s still a lot of work to do so in closing the sale because it is a sale, and we use MEDDIC as part of our hiring process. Understanding, what is the metric that the candidates are looking for, which is typically income or upward mobility, you know, who’s the economic buyer? Many times, I’ll be on with a candidate, and I’ll say, Katja, do you discuss this opportunity with your significant other or spouse? And she may say yes. And I’ll say, would it be helpful if I got on the phone with your spouse and talked a little bit about the opportunity, to make sure I’ve answered all questions? Just making that offer goes a long way in the recruitment of a candidate.

Kunal Mehta: And what’s the result at Vectra through this process?

Marty Sanders: Well, I adopted it as soon as I joined the company about seven and a half months ago, and the last two quarters, in what used to be considered a long sales cycle, over 50% of our revenue is coming from folks that have been hired in the last six months.

Katja Gagen: Well, thanks, Marty. I also want to drill a little bit into the sales cycle. A lot of our companies in the portfolio have very long sales cycles and then they hire these industry superstars with a big Rolodex, and they pay non-recoverable draws. What’s your take on that?

Marty Sanders: My take is this is a problem that many companies are facing, where we hire the person with the expensive Rolex and the nice suit, and they make all these big promises and nine months go by and you really don’t have the right scorecard to see if they’re doing a good job or not.  So, I address it in a couple of ways.

Number one is what can we do to shorten that long sale cycle? And I’m obsessed with that. And making sure when I use the sales, like a DNA test or personality profile, does this person have the ability to do transactions? Even though you’re not a transactional business, just having that transactional ability really goes a long way in shortening sales cycles.

Number two is building a scorecard to measure if they’re doing a good job and then three, and most importantly, tying that draw to the KPIs on that scorecard. I will not give a draw just for the sake of giving a draw, that you get money just for showing up. We’re going to make sure we tie that draw to MBOs that are great leading indicators that we’re building pipeline. But even activities like identifying stakeholders, meeting the stakeholders, getting the senior leadership like me or my CEO in front of the customer. Identifying use cases, modeling a TCO, developing unsolicited proposals. And most importantly, have you identified pain in any part of an organization? Just making sure we’re paying that draw and tying it to hitting these KPIs.

Kunal Mehta: Marty, I think those verifiable outcomes that you’re talking about and tying the draw payment to that is incredibly refreshing to hear. I know you have this great way to onboard, ramp, even identify talent, but you also have an incredible way to think about just continuous improvement as folks come in. Maybe you can talk to that a little bit and how you’ve compressed things like sales cycle.

Marty Sanders: Continuous improvement has to be throughout an entire organization, and everybody has to be obsessed with that. Probably my biggest obsession right now, is shortening the sales cycle. When I came to Vectra, our sales cycle in America was 241 days, and now we’re down to 111.

Last quarter we had five new customer transactions, brand new net, new customers that closed in less than 30 days. So, we’re certainly trending in the right direction. And the pillars to get that done is — a big part of it is culture and not allowing that limiting belief that all of our sales cycles are nine to 12 months.

One of the things that you have to do again, going back to the sales DNA, is making sure you hire people that do not have that limiting belief and agree with me that we can shorten that sales cycle. Number two is making sure all your sellers can articulate the value prop in 90 seconds or less. You can get that in less than 90 seconds; you can build a 90-day sales cycle.

Next is building a culture of compression where every Friday is treated like month end, every month end is treated like quarter end, and every quarter end is treated like year-end. By the way, this is tough. It can wear people out, but you have to maintain it. But because it’s tough, you have to do two things. Again, hiring people who are built for that.

And then number two, really being aggressive in recognition and making sure that you’re checking in on your people, that they can continue to maintain that pace.

Kunal Mehta: That level and that mindset is incredibly important. And I remember Marty, when we first met, you talked about no goose eggs ever. Maybe you can just explain to our listeners how that mindset is so critical in your own organization.

Marty Sanders: A great example is, you know, a sales rep who doesn’t clearly have a deal to commit, you know, from a forecasting perspective. And they’ll say their commit is zero. You cannot allow anybody to put a goose egg in their commit.

They must put something. Something has to be in there because if you allow them to have a zero forecast, you’re basically giving them a mulligan. You’re giving them the subconscious right to fail. By getting them to commit to something, anything, even if it’s $50K, that commitment now is tied to a moral obligation, and they are morally obligated to get to that commit. So, it’s very important that none of your managers can ever accept somebody committing to zero.

Katja Gagen: So, it’s a lot about having growth in mind, but also being very focused. That leads me to lifetime learning, Marty, and I know you’re passionate about learning. So, tell us, who do you learn from and who has had the biggest impact on your career?

Marty Sanders: I could literally chat for a week answering that question, as there’s been so many people that have influenced me and helped me. But my go-to book, the book that I ask all my managers to read, the book that I read on an annual basis is Dr. Robert Cialdini’s Influence, and his new book called Pre-Suasion. It’s all about using tools like neurolinguistic programming and the seven most powerful words and subconscious laws of influence to get people, to do what you want them to do. To lead them, to make the right decision. And the premise is: there’s no such thing as free will.

Kunal Mehta: Well, I love any books that have to do with influence and persuasion. Maybe you can talk about how that impacted you and your personal life.

Marty Sanders: The beauty of Cialdini’s work is the impact it has had on my personal life. And I’ll go back to a sales campaign, talk about long sales cycles, this is a sales campaign I started about 15 years ago. I had seen John Chambers do a presentation about the need for more engineers and said, “if you have small children at home, do what you can to get them to be engineers”. And I went home that day with a moral obligation to make sure my daughters became engineers. So, I looked at my four- and six-year-old in the eye and said, “you guys are going to be engineers one day.” And they laughed. They giggled, they went back to dance class and her piano lessons, not knowing that over the course of the next 15 years, I adopted every piece of learning from Cialdini that I could apply to influence my girls, to become engineers. And up until the day they were doing their college applications, they still didn’t realize what major they were going to do, but yet they somehow wrote down mechanical engineers.

And as I look back today, I’m very proud of my two successful daughters who are going to be big, big players in women in STEM.

Kunal Mehta: Marty — they’re going to know about it now, this lifelong campaign.

Marty Sanders: Cat’s out of the bag.

Katja Gagen: And so, taking this to the influence and persuasion in selling, what’s your number one tip that you can tell with our listeners?

Marty Sanders: I would probably start with, are you using the proper pre-framing techniques before you message to a customer? Here’s one of my favorites. And this came out of a result of doing presentations and I thought I was doing a great job, but they weren’t taking the actions that I wanted them to take at the end of the call.

And a lot of us have great calls with no actions. So, I’ll start a call and I’ll go, “Hey, Kunal, thanks so much for having me today. I’m really excited to be here. What I can tell you Vectra is very data-driven, and we actually take a look at the results of every time we do a presentation like today. And what I can share with you Kunal, is at the end of this presentation, the data says, that 75% of people who go through this take action at the end. Now that action may vary. The action may be a deeper dive, talk to a reference and some cases they just want to accelerate the move to a procurement, but 75% of the people who see what I’m going to share with you, take action.”

And at the end of my presentation, I’m not going to have happy talk. I’m going to say “based on what we just went through Kunal share with me your next action. I’m not asking you; I’m telling you to share with me your next action.

Katja Gagen: That’s really great advice, Marty. I love that and our listeners will love it too. So now as we’re getting to the end, we’ll finish with a quick lightning round. So, tell me what book is on your nightstand?

Marty Sanders: Awesome book by my friend, Randy Seidl. Your Go-To Sales Adviser.

Kunal Mehta: And I just wanted to know maybe the company you admire the most and why?

Marty Sanders: It has to be EMC. EMC sales DNA is sprinkled all over Silicon Valley and companies like ServiceNow, Snowflake, Cohesity, Rubrik, and now Vectra.

Katja Gagen: What’s the one thing you wish you had known earlier in your career?

Marty Sanders: People matter. Hire right? Sleep at night.

Katja Gagen: And Marty you’ve seen good and bad sales calls. What’s the best cold call opening line? What’s the worst?

Marty Sanders: Well, the best cold call opening line that worked for me when I was a young lad was: “Hey Katja. This is Marty from Vectra. We do a lot of business with other venture capital companies, and research says that it takes me nine calls to reach you. So, you could save us both another eight calls by returning my call and just give me three minutes of your time. If I don’t prove value in those three minutes, you’ll never hear from me again, Katja.”

Katja Gagen: I would definitely return that. What’s the worst one?

Marty Sanders: “Hey, Katja. It’s Marty from Vectra. How are you today?” I can’t tell you how many times somebody said, like “I’m horrible, my wife just threw me out of the house and my dog died. How are you doing?”

Katja Gagen: Well thanks so much, Marty, for sharing all your insights for salespeople and for life. It was so nice to have you on Growth Hacks today. Thanks for joining us.

Marty Sanders: It was a blast and I hope you two have an awesome day.

Katja Gagen: Thanks for listening to Growth Hacks. You can follow us on Spotify, Apple Podcasts, or wherever you listen. To learn more about us and TCV’s CEO and founder podcast, go to TCV.com or email us at growthhacks@tcv.com.


The views and opinions expressed are those of the speakers and do not necessarily reflect those of TCMI, Inc. or its affiliates (“TCV”). TCV has not verified the accuracy of any statements by the speakers and disclaims any responsibility therefor. This interview and blog post are not an offer to sell or the solicitation of an offer to purchase an interest in any private fund managed or sponsored by TCV or any of the securities of any company discussed. The TCV portfolio companies identified, if any, are not necessarily representative of all TCV investments, and no assumption should be made that the investments identified were or will be profitable. For a complete list of TCV investments, please visit www.tcv.com/all-companies/. For additional important disclaimers regarding this interview and blog post, please see “Informational Purposes Only” in the Terms of Use for TCV’s website, available at http://www.tcv.com/terms-of-use/.

OneTrust Secures $300 Million Series C Funding at a $5.1 Billion Valuation led by TCV

ATLANTA, Dec. 21, 2020 /PRNewswire/ — OneTrust, the largest and most widely used privacy, security, and data governance technology platform, today announced a $300 million Series C funding round. The funding values OneTrust, founded in 2016, at $5.1 billion and brings the company’s total money raised in the last 18 months to $710 million. TCV signed on as a new investor and led the round, joined by OneTrust’s existing investors, including Insight Partners and Coatue.

Watch the video: Kabir Barday, CEO and Blake Brannon, CTO, discuss OneTrust’s growth to a $5.1 billion-valued leader in privacy, security, and governance

OneTrust’s technology sits as the epicenter of trust for organizations, enabling strong privacy, security, data governance, and ethics and compliance practices that underpin their digital transformation. As organizations strive for increasing levels of efficiency and agility in their transformation journey, they are looking for a platform approach to managing privacy, security, and governance requirements across an increasingly complex regulatory environment.

Today, 7,500 organizations, including more than half of the Fortune 500, use OneTrust’s technology to comply with the world’s privacy, security, and compliance requirements, including GDPR, CCPA, LGPD, ISO 27001, NIST, DOJ Guidelines, and hundreds of other laws and frameworks. The list of regulations an organization must comply with continues to rise. In 2020, sweeping privacy laws came into effect in California, Brazil, and others, and Gartner predicts 65% of the world’s population will be covered under modern privacy regulations by 2023, compared to just 10% today.

OneTrust has pioneered a true platform approach to trust with its modular products that are built on a single code-base and have been awarded 130 patents. Product offerings include:

  • OneTrust Privacy – Privacy Management Software 
  • OneTrust DataDiscovery™ – AI-Powered Discovery and Classification 
  • OneTrust DataGovernance™ – Data Intelligence Software
  • OneTrust Vendorpedia™ – Third-Party Risk Exchange 
  • OneTrust GRC – Integrated Risk Management Software 
  • OneTrust Ethics – Ethics and Compliance Software 
  • OneTrust PreferenceChoice™ – Consent and Preference Management Software 

In less than 18 months, OneTrust raised $710 million in funding. Since its founding in 2016, OneTrust has grown to the largest and most widely used privacy, security, and governance technology and achieved the #1 spot on the 2020 Inc. 500 list of fastest-growing private companies.

“OneTrust is leading the market outright and showing no signs of slowing down or stopping,” said Ryan O’Leary, senior research analyst, Legal, Risk, and Compliance at IDC in the report: Market Share Worldwide Data Privacy Management Software Market Shares, 2019: OneTrust Dominates the Competition. Other key analyst recognition includes:

“Our mission is to build the technology platform that creates the trust fabric of an organization, while addressing the hundreds of privacy, security, and compliance requirements they are faced with today,” said Kabir Barday, OneTrust CEO and Fellow of Information Privacy. “We were excited when TCV approached us for an investment. Even with most of our previously raised funds still available, their partnership allows us to further accelerate our mission, leverage our capital and currency to drive organic and inorganic growth, and deliver for our customers and partners long term.”

“Consumers and regulators are demanding that every company on the planet comply with complex and ever evolving privacy regulations,” said Tim McAdam, General Partner at TCV. “There are hundreds of regulatory initiatives in the works emanating from all major countries. OneTrust has emerged as the runaway SaaS leader in the trust and privacy arena. Kabir and his team have built the only truly global privacy platform allowing companies at any stage or size to own their privacy initiatives and remain compliant. TCV is honored to partner with such a rapidly growing and category-defining company led by an outstanding team of innovators.”

For information or to request a demo, visit OneTrust.com

OneTrust, OneTrust DataDiscovery, OneTrust DataGovernance, and OneTrust PreferenceChoice are registered trademarks or trademarks of OneTrust LLC or its subsidiaries in the United States and other jurisdictions.

About OneTrust
OneTrust is the #1 fastest growing and most widely used technology platform to help organizations be more trusted, and operationalize privacy, security, data governance, and ethics and compliance programs. More than 7,500 customers, including half of the Fortune 500, use OneTrust to build integrated programs that comply with the GDPR, CCPA, LGPD, ISO 27001, NIST, DOJ Guidelines, and hundreds of other laws and frameworks.

The OneTrust platform is powered by the OneTrust Athena™ AI and robotic automation engine, and our offerings include:  

  • OneTrust Privacy – Privacy Management Software 
  • OneTrust DataDiscovery™ – AI-Powered Discovery and Classification 
  • OneTrust DataGovernance™ – Data Intelligence Software
  • OneTrust Vendorpedia™ – Third-Party Risk Exchange 
  • OneTrust GRC – Integrated Risk Management Software 
  • OneTrust Ethics – Ethics and Compliance Software 
  • OneTrust PreferenceChoice™ – Consent and Preference Management Software 

Be a More Trusted Organization™. To learn more, visit OneTrust.com or connect on LinkedIn and Twitter

About TCV
Founded in 1995, TCV provides capital to growth-stage private and public companies in the technology industry. TCV has invested over $14 billion in leading technology companies and has helped guide CEOs through more than 125 IPOs and strategic acquisitions.

TCV’s software investments include Alarm.com, Altiris, Ariba, Avalara, ExactTarget, ETQ, FinancialForce, Genesys, IQMS, OSIsoft, Oversight, Silver Peak, Sitecore, SMT, Splunk, Vectra, and many more. TCV is headquartered in Menlo Park, California, with offices in New York and London. For more information about TCV, including a complete list of TCV investments, please visit http://www.tcv.com.

1IDC, Worldwide Data Privacy Management Software Market Shares, 2019: OneTrust Dominates the Competition, Doc # US46214219, April 2020

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Media Contacts
Gabrielle Ferree, OneTrust
+1 770-294-4668

Katja Gagen, TCV
+1 415 690 6689


Is the Cloud Safe? – The View from Vectra on Reducing Business Risk as Enterprises Aggressively Move to the Public Cloud

Digital transformation is driving enterprises to rapidly enter the next chapter of cloud adoption. Nearly half of current infrastructure-as-a-service Enterprise users are running production applications on public cloud infrastructure. As such, organizations are acutely focused on dynamic scaling, 24×7 availability, streamlined management and development tools to make the migration seamless…yet, security seems to be an afterthought or maybe just assumed to be “locked down” given that the bulk of workloads are at Amazon Web Services, Microsoft Azure or Google Cloud. Given the brands and heft of these mega tech companies, how can these clouds possibly not be secure?

Recent high-profile breaches demonstrate that there are inherent risks in the public cloud. In fact, just moving workloads to these branded cloud providers does NOT make them more secure at all.  It’s clear that enterprises must ensure their security stack is properly architected for the cloud. The recent Capital One breach was a shock to the system.

In the case of Capital One, a combination of a tech savvy team and AWS were breached by vulnerabilities that were known and could have been avoided. Does that mean it’s inherently risky to migrate to the cloud? Probably not, but it is clear we need better tools and processes to make this migration secure, scalable and cost-effective.

In this podcast, TCV’s Tim McAdam and Vectra CEO, Hitesh Sheth, talk about what it takes to reduce business risk in the cloud – and keeping enterprises, consumers and their transactions/interactions secure – while capitalizing on the tremendous opportunities the cloud offers.

For these insights and more, settle back and press play.


Tim McAdam: Welcome to Growth Journeys, a podcast series from TCV, focused on lessons from the field from entrepreneurs in the TCV ecosystem. I’m Tim McAdam, General Partner at TCV, and I’m here with Hitesh Sheth, CEO of Vectra, a leader in applying artificial intelligence to detect and respond in real time to cyberattacks in the cloud, data center, and enterprise infrastructures. Hitesh brings a wealth of experience from senior roles at Aruba, Juniper, and Cisco, that affords him important lessons about how enterprises can assess and address security as they migrate workloads to the cloud. These lessons include views on encryption, 5G, and commingled log data, to name a few. We’re covering all these topics today, but first, thanks for joining me, Hitesh, and welcome to Growth Journeys.

Hitesh Sheth: Great to be here, Tim. Thank you for having me.

Tim McAdam: So, let’s start with a relatively simple one, but probably complicated in its scope. What’s the general state of cloud security today?

Hitesh Sheth: Cloud security today is, in my view, where Windows used to be circa 1990s. If you go back in time a couple of decades when Windows started to proliferate, security was really not the first thing that Microsoft thought about. And at that time, it looked like a pretty complex setup with multiple operating system versions, different devices on which Windows was getting deployed, and it felt like it was an endless opportunity for attackers to leverage.

Now, fast forward to today, and if you look at the cloud environment, whether you’re dealing with serverless computing, whether you’re looking at Kubernetes, none of the technologies that are being built for the cloud have had security at the front end, and by comparison we have a thousand-fold more complex scenario than we had when Windows started prevailing from a security point of view.

So, I think the scenario we have right now is that while cloud is taking off exponentially, the security holes that we are facing are indeed very profound.

Tim McAdam: And how do you think enterprises should approach assessing their security vulnerabilities as they migrate these workloads to the cloud?

Hitesh Sheth: One of the most important things that they should think about very carefully is that whatever strategy they had in place in their traditional on-prem networks is not the strategy they should deploy into the cloud. And a good example would be – you think of perimeters when you think of on-prem networks. So traditional firewalls tend to be the way you think about security. That already is disappearing in traditional networks, and that certainly cannot apply when you’re looking at cloud infrastructure.

Now, I think Gartner has come out with a very good synthesis of how to think about building visibility for next-generation SOCs and they’ve got this thing called the Triad, and the Triad has three components to it. There is a SIEM in it. There is NDR, which is network detect and response. And there is endpoint detect and response, EDR. And logically, if you have those three technologies in place, then you have the best shot at delivering comprehensive visibility for the SOC. And the good news there, is that it is independent of whether you’re in the cloud or on on-prem networks as well.

Tim McAdam: Right. And just for the audience, could you define what a SIEM is?

Hitesh Sheth: Absolutely. SIEM is security information and event management systems. A vendor example here would be Splunk. When you’re looking at EDR, a vendor example would be CrowdStrike. And then certainly when it comes to NDR, Vectra would be the example in mind.

Tim McAdam: Perfect. So, talk about encryption for a second and what role encryption will play in securing workloads. And I think there are probably some schools of thought that say, “Why do you need any of this stuff if our data’s encrypted?”

Hitesh Sheth: Correct. So, I think there’s good news and bad news in encryption. Let me start with the good news. The good news is that you can indeed encrypt the traffic from say, the endpoint to the edge of the infrastructure, or to the SaaS application. And so, in theory, you are reducing the opportunities for a hacker to break into that workload or into the payload and initiate a cyberattack. So that’s the good news.

However, the reality is that whether you’re dealing with data centers or you’re dealing with cloud infrastructure, the number of times where the traffic’s going to get encrypted post the edge of the cloud or the data center tends to be very, very limited. And therefore, you have the need to still continuously monitor the inside of the data center or the inside of the cloud for tracking advance attacks. That’s number one.

But number two what is also probably not fully appreciated is that encryption is actually a friend for attackers. So, if your device is compromised, Tim, and then your traffic is encrypted from your device to the SaaS application, then if I’m the hacker, the chances that somebody’s going to pick me up really get diminished. Therefore, you know, logically the only way you can really find those attacks is by looking at the behavior of your device and how you’re interacting with the application. Therefore, behavioral approaches become really essential in this scenario.

Tim McAdam: Right. And that begs the question – that might be a device-specific viewpoint. But how about the data itself? Obviously, multi-tenant cloud applications have effectively commingled log data or log data from multiple customers. Is that a limitation or security risk as enterprises move their workloads to the cloud, and how do enterprises gain comfort that the integrity of their data will remain intact as they move workloads to the cloud?

Hitesh Sheth: The reason logs get commingled in the cloud environment – I’ll come back to the point I made earlier. Security is an afterthought in the scenario. The primary objective of doing that is to add efficiency to IT ops. That is the reason why they do that. For a customer, who is adopting cloud services, you have to reconsider the Triad that I described earlier. You have to have a SIEM. You can take this commingled log data and you can have this centralized in one place for analysis purposes.

But, what is really crucial is that you don’t rely on that by itself. You have to use network detect and response. You have to use endpoint detect and response. And so, the whole point of that Triad is to give you coverage in scenarios like the one you just described.

Tim McAdam: Got it. That makes sense. How about trends around next-gen communications like 5G, for example, and then this whole mindset of zero trust? How do you see these newer trends enhancing, or frankly, causing security issues?

Hitesh Sheth: The benefit of 5G is that we, as users, can bypass traditional networks, and with our devices – whether it’s a phone or a tablet – you can go straight to the cloud and order the SaaS application. You don’t have to worry about your traditional network and the security therein. Which is great.

Now, the challenge with that is that you have just now opened up a direct path into the data without any intermediary layers. So, this is where zero trust is supposed to come in.

Zero trust is supposed to introduce the notion that unless every device is authenticated, it should not be trusted. But frankly, it’s a very simplistic view of security because it essentially says, if Tim on Tim’s phone is authenticated, then Tim and Tim’s device are now automatically safe. But what if somebody stole your credentials? And that happens on a daily basis, as we know. And, therefore, it is not enough to rely on something like zero trust.

You have got to have the right monitoring principles in place in the cloud itself to ensure that if your credentials are stolen on one end, you’ve got the right mechanisms to watch for the behavior of the privileged user in the cloud.

Tim McAdam: Got it. So, let’s talk about responsibility for a second. I recently read a Gartner report that was talking about degrees of hand-off points from infrastructure as a service providers, to platform as a service providers, to SaaS providers. How do you think about this shared responsibility continuum, and do you see this security responsibility changing over time?

Hitesh Sheth: First of all, I think a lot of companies make the mistake of thinking that the security responsibility is solely the cloud provider’s responsibility. And I think that mistake originates from consumers of SaaS applications.

If you are consuming Salesforce, as an example, I think it’s very reasonable to expect that Salesforce has taken care of your security requirements. In theory, that’s generally true. However, if you are the entity that is actually deploying your applications into the cloud environment, having that expectation that AWS, Microsoft, Google, have done the same thing is fundamentally not true.

At the end of the day, the company that’s utilizing cloud resources is responsible for the security of the network layer, the data on top of that, the applications, and how people are interacting with those applications. That responsibility solely resides with the entity that is using those services. And I think even as cloud providers evolve their security offerings, it would be a mistake for consumers of those offerings to relinquish their responsibility back to the cloud provider.

Tim McAdam: So, Hitesh, you can’t pick up the paper today without reading headlines about the shortage of qualified cybersecurity talent relative to the size of the problem. This is a massive issue. Why haven’t more cybersecurity companies adopted an AI/ML framework like Vectra’s given the obvious dearth of humans in the sector?

Hitesh Sheth: I actually think, Tim, that a lot of security vendors are talking about AI today. It’s become one of the pain points for customers, where AI has evolved into a buzzword from vendors, and they talk about it all the time.

The issue fundamentally is that the vendors are approaching this completely wrong, in my view. Even for investors, as they think about investing in companies that are touting AI, the principle of generalized AI simply does not work. Generalized AI equals a human being. And AI is not advanced enough, from a software point of view, to repeat what a human being would do in technology. So, the notion of applied AI is really key here. Applied AI does work as evidenced from the work that we do at Vectra.

And I think the key there is you cannot just take AI by itself. If it’s application-specific, then domain becomes very critical. And one of the early epiphanies that we had in our journey here is that as we experimented with generalized AI, and frankly we made mistakes with that. And what struck us very quickly was that, “Hey, you need security domain, you’ve got to have security domain paired up with AI for this to work.” If I’m a customer, I would be testing for that every single day before accepting a vendor’s word that their tech is actually going to work in my environment. Otherwise, it’s the person behind the curtain actually doing the work, not the software.

Tim McAdam: Right. Well, thank you for making all those generalized AI mistakes before we invested, Hitesh.

Hitesh Sheth: And, yes, we did that in the first few years, Tim, as you know well, but if you don’t make mistakes, you don’t learn. And we are much better off as a result.

Tim McAdam: So lastly, at a recent offsite, one of my partners floated the concept of via negativa, or addition by subtraction, as it related to our business model as investors. That is to say, focus on fewer, more high-impact investment themes or investment types by not focusing on others. Hitesh, should via negativa apply to streamlining the security posture of enterprises as they think about moving to the cloud?

Hitesh Sheth: I think it’s an absolutely fantastic principle for how you think about where you invest in infrastructure broadly and certainly in security, because as we all know, security is rife with a plethora of technologies and vendors pitching the next-greatest tool to customers every single day. Yet, paradigms have evolved very, very rapidly.

So for example, if I am building something from ground up, a customer should ask themselves, why do they really need a firewall? For what purpose? If I have EDR on my endpoint, if I have the right setup for monitoring my workloads in the cloud, what role does a firewall really play? What role does a perimeter play? If you want to save your dollars, OpEx or CapEx, I’ll put something bold out there and say, eliminate the firewall. I would challenge somebody to do that. And then provided they are actually following the SOC Triad – be religious about implementing the SOC Triad.

Do that first and then question the need for spend on anything else next. That’s the approach – that’s how via negativa can apply to security spend.

Tim McAdam: That is bold. I like it. Hitesh, thanks for joining us today.

Hitesh Sheth: Thanks very much, Tim, really appreciate it.


The views and opinions expressed are those of the speakers and do not necessarily reflect those of TCMI, Inc. or its affiliates (“TCV”). TCV has not verified the accuracy of any statements by the speakers and disclaims any responsibility therefor. This blog post is not an offer to sell or the solicitation of an offer to purchase an interest in any private fund managed or sponsored by TCV or any of the securities of any company discussed. The TCV portfolio companies identified above, if any, are not necessarily representative of all TCV investments, and no assumption should be made that the investments identified were or will be profitable. For a complete list of TCV investments, please visit www.tcv.com/all-companies/. For additional important disclaimers regarding this document, please see “Informational Purposes Only” in the Terms of Use for TCV’s website, available at http://www.tcv.com/terms-of-use/.

Vectra raises $100 million led by TCV to secure the cloud using network threat detection and response

SAN JOSE, Calif., June 10, 2019 /PRNewswire/ — Vectra, the leader in network threat detection and response (NDR), today closed a $100 million round of funding led by TCV, one of the largest growth equity firms backing private and public technology companies. Existing investors also participated in the funding round, bringing the company’s total funding to date to more than $200 million.

Vectra will use the investment to accelerate global market expansion and R&D innovation, solidifying its Cognito platform as the market-leading solution for artificial intelligence (AI)-driven cloud security using NDR.

The cloud has critical security gaps that leave organizations vulnerable. Cyberattackers take advantage of these gaps without leaving a trail of evidence. Underscoring this risk, a recent survey by the SANS Institute found that one in five businesses had serious unauthorized access to their cloud environments this past year alone, and many more were unknowingly breached.

The Cognito platform addresses these security gaps by providing 360-degree visibility into cloud, data center, user and internet-of-things (IoT) infrastructure, leaving attackers with nowhere to hide.

“TCV has an extensive track record of partnering with enterprise security companies, including Rapid7 and Splunk, from growth stage to public,” said Tim McAdam, general partner at TCV and a member of the Vectra board of directors. “In our research on the category, it became clear to us that Vectra was rapidly gaining momentum with customers by rethinking the way enterprises view both network and cloud security. The Vectra Cognito platform is poised to become requisite in the security infrastructure of multinational enterprises and midsize businesses alike.”

“The cloud has inherent security blind spots, making it imperative to eliminate cyber-risks as enterprises move their business to the cloud,” said Hitesh Sheth, president and chief executive officer at Vectra. “The Cognito platform enables them to stop hidden cyberattacks in the cloud. We look forward to partnering with TCV and our existing investors as we continue our rapid growth.”

Vectra experienced 104% growth in annual recurring revenue in 2018 compared to 2017. The company will continue to ramp up initiatives aimed at addressing the global deficit in cloud security, innovating on its existing platform and expanding its global customer base.

Cloud Security Solutions Forecast, 2018 to 2023” by Forrester Research, Inc.

About Vectra
Vectra® is the leader in network detection and response – from cloud and data center workloads to user and IoT devices. Its Cognito® platform accelerates threat detection and investigation using AI to enrich network metadata it collects and stores with the right context to detect, hunt and investigate known and unknown threats in real time. Vectra offers three applications on the Cognito platform to address high-priority use cases. Cognito Stream sends security-enriched metadata to data lakes and SIEMs. Cognito Recall is a cloud-based application to store and investigate threats in enriched metadata. And Cognito Detect uses AI to reveal and prioritize hidden and unknown attackers at speed. For more information, visit vectra.ai.

About TCV
Founded in 1995, TCV provides capital to growth-stage private and public companies in the technology industry. Since inception, TCV has raised over $15 billion in capital and has helped guide CEOs through more than 120 IPOs and strategic acquisitions. TCV’s investments include Airbnb, Altiris, AxiomSL, Dollar Shave Club, EmbanetCompass, EtQ, ExactTarget, Expedia, Facebook, Fandango, GoDaddy, HomeAway, LinkedIn, Netflix, OSIsoft, Rapid7, Rent the Runway, Sitecore, Splunk, Spotify, Varsity Tutors, Webroot, and Zillow. TCV is headquartered in Menlo Park, California, with offices in New York and London. For more information about TCV, including a complete list of TCV investments, visit https://www.tcv.com.

Media contacts
John Kreuzer
Lumina Communications for Vectra

Katja Gagen
415 690 6689


Related Links


From Startup to Global Scale: Securing and Building the Company’s Culture Are Keys to Success of Tech Leaders

The days when technology chiefs could focus simply on hardware and software are gone. For technology leaders, aligning IT with long-term strategy and attracting and nurturing a winning team has become key in a world where customer expectations are growing, and the pace of change continues to accelerate.

Today’s technology businesses need to think strategically at the local, national, and global level. Many companies run business online or mobile first and are getting creative and competitive advantages from collecting and analyzing consumer data. This provides both opportunities and challenges: on one hand, companies can get access to global customers fast, yet they are also facing competitors both at home and abroad, not to mention threat actors who could be located anywhere and can come at you with sophisticated attacks. It’s your talent against theirs – with your enterprise and your customers in the middle.

At TCV, we’ve been focused on talent and culture as critical success factors for more than 20 years. Many of our investments have turned on building or sustaining successful cultures and nurturing them with the right people. For this year’s invitation only CTO/CIO Summit we decided to look at talent and culture together with the challenges of globalizing and securing the enterprise. We brought together over 40 technology executives, including founders, product leaders, TCV partners, and — of course — CTOs and CIOs, in Half Moon Bay, CA, for an opportunity to build peer relationships, learn from shared experiences, and discuss top-of-mind issues facing these leaders. We also mixed up the “talent” for the event itself, drawing not only on working CTOs and CIOs but also career IT experts with consulting and investing experience across multiple industries.

For us, the most important part of the two-day event was gaining a deeper understanding of both the challenges and opportunities technology executives need to balance, including:

  • Winning the Talent Wars and Creating a Winning Culture
  • Building a Globally Distributed Organization
  • Privacy and Identity Initiatives and Securing the Enterprise
  • Our agenda centered around best practices in scaling a global organization. Other topics we discussed included how to integrate acquisitions and best practices in managing a global workforce.

Here are the highlights:

Over dinner, Zillow CTO Dave Beitel spoke about how technology has transformed the real estate industry. Dave joined Zillow in 2005 and has seen the company grow, both organically and with 13 acquisitions in the last 12 years. Dave explained the importance of creating a strong culture across multiple locations and laying out paths to career development to motivate teams as organizations scale. He also provided advice on a common challenge that many growing companies face, particularly how to integrate offshore teams and make them an extension of existing efforts rather than adjacent resources. He also discussed with the group how to achieve success in scale with multiple office locations and different cultural identities.

Tim McAdam led the next day’s first panel with Victoria Schillinger, VP of HR at Alarm.com; Caroline Horn, Partner at Andreessen Horowitz; Michael Morell, Managing Partner at Riviera Partners; and Jonathan Schoonmaker, SVP of HR at FinancialForce. Their topic: winning the talent wars against today’s tech giants. The practical tips flowed freely, starting with university recruiting. Pick a few schools and work them, including both Ivy League schools and state colleges. Build relationships with influential faculty. Introduce your brand to younger students, not just seniors. When they become interns, give them meat to work on, not crumbs – having an impact is what they value most. If they turn down an offer, wait 2-3 years and call again – they may not be having the impact they expected at that big company they chose. Retaining key talent has to be proactive. Sit people down and map out how they will develop themselves and increase their impact by staying with you. Give them management opportunities so they can imagine themselves as leaders. Don’t expect diversity to walk in the door — look for talented, highly motivated people who come from completely different fields such as law or the military. And finally, the 90 days after a new hire starts are more important than the 90 days spent hiring them. Set them up for quick wins, build in plenty of touch-points, and make sure they’re comfortable in the culture.

Ted Coons continued the conversation with a focus on talent and culture, talking with Kameron Kordestani, a partner at McKinsey & Company, and Otto Berkes, CTO of CA Technologies, about building a globally distributed company. Both speakers separated the “artifacts” of culture – posters, slogans, logos – from its essence: ways of working that make the organization succeed. People who embody those essentials should be made ambassadors to new acquisitions or newly built development centers, so that people new to your culture can experience it live. When new team members absorb it, they should be given broader responsibilities in the combined company – this leverages their talent and inspires their original team. Particularly after M&A, the acquired team needs to understand its role and contribution to the combined entity; this should happen quickly and positively. Pay for travel if you can; people in far-flung organizations form bonds faster when they meet in person. Both Otto and Kam warned against sticking too closely to integration playbooks, particularly when the acquired technology is new or different. Sometimes a talent-rich team should not be integrated rapidly. Don’t compromise on security or safety but take time to observe how they work before you impose on a new team – the last thing you want to do is spoil an acquisition by how you integrate it.

TCV EIR Jonathan Shottan, Manmeet Singh, Co-founder and CEO of Dataguise and Pablo Jensen, CTO of Sportradar pulled back the curtain on Europe’s General Data Protection Regulation (GDPR) and California’s new privacy laws. Simply put, GPDR is about What, Where and Why: What private data do you have? Where is private data stored? Why do you need to process that private data? Both the compliance challenge and market opportunity of the new regulations are huge and what unites them is the challenge of identifying the vulnerabilities. Many companies mistakenly believe they are compliant, because they encrypt and segregate various types of customer data physically or in the cloud; but when they bring data types together for analysis, they create “PII” – personally identifiable information. The new laws also require companies to delete data if customers demand it, but that’s likely to create havoc with legacy database applications built on relational technology. And how do you delete older data stored on physical media? Enter data masking, at production scale, to stand in for deletion and encryption. First movers — with enough IT spend on decoupling, segregating, and masking data — may even competitively enhance their brands as “more secure” than others.

After lunch, Ted Coons and Charles Beadnall, CTO of GoDaddy, delved into the transformation of GoDaddy’s culture, a process that started back in 2013. Engineers loved the company’s mission of providing small businesses with a home on the internet, but deterrents included fly-over geography, aging facilities and sensationalist marketing. With a new CEO – and marketing campaign – GoDaddy began recruiting heavily. The challenge was forming a new culture that welcomed both existing employees and a flood of new developers in ways that produced better products, faster. Charles employed a version of the 80/20 rule: if he could populate 20% of a department with more diverse people who modeled the right behaviors, they would tip over the rest. The company hired people based on referrals, recruited many female graduates from local universities and placed experienced diverse hires in senior IT roles. Charles also drew in Ph.D.s from MIT and spent time with teams around the globe to transform a culture while keeping the company focused on growth.

Matt Robinson led the day’s final session on securing the enterprise with Amir Ben-Efraim, co-founder and CEO of Menlo Security; Rob Fry, VP of Engineering at JASK; Robert West, Managing Director at Deloitte LLP; and Christian McCarrick, VP of Engineering at Auth0. Matt first asked the panel how CIOs and CTOs should differentiate among today’s legions of security providers. Recommendations included assessing your vulnerabilities so you’re asking the right questions, getting referrals from peers, and anticipating the inevitable consolidation among security providers. Not every company needs an industry giant – those companies were startups once, and today’s upstarts may have superior technology. The panel then discussed prioritizing among today’s proliferating threats. Getting governance in place is critical – if no one fully owns the security portfolio, priorities will be set for the wrong reasons. If the role falls to you as CTO or CIO, you must be (or become) a good storyteller to convey the threats to your company and build consensus on addressing them. It’s also vital to recognize that malware will get inside your systems, but it won’t be the end of the world if you’re prepared. Ultimately the biggest weakness of all security systems is the human element. Education and training are essential and need to be on the agenda regularly. In addition, Amir argued that companies should hold vendors to a higher standard, aiming to receive 100% efficacy to keep companies protected.

We are grateful for all the valuable insights our speakers shared with attendees and the TCV community we strive to create. We look forward to exploring new topics and connections during our next TCV event.



The views and opinions expressed are those of the CTO/CIO Summit speakers and do not necessarily reflect those of TCMI, Inc. or its affiliates (“TCV”).  This summary is not an offer to sell or the solicitation of an offer to purchase an interest in any private fund managed or sponsored by TCV or any of the securities of any company discussed.  Not all companies discussed above are TCV portfolio companies.  Any TCV portfolio companies discussed above are not necessarily representative of all TCV investments, and no assumption should be made that the investments identified were or will be profitable. For a complete list of TCV investments, please visit www.tcv.com/all-companies/.  For additional important disclaimers regarding this document, please see “Informational Purposes Only” in the Terms of Use for TCV’s website, available at http://www.tcv.com/terms-of-use/.