How AI is Changing Security Awareness Training

Greetings, everyone. I'm excited to welcome Brandon Min, founder and CEO at Herd Security. Brandon, welcome to the show. Yeah, thanks for having me, Ben.

Hey, great to have you here. Looking forward to this today. First, let's talk, tell us a little bit about your background. Yeah, so I've spent the last decade in cybersecurity across various different roles.

I actually came from a technical background in college, was a systems engineer with some database security background. but I actually specialized in human factors, unrelated to security, but just in general, and those could be anything from how, I think traditionally it's how humans interact with maybe manufacturing systems. We went as far as researching how humans interact with even line systems at amusement parks and things like that. So really fun, cool projects in that sense.

And as I started my career, I eventually found my way to Duo Security, the multi-factor authentication company. And it was at that time I started working as a deployment engineer, essentially working with companies, helping them with their initial deployments of Duo. And I saw firsthand how human factors can actually relate to cybersecurity products in the sense that humans need to properly adopt technology in order for it to be most effective, not only, I guess that's in a general sense, but definitely in a security sense as well.

Perfect example being if people are familiar with a dual push or a push notification, if you get a push notification and you just click the button without thinking about it, then you've defeated the whole purpose of your company paying for that. So beyond that, I was able to take that experience, really drew into what I wanted to build at Herd. I actually decided around that time that I wanted to start a company, but felt like I wanted to get some more experience across really early stage startups.

So I went to a few other ones before and was in various different go-to-market roles across pure sales, account management, as well as technical product marketing and best areas. So done everything under the sun on that side. And we started this iteration of I've been on my entrepreneurship journey full-time for about three years, but this iteration of heard started in late 2024 early 2025s and this is where we're bridging that gap directly between how humans interact with cyber security and ai products and that's been our biggest thing okay so founded the company then 2024 formally or formally yeah we just say we say 2025 but yeah it's pretty late 2024 yeah okay later early okay so pretty still pretty early out of the gate yeah Love that background.

So tell us a little bit about herd security. I think we have a flavor for it. But yeah, tell us what products and their services it offers then. Yeah, we are at the intersection of how humans learn how to adopt security and AI, technical AI products, essentially.

So where we started was pure security awareness training, which is something that people are pretty used to. The video style trainings that you do once a year for compliance. we are one of our first missions was to get organizations away from that cadence of thinking about security awareness training as just a compliance checkbox and something that needed to be more routine for users because security is not something you can just think about once a year for everyday users it needs to be on a daily weekly you know normal cadence in that sense so Our first product was the ability to take an existing program and use AI to make it a more ongoing program with very curated content that can be created on the fly with different subject matters, with different ideas from the organization and bringing in context from other organizations and other attacks that were happening across the ecosystem and easily putting that in a micro style learning format for users.

and delivering that within the enterprise. We've expanded that over time towards different types of training. We have people who actually started building in sales enablement training, general compliance and LMS training, L&D, et cetera. We don't necessarily focus on those, but it has been used in those areas.

But the second major area we started to focus in is AI governance and also adoption around how an enterprise finds the right ROI in their AI investments that have to do with employees. So not only making sure those are done securely, but also ensuring that people learn how to maximize the usage of the tools that are given at their disposal. Yeah, really interesting. Yeah, especially the whole AI ROI debate and what ROI you're getting out of that.

So tell us a little bit about your ideal customer profile. So who are you targeting? I mean, can this be any industries, the software companies? Can it be small to large?

Tell us who, where's that sweet spot? Yeah, it in theory can be anybody. But who we target is we typically work with mid-market based companies. So anybody between maybe say 500 employees to several thousand.

We do have some customers that are higher than that with multiple thousands and thousands of employees. And we have some that are smaller in terms of that. but overall we look for those mid-market companies that are looking to be more forward-thinking with their security program that doesn't necessarily mean they have to be a technology-based company we have some that are even financial services that do that but if some if we run into an organization that's not committed to changing or thinking that security needs to be a more ongoing all the time tasks or aware of that, then those typically are not the right profile for us, at least at this time.

And then we, but yeah, you've seen it cross industry and then our ICP ends up being security folks that are especially specialized in governance risk compliance because they typically the ones who have to understand how not only do they run training programs typically for security but they also need to understand how organizations internally are adopting any kind of tool safely And say, so this mid-market company, what kind of title, who are you going after within the company?

What kind of titles do they have? Yeah. Within the security team, governance, risk compliance, GRC. Okay, GRC.

Typically the most common. and that can vary based on the just the size of the company but and so you'll see in larger companies there are pure security awareness even security culture based teams that that could be involved with the training and ongoing awareness you can have it's a newer role but human risk management teams that are forming in order to ensure that humans are in the organization are both prepared for different types of social engineering attacks. But then you can get all the way down to a small business has one IT person doing IT and security all the above.

We work with them as well. Okay, interesting. Interesting. So founded, say, late 2024, maybe early 2025, or out of the gate here within the past year and a half.

So let's talk a little bit about your fundraising journey. Looks like you raised, looks like a $3 million, maybe, I don't know, seed round? It's nomenclature, but we call it a seed round, yeah. Yeah, $3 million raised.

Okay. Yeah. And is that total capital raised to date then? It's about maybe $3,200,000.

Okay. It's about total. Yeah, we had a pre-seed round that was early in the beginning. But yeah, the fundraising journey, it is a hard time to raise for 90% of people out there.

It is really easy for like a small 10%, a.k.a. if you have just an insane AI idea to the moon, And then some of those you're seeing the crazy valuations, crazy investments in terms of that.

Some warranted, some maybe not, but that is how it is. So it was, to be very transparent, it was incredibly difficult to pull that round together. And when just before, when did you raise, like, when was that? Was it right, say the 3 million, was that right out of the gate or was that recent?

When was that seed raise? No, so yeah. So when we started the company, we had the idea formed. Okay.

And so late 2024, we formed it. We actually got our pre-seed check-in then. And then we started to, we actually closed the seed round in January, or yeah, January of 2026. So just a few months ago, and then announced in May.

So there was a solid year, a year's worth plus of traction that needed to happen before bringing in that seed round. Okay. And now I want to hear about the traction, but you're alluding to, and I hear this, of course, in the interviews, is maybe different fundraising environments. So tell us, that seed round, was it hard?

Tell us a little bit about the dynamics of that raise. Yeah. No, it was incredibly difficult and just to not sugarcoat it. It took, I think we hear about all the rounds that are just really fast and really big.

It took me eight to nine months to close that round of like pure fundraising and maybe 150 different VC conversations. That's just, they, and some had multiple. So let's say 150 something rejections in there as well. And that's the norm in terms of it at this time.

And my, yeah, the best thought and how I structured it was really looking for VCs that I knew I wanted to partner with, but also who had the same mindset in terms of the investment and the long-term goals of the company. I'm not going to share those all necessarily, but there's moments where you can be, and I say this to every founder now, you can be very smart about how you can potentially exit. And if you protect your exit, there's moments where a $40, $50 million exit for a company could be more fruitful for everybody involved than a billion dollar exit, which just sounds crazy on paper.

But you with a financial background understand how these cap tables work, how preferences work, preferred stock, et cetera. My biggest thing was protecting our potential exit based on the traction that we had and having a very realistic valuation that we could grow into. And that was my two biggest priorities, which maybe took me a little bit longer to pull together because of that. But we ended up in a really strong position in that.

Yeah. So it's not like cap table priorities, plus for that good founder investor fit who knows your space. And tell us hard, long raise, 150 conversations. And do you think, was it just the bar is higher for a seed round?

Or was it they weren't sure what you were trying to offer? Do you think it was just the market conditions or maybe just them trying to understand what you're trying to prove in the market? It was somewhat the market conditions, but I also think if you're not a pure AI play, there's a lot of, there's not as much interest these days, just overall. So even in cybersecurity, when we were raising two, we were a lot more focused on pure security training.

And that's a hard market to maybe get investors really excited about because it sounds like something that's been around before. If you say you're building a manufacturing optimization process tool, everyone's going to be like, okay, great. And again, it could be a fantastic business and it could go far, but it's just in the beginning without real metrics behind it can be tough. And so it took some time to simultaneously gather good backing with some good press and some good actual traction as well in order to get the right numbers to put us in a stronger position.

Yeah. And that's my next question is just, and you mentioned some traction because sometimes at the seed round, it varies. It could be, Hey, I'm a five times founder and they know my background. So we get you know invest some money and go have a nice return But in this case did it was it more than say your vision and market and you needed to show some traction proof points to get the seed Yeah I would Yeah definitely that I will say all of my advice so far is for first time, I guess, first time VC back founders.

If you're a multi-time and you've exited in the past, then it'll be pretty easy, hopefully, to raise. But yeah, for us, it was a market that seemed like there were competitors. There's a large player in it. And we hadn't developed as much of our AI governance and adoption type tooling yet.

So therefore, with that all combined, it took, we had to garner some real logos. And even that, it came down to what's the velocity of those logos, et cetera, et cetera. But once you got one in, it helped. But there were false starts in there.

I'll be honest, I can't share everything. But we had a term sheet that somebody just backed out of nowhere. and that was and I started telling people we had a lead everything which I did and it just completely changed anything could happen but you can also get through it yeah yeah and interesting because you had to show some logos right acquiring some logos but then you mentioned velocity so you're saying once I landed this customer they had to see some sort of revenue trajectory that was increasing yeah and again maybe I I've learned a lot maybe I could have done better in terms of So I'm not saying it's end all be all, but I think it depends on the, if the question is, do you have, the first question is, do you have revenue or what's your traction?

Typically revenue is the most important de-risk, right? And we know that. So is it revenue? Okay, great.

Is it, if it's B2B, then they're going to say how much revenue and they're going to say, what's your ACV, right? In terms of that. So if ACV is somewhere in single digit thousands or maybe low 10, 20,000 even, then it's going to be more of, okay, this is a, for scalability, this is a velocity play. How can we, then we have to see speed numbers.

To be fair, if I had come in with, let's say two contracts that were like half a million each, that maybe there was a different story there, but that wasn't us. Yeah. There need to be some speed numbers in that. But with that, I can't share exactly our revenue numbers.

Well, in a pretty strong position for what you would say in seed, we have a 100% net retention and expansion number. And I think in our sales process, it was a 90% win rate when we got to trial with the customers. So when they started seeing stronger numbers like that and clear retention, there started to be more completeness in that, especially because a couple of our early customers wanted to renew and expand three months before their contract was even up. Yeah, I love that.

I appreciate that insight because like you said, if you had landed a couple million dollar logos, perfect, right? But now, yeah, they're like, oh, your price point is 10,000 a year. Okay, yeah, we need to see a bunch of logo acquisition to prove that product market fit. So, yeah, great insight.

So Brandon, at this stage of the business, say, I don't know, a year, year and a half in. So is this founder led sales at this point? Tell us a little bit about your go to market motion. It certainly is.

A lot of it has been, I wish I had a cooler story about it, but a lot of it has been outbound, pure old outbound based sales. I know a lot of people say it's dying. And I wouldn't say maybe it's just dying in the traditional sense. It's certainly there still are people that respond to it if you approach it correctly.

and so everything that I had built was either through that maybe a few warm connections making my way to six connections to Kevin Bacon or trying to get there but and that's been everything and and how we've closed everything so now with our initial investment we're actually starting to expand our outbound capabilities as well as our inbound capabilities and that's been a lot of levers we've been starting to pull mainly because we've in the founder-led sales motion we've kind of proven that there is somewhat of a repeatable process we can learn but we'll kind of start to expand on what we know and then pull on some levers that we want to experiment with at the same time okay yeah interesting so founder-led sales and right outbound a lot of outbound out there but if it's the right and yeah i will open them but i also get a lot of bad stuff too So before, yeah, everybody does now.

And before we hit record, talked a little bit about pricing. And I just released a post about perceived pricing. And so tell us a little bit about the pricing model. We know pricing evolves over time.

And even now today, maybe even more complicated with AI and tokens. But tell us how you're charging customers. Yeah, it is. I'll tell you what it is today.

And it could change. We know it can be all the time. But we essentially have several different versions of the product. So I basically made two flat rate versions that have a little, I want to say less capability, just smaller capabilities with the product, making sure our unit economics are good in those, but bringing value in a more directed approach.

Like one example is one of our lowest tiers is kind of servicing those checkbox compliance needs for SOC 2 based training, HIPAA based training, et cetera. And we actually work with a lot of really early stage startups that are building into it that need to get it done fast. And so our tool can do it, automate it, and they pay a pretty low price for it for the year. And our enterprise version is a, as of today, is a per seat model.

Based on that, based on sizing, it goes into a bulk discount. I think if it's under, if it's under a certain amount of seats, there is like a platform fee that we have to throw in terms of that. But overall, we have talked about for enterprise, a mix, eventually going into a mix of seats and outcome based pricing, which you've talked about in your article, but around either usage, results, creation, whatever that is. We haven't figured out exactly how that'll work, but there is interesting thoughts or at least conversations that we have a lot about it.

Yeah. Oh yeah. I know. It's like even more options today.

And even like when I did all this research a year ago, there was really least public tech companies, not like maybe they say it was outcome, but it's really usage. But now you are seeing actual outcome and reading those pricing pages and then you click to learn more and the whole page right And people may think all right it getting really confusing but when do you charge When do you not charge What happens if this action happens, right? With that outcome. And I don't charge them.

So yeah, a lot of thought has to go into that. Plus just the infrastructure to track the workflows, the inference costs to achieve that outcome. So not an overnight thing. Yeah, no, and I can't imagine, from a CFO perspective, of it must be trying to predict repeatable revenue has got to be extreme yeah we always want repeatable revenue predictable revenue so we'll see where it goes with outcome-based pricing once we have some data out there so that'll be fascinating and brandy at this stage of your journey what's important to you as far as a number of metrics something that you're looking at maybe an operational metric to guide the business yeah taking arr and finding out of it obviously our goals match what the market would say in terms of that.

But so there's two things that I care about internally. We so we leverage AI a lot internally. We actually built our entire code base to optimize for plot code and other coding based mechanisms. And so we first actually two engineering based goals we tracked are the amount of features that we release on a daily basis.

It used to be, essentially we're at a point where we can release as many as 15 to 20 new features a day. And it's really not a problem. And then we test the speed at which a customer asks for a feature. And then when it's built.

So we actually have an internal system where with call recordings or transcribing, whatever we're using, that on the call, we can essentially say keywords that'll create tickets automatically. And Cloud will begin processes of actually creating certain engineering tweaks to the code that we can develop certain new features. So we test the speed of if somebody asks for this on Thursday, when is this out in the product and in front of them? Those are two core metrics towards not only engineering speed, but also listening to customers and understanding how quickly is sales and customer success getting that feedback to engineering.

And those are really important to me personally. Yeah, it's interesting. And one more thing there and a few more questions before we wrap up today, but engineering speed versus product roadmap. And should we actually do that?

Do you think now that's more of a conversation or do you think that's not enough? Maybe for you, but others now, right now with VibeCode, we can put anything out there with these coding tools, but maybe we shouldn't. Maybe we need to slow down and think about a little bit more. Yeah, there's definitely some guardrails around it in the sense of somebody asked me to build a manufacturing operations processing tool.

We're not going to do that, obviously. So there are certain categories that we set up with our product roadmap. So if anything falls into an existing feature or something that's an add-on or et cetera, those are the types of things that will be transcribed and Claude will create pretty much immediately. So they fall into our existing roadmap.

I will say though, and I listened, there was a podcast on this recently about Anthropic's head of product talking about this. I think she's had a product for Cloud Code. They, Anthropic has gone into a mode where they just release MVPs of every single idea or product out there. And we're in a similar boat where we just put it out there and see what the usage and reaction is.

At worst case, we take it away. after no one's using it. And I don't want to say engineering is not valuable, but the cost of writing code is so much lower than it used to be now. So therefore, we actually, I want the team to think less about roadmap.

There's obviously buckets we want to put things in and more around ideas and inspiration in terms of that and turning those into real features. And whether that comes from a customer, whether it comes from an idea, anybody in our can produce that yes there are those long-term conversations of course but we on a micro level we're pushing out those features yeah appreciate that insight and a few stats and figures before we wrap up today do you have a headquarters location do a headquarters location yeah are you located yeah not like an official office yeah okay yeah okay i yeah keep keeping things remote and keeping over remote okay remote yeah and then uh yeah what's your current team size we are as of this actual moment we are four okay in a couple weeks we'll be seven potentially eight so okay doubling in a couple weeks yeah yeah great i'm going through the hiring right now so yeah sounds good brandon appreciate the time sharing your journey so one more question what's top of mind right now so much going on in the ai world with software the software evolution so what are some top of mind things that you want to achieve this year?

Oh, my. Zooming out. It's really so we figured out maybe one or two channels of distribution for us. So it's my first goal is to help quantify those numbers and metrics and to basically track from a CFO perspective.

Hey, what money I put in here will if I spend a dollar here, how much money predictably will come out of it. That's my first goal in that. And then second is finding additional channels that we can distribute to. Because, yeah, as you probably know, I think we have a good product.

Clearly the market is showing that, but having a good product is probably only 25% of the battle. The distribution is everything, so. Yeah, I've got to figure out that go-to-market magic and plus the ROI there. So yeah, appreciate that.

Brandon, appreciate your time today, sharing your journey. if listeners would like to learn more about herd security where should we send them online yeah to our website herdsecurity.io and follow us on linkedin or any of other our social pages with that and yeah we find all the information there all right perfect if you'd like to learn more about what brandon is doing check out herdsecurity.