Building Action1: Mike Walters on Patch Management, AI Vibe Coding, and the Power of Focus

Speaker A: We're in this cyber arms race situation where the enemy is getting better and better, right? When you're in a war, in a warfare situation, and you're still using cavalry and horses, your enemy is using tanks. You can't fight them using horses.

Speaker B: Welcome to Cult Products, a podcast by Yaya Digital. I'm your host, Phil Keeney Bolland, and on this show we sit down with the founders and leaders shaping the next wave of cybersecurity innovation. You'll hear the stories behind how they found their first customers, defined what made them different, and built products that earned

Speaker C: a loyal following in one of the

Speaker B: toughest markets on earth.

Speaker C: Uh, let's dive in. Hi everyone. Welcome to another episode of the Occult Products Podcast. Today I am joined by Mike Walters of Action 1. Hi, Mike, welcome to the show.

Speaker A: Hey, Phil, glad to be here. Thanks for having me.

Speaker C: Thank you for coming on. Really looking forward to chat today. Before we get into the discussion, it might be good to just tell everybody a little bit about Action One and what it is that you do there, please.

Speaker A: We are a cloud native endpoint management company. So what we do is when you run, no matter how big your company is, whether It's a small IT shop with, um, 10 people with 10 laptops working, ah, spread out around the world, or, uh, large corporation with a million people working in hundreds of offices, what we do is we automate everything that happens on your endpoints, whether it's laptops, workstations, and specifically, the biggest challenge we tackle is patch management, deploying patches at scale when critical vulnerabilities arise. And we fully automate the process. And what we help with is we reduce the time and in many cases completely, uh, remove the time, give it back to you, which you would otherwise spend on doing this routine activity. And everybody has to do it because if you don't patch your computers, you sooner or later you become a victim of a, uh, security breach or a ransomware attack.

Speaker C: Sounds really interesting. Tell me a bit about, you know, where did it all start? How did you get into Cyber Security?

Speaker A: Almost 25 years ago, I would say this is my very first job. I was still a freshman's year of my college. Surprisingly, I was able to get a full time job. So I was mostly focused on doing the job, not so much on studying. And it helped me, gave me a lot of real world experience. And, uh, I worked for this company. It was a small company which was later acquired by a larger company called Quest Software. And that small company was founded by two guys, ah, just the whole story. Just looked incredible to me. I was one of their first employees. And then after a few years the company grew so large that it was acquired by Quest for over $100 million. I was just blown away, like, how is that even possible? And after spending a little bit over nine years overall at Quest, that uh, company combined, I just decided uh, maybe I should do something on my own. And my partner Alex, who joined me in this endeavor. Why don't we try? We're not going to build anything as big as that. We thought it was just impossible. Let's just do what Quest did, which stay focused on the same type of buyer, which is an IT professional and cater to the needs of solving specific, specific pains. Right. There's always specific pains you can pick and if you address them really well, people are willing to pay just to solve this. And that's what we did when we created, uh, our first startup called netwerx, which initially just, we had no particular idea. We just said, all right, let's just create a bunch of admin tools and see what clicks.

Speaker C: Interesting that you didn't start off with a specific product in mind. It was I guess pretty um, exploratory at that stage. And in a sense, I guess you were kind of prototyping several different businesses at once and picking the one that performed best. Is that right?

Speaker A: Yeah, the approach, move fast, break things, iterate as quickly as possible before you end up focusing on one specific product. But what you have to do really as quickly as possible to pick that right product because you can't continue uh, working on uh, many different products at the same time because you lose the focus. So what we did is we had 20 different products and then uh, over probably the first three to four years we established this is a product that sells better than any others. Some others sold to, some didn't sell at all. So those were the, probably the first to get killed. But then eventually it was like three products and it's like, all right, third lowest selling, kill it. The second lowest selling was the most difficult to kill because I was already doing a few million dollars a year. But the number one was doing tens of millions of dollars a year. So the choice was obvious, but it was still very difficult to eat your own baby. But once we did this, this was the best decision we made because we put all the people working on that less performing product. We're put on working on this top seller and that just took off and became really, really successful. That was the story. It was a mistake. I wouldn't advise anyone to do this to many. But, uh, both Alex and I are software developers by trade, so we just love coding. So most of those products were done overnight. So it's pretty much 20 nights spent anyway. Once at some point we just said, all right, no, you can't do this many. It's fun, it's cool, but you have to focus. And then eventually just decided to sell it to private equity firm and took a very quick break, embarked on our new adventure, which is this new company Action 1 I think the biggest one was the lack of focus. We didn't create 20 products this time, but I think what happened is we spent, we spent too much time going too broad on the platform capabilities than we should have because we, at some point we just realized, okay, there's only five use cases in endpoint management that are the top, like the 80%, the 80, 20 rule, right? So 80% of customers want only 20% of the functionality. So that 20% of the functionality is only probably five features. And even within that 20%, again there's 80%. So what we realized that patching was that 80% of the 80% which we uh, actually needed to focus initially. This is what so many people are asking about. But what was counterintuitive to us is it's a very old category. It's a very old unsexy category that's been in existence for decades and decades and decades. All right, well, should we be reinventing the wheel again for 100th time? We had that feeling. But what we realized is no, the wheel does need reinvention because it's still a major problem.

Speaker C: So you, second time around, as you sort of alluded to, there's probably a lot of things that you would think will do this differently. When you were sat in that break between the two businesses and you were planning out what your next move was going to be, what would you say the top things that you wanted to do differently this time around were?

Speaker A: The first company, we didn't have any experience other than software development, so we knew how to code, but we uh, had no idea about this. How to create a sales organization, how to market products, how to run operations, all of those aspects of a business. Still, the product is the most important thing. So if you have a great product and you know the go to market strategy for it, how to market it, then the rest comes naturally. It's just a matter of, uh, execution. So you just need to hire with the right number of salespeople. You need to, uh, allocate enough marketing campaigns. And so this Time with this new company we just figured right. So we knew that the basics, we need to bring the right people early on. That's what we did, uh, really VP of sales early on to start building the sales organization and scale it proportionately. So we knew that, well, we can't have 50 sales people from day one because the products is just not there. Even if we had that many opportunities, we would not be able to close and the product doesn't all the features needed for a typical enterprise client which we're going after. So it's just um, a matter of knowing in advance what to expect and execute and scale appropriately. We have the experience to do that.

Speaker C: So you're coming back into today's uh, climate. Of course, everything is now massively dominated by the conversations around AI. How does it feel as a business founder, uh, now in this climate versus this time around?

Speaker A: I think it's a very interesting time to live. Probably never happened before. The pace of innovation. What's going on with the all the amazing things that people are building using AI agents. There's uh, AI VPs of marketing, AI VPs of engineering, like AI software engineers, AI accountants, like AI everything. And this AI native companies that are run by two founders and uh, 100 AI agents and no other humans. So those stories just sound surreal to me and time will tell like how successful some of them. There's a lot of hype going on around it, but I think what matters. And there's also these talks about SaaS apocalypse. Like all the the existing software companies are going to die. They will get replaced, but people are just going to vibe code everything. Like everything you need. You can just vibe code. Just open lovable or base 44 and just create it overnight, no matter how complex it is. You can replace Salesforce, you can replace Marketo, you can replace whatever you use currently and pay millions of dollars for it. You don't need it anymore. But at the same time people do that. Like a couple months ago I was flying out to Mexico for our corporate vac and sat next to a guy on the plane who showed me open his laptop and he said, oh. So I created this new CRM. I'm not a developer, I just vibe coded it. I just used Vibe coding tools and created the CRM again. Oh, show me that it looked better than Salesforce. Uh, it just was smoother than Salesforce. It was just amazing. Like, you know, how many problems did you issue to create it? I was like, yeah, maybe like 150. We run a software developer and it looks Better than Salesforce. Like wow.

Speaker B: Yeah.

Speaker A: If Salesforce should really be concerned about this type of things happening. But at the same time, if you like for a small business, yes. Maybe if you're trying to build something fully custom on um, the cheap. Well the thing I guess maybe not necessarily on the cheap because you have to pay for your AI tokens to build it. Then you have to pay for your infrastructure. I'm not sure about the comps. Cost may be the same but some people might do this. But some at the same time, some people like, uh, do you really want to build your own car out of a market? Yes, car enthusiasts do that. But most people just go to car dealership, buy a car as long as it's a for and does the thing.

Speaker C: I think everybody has their own take on this and a lot of it is down to, you know, your kind of philosophy or your belief how people are going to adapt to this world. Somebody who clearly understands their problem space really, really well is now able to build the exact tool that they need without needing to raise money for end tools. With no coding experience, working in cybersecurity, having the kind of conversations that we have, we know there are lots of things that you have to think about constantly in order to avoid risk. Things that owners of the SaaS platforms have been thinking about themselves constantly and implementing within products. So that for lots of people, small businesses in particular, they haven't really had

Speaker A: to think about these things before because it's non deterministic. Right. It's like it's right. A lot of times it gets it right but what happens gets it wrong and then it's something exactly.

Speaker C: And, and it looks so good and feels so good to do it but really you don't have a good way necessarily of knowing if the foundations that it's built on are uh, strong. And this could be, you know, companies with thousands of people and potentially if their security is super tight, thousands of people all building new ways to expose the business. That stuff is really scary. I imagine those are the kind of conversations you'll be having with, with customers day to day. Right. Like this is the biggest issue I guess that we're facing right now in cybersecurity.

Speaker A: There's a lot of marketing hype going around. Anthropic's Mythos LLM and the way it was announced as privately available to only a select number of cybersecurity companies. At the same time there's ah, this mixed, mixed report so far about that. So I think many people say it's Just a gradual improvement over the previous model. The rest is just great marketing because Dario is a marketing visionary. He's a great founder. That people say that he is the second greatest founder in human history after Elon. That's, that's what people really say about oh, it's second. This opinion probably took it from, from obscurity being second to really being tied as OpenAI. OpenAI now catching up to that. Right. So the released GPT, uh, 5.4 cyber, uh, to counter response, it's not exactly the same but it's. They're trying to basically catch up and counter the competitive threat. But I think what matters in general is yes, the weapons, uh, your adversary can use are getting more and more advanced. It's worm this cyber arms race situation where the enemy is getting better and better. When you're in a war, in a warfare situation and you're still using cavalry and horses, your people are, you know, horse mountain warriors. Your enemy is using tanks, you can't fight them using horses. You have to start using tanks as well. For any platforms, for any, any systems that manage especially platforms like Action One, because what makes us that situation potentially because we run our end to end Agents. Not uh, confused with AI agents because the term agents is now being like really used towards AI. But pre AI, the definition of an agent is something that runs directly on your computer. So a little piece of software that reports to you, you know, to the main system. Like so, so for example, like it takes commands for patch this reporting this is what Action One is built on. So that when it patches it just issues commands to patch all of your million endpoints or whatever the number you have. And the biggest threat is what if somebody hacks Action1 Cloud and takes over and converts the entire Action1 infrastructure into a command and control center. This is, this is like the worst nightmare. Any vendor runs code on the customer systems. It's prone to this kind of attack. When attackers are armed with tools like Mythos, it gets really dangerous because they want we can dig into how your system operates found, find all those ins and outs and take advantage of that. And if you're not prepared for this type of onslaught of automated AI powered hacking, that that can lead to a very dangerous outcome.

Speaker C: Do you have a sense, I know there's a lot of hype and marketing around Mythos, but do you have a sense of how prepared are we really for like this next jump?

Speaker A: I think very unprepared. Most vendors are completely unprepared these days. In the last few months, what I think if the vendor you're using for anything is still releasing functions and features like user facing features, instead of working on improving their security posture, uh, it's a disaster in the making. Everybody should stop working on any functional improvements. And instead of that, take a really close look at the security architecture, how the system is designed, uh, how to implement some basic measures like isolate components, uh, put some web application firewalls between your components, review your access levels, what employees internally have access to this. How can you make your customer data more protected and prevent the domino effect? Like one system gets attacked and taken advantage of. How do you prevent the lateral spread of the attack? And vibe coding is not helpful that, by the way. So the more stuff you vibe code, the further you are from that goal of actually thinking about scaring your systems.

Speaker C: And how does it. Keeping up with this stuff is challenging for everyone I think because it's just evolving so quickly and there's so much new stuff to learn and new threats, new things to worry about, new opportunities, new users coming in and using it all the time, new tools. What is the secret to actually staying safe in a world that's changing this quickly?

Speaker A: Some things have to change radically the way systems are architected. So the like in particular, what Action One, what we're working here at Action One is uh, this new architecture called Endpoint Takeover Prevention, or ETP for short. So what it does is it. So there's three components to it. So your endpoint, so like say your computer, so you're working on a laptop and Action One agent runs on that. Then there's Action One cloud that uh, it reports to, sends and receives commands from. And there's the administrator, the system administrator, some like say your IT guy who says okay, patch fills computer tonight. Now what if Action One clouds gets taken overnight? Nation state threat actor uses Mythos, takes uh, gets access to Mythos and just hacks Action One. What happens to your computer in a traditional architecture, uh, pretty much is done. It's a domino effect. Every single custom and every single endpoint at each of those customers is pretty much done. So they deploy ransomware, they do whatever they want with that. They have full control over everything. What we're doing with this Endpoint Takeover prevention architecture is we tell the customer to own the signing encryption key when they issue commands, when they create policies or automations to patch computers or do anything else, any other management activities, they sign it with their key, which they own, which never gets transferred to Action One cloud. So even a threat actors take advantage of Action One they will not see it. Even Action One employees cannot do it, Cannot see it. And when they do it. So they patch Phil's computer. Here's my signature. And when your computer, when the agent running on your computer receives that command, that checks. Okay, has John signed off on this? John the IT guy? If John's signature is forged, the agent running on your endpoint will just refuse that command and say, no, sorry, but I can't do this because you're not. Not. This is a very radical shift in the security architecture we're doing because now we assume that sooner or later our system will get hacked too, because there's, there's going to be something huge that'll come out publicly, maybe tomorrow, to hack into it and completely obliterate it. So we need to. It's. So it's not a question of if, it's a question of when. They still have time before it happens, but when it happens, we have an obligation to protect our customers, environment. We can't let that happen. And what I know is most vendors don't have anything, uh, like there's a few vendors that I know in the industry that are working on a similar or have something similar to this, but it's a tiny percentage of what it should be.

Speaker C: That in itself is a scary thought, but seems like, um, a very sensible position to take. On the flip side, you know, you think about Mythos, you think about all the innovation that's coming. One of the things that I'm encouraging a lot of the people that I speak to to think about is you need to have a strategy in place for how you differentiate from your competitors. You also need to have a strategy in place for how you differentiate from the large AI models, because there will be people, and maybe not today, but not too far in the future who will say, oh, why do I need to buy this? Can I just build it? Can I just tell the AI to spin up? Just take the transcript of this podcast, chop out that section, put it into Claude code and say, right, just build that in the future.

Speaker A: It might be possible, I think.

Speaker C: What's your take on cybersecurity as an industry and the future? And we're not just talking about this SaaS apocalypse, but are we all still going to be around in the next couple of years? Are, uh, people really going to, really going to start doing that? How do you see things unfolding from here?

Speaker A: A lot of people say it's the value of code, uh, is, uh, going close to zero these days. So what used to be, uh, called IP intellectual property, what your developers create years and years, those millions of lines of code that are super difficult to replicate. So this is a shrinking. So the time to recreate that is shrinking. Yeah, you can really, you just upload a product demo video to Claude and have it. Okay, make something similar, do the same, but better, faster. And then, uh, here's some additional thoughts that I have. But what matters is how great your distribution is to your distribution model. Your data gravity, what, what they call is like, how do you really. Is your system really a place where your customers come back to you and operate off and then, uh, things, other things like switching costs. If your system is so good that it's, it's practically impossible, even if a better competitor comes out and they offer a better product, better looking, sexier ui, anything working faster. But, uh, if it's expensive to switch because you have to migrate the data, then your customers are not going to switch. New customers, they might start looking and that is a better alternative. But at least you have the time to catch up and recreate it. So you maybe you have a year or two to say, all right, great, so they came up with this better model than ours. Let's just do it and then switch our customers over. Because we have the advantage of having this huge customer base that we uh, can just quickly, if you're able to turn around. So like, it's not always possible. These three things will matter a lot.

Speaker C: I think we're in a really interesting space because if I think about security is not an area where you can be like close to good enough. Maybe a CRM as an example is like, uh, it's not quite Salesforce, but It does like 90% of Salesforce. And it's a bit janky here. You can't say, yeah, you know, this security thing keeps me like 90% protected, but there's a 10% which could catastrophically explode my entire business. And so I think in a lot of cases it'll come down to more kind of emotive form of decision making. Logically, maybe you can build your own thing for your own specific business. And it might be really great, but it might also be better and mean that you can sleep easier at night to outsource that it's not cheap.

Speaker A: Yeah, because AI credits, AI tokens cost a lot of money. Like as you start ramping up your agent coding that you quickly realize that it gets expensive too fast. And then you also need people, qualified people to be able to set this up, uh, manage those agents. And then you have to Maintain you have the maintenance issue just like any. I think it's the same approach. Like yeah, you can always create your custom software, develop it in house or you can, you can go to a software vendor and buy it from the vendors and then have them worry about it. This ongoing maintenance, outages of uh, resource allocation, like your database ran out of space, you need to upgrade that, things like that. If you have a team of people and this desire to handle that, yeah of course you can do it. And some larger enterprises may choose this approach. Like if you're a JP Morgan, yeah you probably have 10, uh, thousand people working in your DevOps department and you're able to develop pretty much anything, you know, whether it's patch management or CRM or accounting system. Like uh, and probably that's what they do. Mid sized businesses, I don't think they do that. Most of them would prefer just going for something off the shelf. But, but the definition of off the shelf is going to change. It's going to be, become a lot more custom. So they say. Now they talk about headless systems. There's like system that does not have a ui, only has an agentic AI capable API like an MCP server, things similar. And when the first time you log into that system you just tell it like what are you to accomplish? What is my business goal? Oh like I want to patch every Saturday and I want to get a report for my boss showing how, how many systems get patched. If, if that's all you need, great. 30 seconds later it creates something that uses Action One API to just deliver it to you and you never actually open Action One ever again because it just worked. It just sends your boss that report and patches the systems and you can do the same with uh, with your CRM.

Speaker C: It's interesting to redefine it that way. I'm interested in um, your take on this. How are we going to make sure that we even still have experts in the future? Because right now we're in a space where everybody's kind of becoming a bit more of a generalist. And possibly most concerning, it's becoming increasingly difficult for new people, younger people mainly to get into lots of industries and work their way up and become expert in any given field really. How do you think we can maybe address some of that? How do we make sure that there is still plenty of opportunity out there for people to learn how to do things the right way?

Speaker A: My nephew, he just turned 15, he like, he does his uh, math homework using ChatGPT and asked and he could like you don't, do you even understand what's going on? Like you just, they just ask Chad GPT. It's always right. It's like, you know, it's not always right. It's like how are you going to know? Like what's the actually going on? Like what's, what are the algorithms that you like, what formulas that you need to use? So yeah, there's a problem. So people, especially younger people, they start trusting it too much and uh, not knowing the basics, the underlying basics. Well at the same time every innovation cycles comes with that. So the invention of the printing press or the whole story behind the Ludi movement, like you know people, lots of people are going to lose jobs. But we have to keep going forward. It's progress, it's evolution and there's going to be uh, bigger, wider concepts, more and more high level. It used to be uh, lamps and transistors, now chips backed with uh, billions of transistors. Nobody even knows like, like how to do this stuff. It's just a domain knowledge of a very narrow group of people compared to the overall human population. And I think something huge is happening these days as well. So a lot of the low level knowledge, you know, it might seem like it will get lost but at the same time a lot of uh, higher level, more developed knowledge will accumulate. And this is what we need to be teaching this newer generation is try to grasp it and try to be a part of that. So instead of uh, doing uh, some of the work manually, learn how to manage agents as they say. It's like that's the job of the future. Like stop using your hands. Like uh, your hands are your AI agents. No coding, no accounting, no support calls, no BDRs. Everything has to be done by agents. And your job is to define, create what uh, they call agent harnesses, how to control your agents so they don't use a million dollars worth of credits overnight and do something that's actually useful and productive. I think that it's going to be a major shift. Nobody really knows what's going to happen. It's changing so fast these days. It's the fastest pace of innovation we've ever seen in human history.

Speaker C: A good note to sort of end on is to look backwards and I like to ask all our guests the same question. Really. I'd like you to think back to when you started Action one. I'd like to think if you could go back and you could give yourself any piece of advice, something that you've learned over the years since Founding the business. What would your one piece of advice to your younger self?

Speaker A: Beautiful of focus again, going back to basics. Uh, this word focus. If I, if I had a time machine that could only pass like one word letters to my past self, this would be the word I would pass to myself. Find something you're really good at and laser focus on that. It applies to pretty much everything business in life. Because if you don't focus, use, produce yourself too thin and you never succeed. You can be successful, like probably not in history. Like you cannot, uh, have five, uh, Olympic gold medals in five different sports. You only get one right? Because you specialize in that. You spend your whole life, you become the best of the best in skiing or in swimming, but, but not in both. Never in both. Like it's, it's impossible. The only way to, to become highly successful is to, to be highly special specialized. That's. And that's the power. What power of focus gives you.

Speaker C: That's great advice, Mike. Thank you. Uh, I've really enjoyed having you on the show. It's been a great conversation. Thank you so much for joining today. Where can people find you? How can they get in touch with you?

Speaker A: Go to action1.com act1 is the number one action1.com and just learn about action1. It's uh, the beauty of action1 is you can sign up for free and use it for your first 200 endpoints at, without paying anything, no strings attached. Fully functional product. If you go over, there's a paid subscription, but only for the endpoints on top of the first 200. But it's a great product. It's an enterprise grade product that we give away at zero cost to all the small businesses and uh, uh, take advantage of that. It's great.

Speaker C: Amazing. Well, I'm sure we will get some interested people taking advantage of that. Thanks again, Mike. Um, and thank you everybody for listening. We will see you next time.

Speaker A: Thank you, Phil. Really enjoyed it. Thanks a lot.

Speaker B: Cop Products is brought to you by yaya. Helping cybersecurity companies define who they're for, what they do and how they're different. To learn more, visit YAYA Co. And don't forget to search for cult products in Apple podcasts, Spotify or wherever you listen. Follow the show so you never miss an episode. On behalf of the team M at

Speaker C: yaya, thanks for listening.