How Danny Jenkins Bootstrapped ThreatLocker From $150K Debt to $200M

Speaker A: Welcome to the SaaS podcast. I'm your host, Omer Khan. AI has changed the playbook for building and growing SaaS. Every week I talk to founders who are writing the new one. He was $150,000 in credit card debt buying $80 of groceries on three credit cards for a family of five. 18 months in still zero paying customers. Then an accelerator told him to to scrap the whole idea. My guest today is Danny Jenkins. He ignored them and built Threat Locker into a CyberSecurity company approaching 200 million in ARR, protecting 70,000 companies. In this interview, Danny breaks down the test that made him create a new category instead of chasing a small market. How he was so scared to ask his first customer for the sale that he was shaking.

Speaker B: And.

Speaker A: And the only two things he says actually matter when you're starting out. Quick heads up before we start. I was getting over a bad cold, so my voice is a bit rough. Apologies for that. I hope you enjoy it. You've got a powerful product, but new users struggle to figure it out. They sign up, get stuck and leave before they ever see the value. And it usually comes down to one thing. Every user has a different goal, but they all get pushed down the same path. Product fruits fixes that it adapts to each user and guides them to the result they want. That's how they help fitness player cut trial churn by 70%. Visit productfruits.com to book a demo. Mention SaaS Club and you'll get a free 30 minute onboarding teardown with a product adoption expert. They'll show you exactly where users drop off and how to fix it. I've interviewed over 450 B2B SaaS founders on this podcast. Success leaves clues and I've been taking notes. Every week I send out the shortcuts, the blind spots and the tactics that actually work. So you don't have to learn everything the hard way. Over 5,000 founders read it. You probably should too. Sign uh up free at Sasclub I.O. newsletter. That's Sasclub I.O. newsletter. Okay, Danny, welcome to the show.

Speaker B: Omar, thank you for inviting me today.

Speaker A: It's my pleasure. Uh, so tell us about Threatlocker. What does the product do, who's it for, and what's the main problem you're helping to solve?

Speaker B: I mean, our goal is we understand that cyber attacks are getting worse and worse every single year. Uh, we understand that it's no longer just an IT issue, but it's a real business issue. And we understand the solution isn't complicated. What's complicated is the implementation of the solution. So what we did is we came out with the idea of building cybersecurity. What is now referred to as zero trust wasn't then, but on the basis of basic controls, least privilege, and actually stopping ransomware attacks, cyber attacks, phishing attacks, being successful and everything else, rather than trying to detect everything just to build a really good controls platform that hardens people's environments and ultimately all but stop cyber attacks.

Speaker A: Great. And give us a sense of the size of the business. Where are you in terms of revenue, customers, size of team?

Speaker B: We protect about 70,000 companies worldwide. We've got, uh, and that's a lot through MSP networks, but also a lot through Direct. And we've got about six to 7,000 direct customers. And they range from small businesses through a local MSP right up to, uh. I can't give some of the names, but some of the world's biggest companies, I mean, literally companies, Companies you wouldn't even think about mentioning that I'm not allowed to mention. Uh, but the biggest and the most valuable companies in the world are our customers. And revenue, uh, revenue were just approaching 200 million.

Speaker A: Awesome. Um, so the story, uh, I guess the business was founded in 2017, but maybe just start by telling me a little bit about your background. You grew up in England. How did you get into the cybersecurity space in the first place?

Speaker B: So, uh, essentially I grew up, um, in the uk. I was very short as a child. I grew very late as a teenager. Uh, today I'm six foot tall, but back then I was five foot two at 16 and I had a rough time at school and I left school at 15. I didn't graduate high school, I didn't do my GCSE. I was like, I'm out of here as quick as I can. And this is the 90s, so the Internet doesn't really exist. I love computers. I created, you know, there was one computer class, if you like, and I created, um, uh, what's the word I'm looking for? Uh, scripts, but malware to delete people's work from their computer. That bullied me. So I was like, oh, look, I can just edit the autoexec bat file. And when the computer starts, it will delete anyone's homework from their floppy disk. So I do stuff like that when I was in high school. And that's what got me into it. And what I did is, and it's going to be hard for anyone in today's age to understand this is. I Wrote a letter to every computer company in the town I lived in, said, I'm looking for an apprenticeship. And one of them came back to me and I got a job. Uh, started off physically building computers, uh, started working on Novell Netware servers, small, um, business server. This is before people even connected to the Internet. If they did, it was like a dial up, check your email and disconnect. And that's really what got me into the IT industry. And I just had this passion to understand how technology works. I want to know everything about it. I want to know how Windows works, how the registry works, how not how printers work, how they communicate with each other. And what really got me into cyber security was I ended up moving to Ireland. And when I was in Ireland, I got a job for, um, a manufacturing company that manufactured building materials. And I worked in one of the local, um, offices. And they had like 146 sites worldwide. But the corporate headquarters didn't have an IT person because they only had like 20 or 30 staff. And that's where the CEO of the chairman. This is a $4 billion company at the time. And I went back to, um, uh, I was in the division, if you like. And I keep getting calls saying, hey, can someone come up from division to help corporate. The corporate headquarters help with their words not working, the spell checks not working, printer's not working. And the other guy was like, I don't want to go up there. Can you go up there? So I just kept driving up to corporate headquarters and suddenly I was fixing problems that had been going on for years. So then they offered me a job, um, as the IT in corporate headquarters. And at this point every division was completely separate and there was no real security threats. And then suddenly the love bug came out and the Blaster virus came out and they were like, oh, we have 14 different IT divisions, 146 sites worldwide. And when they screw up, it affects the whole company. So it started becoming a corporate issue of cybersecurity. And I was 20 years old at the time. I happened to be the person there to solve the issue. So that's what really got me into security to begin with.

Speaker A: Where did the idea for, uh, Threat Locker, uh, come from? Because you built an, if I understand correctly, you built an early version of the product. But it wasn't like you didn't jump in with both feet straight away.

Speaker B: I, um, I was struggling. So I had an email security company. And anyone here who's ever sold to IT and to tech people before knows this. They don't show up at calls, they cancel on you all the time. They're the worst buyers in the world. They forget everything they are going to do. So I'd had an email security company and I'd sold that to one of our customers and it was, it was a very small business end up with lifestyle business, oem. Um, and I was thinking about what I wanted to do next. So we did some ethical hacking. Uh, it turned into mostly ransomware recoveries. I was doing consulting for other companies at the same time and there was a case in Australia where I'd been, uh, an MSP had brought me in to help recover from a ransomware attack. This is 2014. And um, the attacker had got in encrypted everything, databases, SQL exchange, everything, backups gone. And they come in through a piece of malware that a user had ran. And I got onto the. About a week into the recovery the owner of the company called me and said he was like a 60 something year old man. He got very mad with me and he said, well, when is this going to be fixed? I was like, I don't know. It is like, you've got to be real here. Everything is gone. You've paid $22,000 ransom. The ransoms were cheaper than. The decryption keys do not work. We're reverse engineering the code. We're doing low level disk recovery. We're doing everything we can to get you back up and run, running and I don't know that you're going to be recovered. And suddenly his voice breaks and he gets very emotional on the phone now, you know I'm British. Last time I cried I left Britain, haven't been back since. Um, so I don't really do well. When some guy starts crying on the phone to me, I'm like, look, I'm going to do what I can. This guy did not go out of business. We managed to recover everything but at the end he said to me, well, why did our security tools not stop this? And I said, well, because your security tools are looking for known threats. You need to block everything by default and just approve what you need to. And his IT team said that I was nuts and that was not viable. And I eventually uh, tried to prove him wrong and found out there really was no products that were viable for a 50 employee company to implement a security that was required to defend against ransomware or any kind of cyber attack. So this was 2014. Um, at the same time we're also looking after our kids school, it's, and every day there was Malware, there was viruses and the teachers were running things they shouldn't do, the students were running things they shouldn't do. And it was literally 20 hours a week we were spending, trying to keep our kids school and my wife was doing most of the work. And again, same problem. How do we block things by default? So this idea, well, what if we built something that was easier? My problem was I didn't want to sell to it again. So at the same time I'm looking at this health tech, there's ed tech, there's other solutions out there where I could actually sell to people where they want to take my call. And uh, I built ThreatLocker and I was spending 15% of my time on it. So it's 2017 and we have this concept. We've got a driver built, we've got a service built. It's been very, very difficult to get to a point where we can. And look, all it does is block. And the blocking part is the easier part. Uh, it's the allowing that's actually more difficult. And that's where ThreatLocker actually does most of our research is how do we allow software? And WannaCry came out and what I'd done beforehand is I'd realized that the size of the whitelisting market at the time, so that's one of our components, was a total market size, if we stretched was potentially a few hundred million dollars and in order to succeed it was Gonna cost us $100 million plus to run this service. So we would have to go and take 70% of the market. And that didn't seem viable at the time. Uh, when WannaCry came out, we just tested it and it blocked it. And I sat there and thought, okay, what if we change the size of the market? What if instead of, you know, trying to take a corner out of an existing market, we go out and create this entire new market, this entire new category and we just say that we are actually changing it. So this is not just for big businesses, it's for small businesses, it's for medium businesses, for businesses that ah, are dynamic and change at airports and hotels and hospitals and all of these types of businesses. Could we make it work then? And that was the turning point in May 2017 where we said, okay, I'm taking no other work on, I'm quitting everything else. All of our other income was drying up. How do we go and make this work? And that's, that's the point that WannaCry really said we have to make this work. And at no point from then onwards was this ever going to be a small lifestyle business. It was going to be a multi billion dollar company.

Speaker A: So it was about 18 months, um, late 2018, that you landed your first customer worth about 5k, I think. Tell me about what those 18 months were like. What were you doing every day? Uh, was it working on the product? Were you trying to find customers every day? How did you spend your time?

Speaker B: Well, so in 2017, so we spent all of the time trying to build the product and make it mvp. And mvp, by the way, minimal viable product. When you create an endpoint security product until you start deploying it, it's shit. And the reason being is because you're trying to predict what everyone's systems look like. So you could build test systems and you could do whatever you want. But what gets you real value is, hey, this is how Dell Support Assist works, this is how this software works. So we're working on the products, trying to create a stable version that we can at least get turned on on our kids. School would be nice. And they were the first user of Threat Locker. And then, um, then we realized, hey, we need to build a sales team, we need to build marketing, so we need to raise capital. And we're at this point, our savings are gone, we remortgaged our house and now we're burning into credit cards. So we go through an accelerator. Um, by the way, I would say now, and this is my opinion from one experience, but I would say going through an accelerator and committing three months to accelerator was one of the bigger mistakes we made. Um, uh, it was a waste of my time, it exhausted the family, exhausted everything. But we went to this accelerator, went to dc, I stayed up there for three months when I came home at the weekends and I was working on the product of the weekends and I was going through this, hey, we're going to train you to raise capital, we're going to help you grow your sales team, we're going to help you. And all they did was mostly talk about, you should pivot your business. Don't do zero trust, don't do white listing, do edr, do edr, that's the future. And uh, the last day I was there, there was one of the, and quite often there are really good people that surround themselves, but a lot of the people that surround themselves with accelerators, let's face it, I'm a busy person. Most people who are actually doing well in their life are busy. So they don't generally go down. And we try I try and make an eff to give back to the community, uh, but I can't spend months of my time and accelerate. So the people who are spending a lot of time there tend to be one of two types of people, uh, one of which is trying to sell you something, uh, which probably is the better ones you want to talk to. And the other one are people who just like the sound of their own voice. And, uh, I remember they were getting so mad because I was like, I'm not going to pivot this to edr. And, uh, she said to me, you don't know how to take advice. It's like, I do. I just don't take advice from stupid people. And I just like. We never got funding. They promised to introduce us to investors. We never got the investors. We never got any customers from it. We just wasted three months there. But we went back. Um, I said, look, this is what I need to do the products now at, ah, MVP stage. Um, so I have to actually have back surgery as well. So I spent six weeks not being allowed to sit down, which was tough. Ah, so I go through my back surgery. I keep coding alignment. Literally, I had to lay back and share. And I just kept coding, building the product, get it to MBV stage, and then I start to hire someone. I've got very little money, but I figure, hey, if I can get someone just to dial and book me meetings. So I got a guy working in my house four hours a day dialing and saying, hey, I'm calling from Threatlock. I want to talk to you about our whitelisting product. And this guy was awesome, by the way. I wish he was still with us. Um, and, uh, he, um. So after, uh, eventually he gets me a couple of demos set up, and a lot of time he would get them on the phone and they start asking questions. He would hand the phone to me and answer the questions. So he gets this demo set up. And, um, it's. It's like August or something, the end of 2018. And the guy's like, does it do this? Does it do this? We do this demo and I'm showing him m, do you want to start a trial? And I remember. So we deployed the agent, and we're looking at his unified audit. And we're like, holy crap, look at all this stuff coming in. So we're literally writing code, pushing it to try and understand how to learn his environment, because we've never seen an environment like this. And we're about six weeks into the trial now. Everything's Going relatively smoothly. He's had some hiccups, but we've managed to keep everything relatively smoothly. And then he says, um. So I said to him, well, I'm really nervous, and I'm $150,000 in credit card debt. At the point that week, I'd had to buy groceries, and I had to put $80 of groceries on three credit cards for a family of five. It was rough. So I'm like, we are absolutely screwed. And the. I call this guy, and I'm literally shaking, and I don't know how to. I'm not a sales guy. I don't know how to ask for an order. So I'm like, well, how's it going? Is there anything wrong? You've got the machine secured. I was like, well, what would it. What do you need to do to make a decision if you want to buy this? And the guy's like, oh, how much is it? And I'm like, oh, it's, uh, $50 an endpoint. Uh, and. But I'm. But I start discounting myself in the same conversation, but we can work with you. And. And he's like, so it's 5500. Yeah, just send the order cost. We'll sign it now. And, like, it was such a relief because I was so scared. We just got this $5,000 order, and at that point, we were able to go and get some angel investors, because now we had someone willing to pay money for threat locker. So people were like, this might be interesting. So he got some angel investors, and then we started to really rinse and repeat and slowly grow.

Speaker A: So was that 5,000amonth or a year?

Speaker B: Yeah, it was paid up front, which gave us, uh, uh, the, um. And it was like a defense contract that made parts for planes for the air force or something. Um, so paid up front, and it allowed us to essentially, um, get through the next few weeks. We then got a investment, uh, check for angel investors. So we raised, like, $200,000 from angel investors, multiple investors. And that kept us through the next year.

Speaker A: I mean, you talked about, like, what a financial strain this was for you and your family and that, you know, everything is going on credit cards, um, 18 months to land that first customer. Like, what. What kept you going? And especially with this accelerated experience where they're telling you you're going down the wrong path. Like, was there a time where you just felt like, maybe. Maybe I should just go and get a job again?

Speaker B: There was never a situation where I said, this isn't worth it. I was Just trying to figure out how do I deal with today's problem. And ultimately, the goal is get this successful and do I need to go and do some work to get paid so I can buy groceries, maybe, and we'll deal with that. Uh, yeah, we considered, uh, filing bankruptcy, actually, at CF bank. And I remember calling a bankruptcy firm, asking, is there a way I can keep the business? We got no revenue. It's got no money. How do we do this so I don't lose the business in the bankruptcy? Because I would rather have said, hey, I'm going to file bankruptcy. Ah, than. Than actually. And we didn't. Thankfully, we managed to get that. We managed to move than actually lose the business. The goal was always, how do we. We have to change the world? I mean, it's. For me, it was very clear. And it wasn't about money. Of course. No one builds a business saying, I don't want money and I don't want to be successful. But it was about, this is the only way the world isn't going to be destroyed from ransomware attacks. There's no way you can stop cyber attacks without doing this, and we have to make it happen. So there was never a doubt. Should we continue? It was hard. It put a lot of strain, um, on us. But at the end of the day, uh, I always figured, look, at the end of the day, if I lose everything, I can always just build back up again, but I'd rather take that risk and actually do something worthwhile. And I think it was probably tougher on my kids. We weren't the, you know, I was constantly traveling, I was constantly working, and. But that's part of their life. They've always known what we do. Uh, and my wife founded the company with me, which made it a little bit easier because we were in it together. It wasn't like one of us is burning our dreams on this hopeless company, and the other ones, like, well, we can't afford to pay the mortgage. We were in it together.

Speaker A: You. You had moved the family to Florida around that time, is that right?

Speaker B: No, we moved them in 2010.

Speaker A: So you. Okay, so you'd been there for a while.

Speaker B: Okay, yeah, we've been there for a while. Um, it's, uh, you know, we had a house, and actually we had. We'd moved houses, so we had a second house. Well, we didn't have to. We'd moved. This is our second home. We lived in or owned in Florida. And it was, um, you know, it was. It was, uh, you know, everything was kind of, you know, settled as a family. Ah, we had some other problems as well at the same time, because, you know, just as we think we're getting further, like, in. As I was in the accelerator, I think it was Hurricane Irma, um, came through and wiped out, like. And I'd said it to our neighbor before. I said, you know, you should thin that tree out. She had a massive live oak tree or some kind of oak tree. I don't know if it was live oak. And I said. And she said, oh, no, that tree is fine. And it came down on our house. It ripped all the pool pipes out the ground. It took the gable down. It totaled the car. It took the roof out. We got like 50 cents, maybe even less than 50 cents on the dollar from the insurance company on the cost of repair. So we end up having to sit on the roof, me and my wife on the roof, in the middle of the heat, like, nailing roof panels on and fixing the roof so we could. The water would start coming in because the top had blown off a few months later.

Speaker A: So in the middle of building this business and trying to land the first customer, you're also repairing your roof.

Speaker B: Yeah, repairing the roof. Uh, the car had been totaled. And what made it worse, because this was a point where just before we. We hadn't completely ran out of money, but we were really running down our money. And we weren't on credit cards yet, but bank of America, we, uh, had a car loan with them. And the. Our car had been totaled. And there was a $7,000 delta on the finance. And 60 days afterwards, they came in and said, if you don't pay it today, we're going to report it on your credit. And I'm like, if my credit gets wiped on this, I'm going to. This is really going to think. So we had, like, uh. I think we had like $9,000 in the bank, and we. There was $7,000 left. We had to pay that $7,000 to bank of America that day. And we were paying it every month still. And they're like, no, it's got to be paid right now. And, uh, it didn't happen. So all of this is kind of coming together and falling apart the worst time. But again, we just like, okay, what do I need to do today? We'll do what we've got to do today, and then we'll do what we got to do tomorrow.

Speaker A: I mean, that was the thing that I wondered a lot when I was researching for this interview. And like. Like all this shit that Life was throwing at you while you're trying to get this business off the ground. I was like, what kind of mindset? And we talk about resilience a lot, right? But what kind of mindset does that do? You actually need to be able to deal with that on a day to day basis. And I love this thing that you say, what do I need to deal with today? I'll deal with that and I'll worry about tomorrow. Tomorrow.

Speaker B: Yeah. Look, and I think, um, ah, there's a certain type of person that has to start, uh, a business. And that type of person is not someone who is, uh, easily stressed or easily miffed or easily defeated. Uh, uh, because starting a business is one of the hardest things you'll ever do in a business, in a career sense. And this idea that people start businesses so they don't have to work 40 hours a week or they don't want to talk to their boss, it's crazy because, you know, even Today I'm working 100 plus hours every week. I sleep very little. Um, and it doesn't get easier. It absolutely does. You think, oh, once I get more money, once I get funded, once I get more customers, it'll get easy. It never ever gets easier, only gets harder. Um, but I think you just have to be at that mindset that I'm going to do it. And I also think you need to be the type of person that doesn't dwell on what's wrong. Because, you know, I always say, if you want to feel better about your life, ride the elevator in a children's hospital. And then you'll feel better about your life because everyone else is in a worse situation than you. So if you just have to say, I'm doing what I'm doing and I'm going to do what I need to to make it better. And if something's wrong, what do I need to do to fix it? Well, there's a hole in the roof. Let me get on the roof to fix it. There's a, there's a problem with the code, let me write the code to fix it. And then when there's another problem, and yes, sometimes, you know, everything piles on at the same time. You just say, let me take the most critical thing, let me move on to the next most critical thing. And we'll just keep doing that. And that's eventually how you end up growing a business. And at the beginning, you know, everything is one of the things, you know, actually one of the things the incubator said to me, the accelerator, they Called themselves, but was, hey, you got to file a trademark. So at this point, we're about $50,000 in the bank. Um, we haven't got into credit cards, and we got to file a trademark, and it's going to cost. So this legal firm comes in, why is it important you file your trademark? Why is it important it's done right? And so we look at all this and listen to them, and we're like, okay, we need to file a trademark. So we look online. What's required to file a trademark? It says you should use a lawyer. Uh, but you can do it through the US Trademark office by yourself. And it's say, I can't remember the number. Say, it's $300 to do it directly through the trademark office. So the lawyer says, it's going to cost us 12 grand to file a trademark. I think I can't remember the exact number. And I can't afford to spend $12,000 on filing a trademark right now. And we did ourself. Um, and you know, it's interesting because when you're starting a business, there's a lot of people who are starting a business will go to someone who's running a really successful company for advice. But if you come to me and say, I'm running a really successful company, what should I do to file a trademark? I'll go and find the best damn lawyer you can and make sure it's filed properly. But if you say to me, I've got $50,000 in the bank, should I spend $12,000 on filing a trademark? I'd say, no, do yourself. And it's going to cost you a fortune in the future if you do it wrong. But guess What? Spend the 50,000 on dollars on what you need to do as a business today. And when you're starting a business, you need two things. You need a product that solves a real problem. And you need the customers to know the product exists. You need the buyers to know the products exist. Everything else is white noise. Like, and, um, just ignore it. Because, yes, it will be important. And it cost me at least $50,000 three years later because we filed the trademark wrong. We had long standing litigation that could have, that would have. We spent 50,000 plus dollars in motions because we forgot to put a period where we should have put a period or we did something wrong. But if I'd spent the $12,000 on the trademark registration, I wouldn't have spent it on marketing it, and I wouldn't have a business to defend the trademark for. Later on. And the $50,000 at the point in time I spent it was irrelevant because we had a lot more money in the bank.

Speaker A: Right. So you've got that first customer that takes a lot of pressure off. You said you were able to go and raise some capital from that. Where did customers 9 through 10 come from? Was it just more cold calling? Do you remember?

Speaker B: So, and here's the other thing. I actually don't remember. Second customer. So I think, um, uh, I think nine through ten. Um, so here's what's happening is this is another failure. I see a lot of. Of course, one of the things about going through and accelerating, One of the nice things about it is you do meet a lot of peers in the same situation. Um, pretty much all of them, actually all of them now are no longer in business. Um, but you do get to see what people are doing, what they're doing wrong. And one of the things I see from a lot of people starting a business that's failing is they assume I've got a lead, that lead's got to close. And they'll assume that because the customers or prospect is being nice and talking nice, it's going to close. I tend to run a different approach on this. You need to have 100 leads to close 10. Now our close rate back then was more like 45%. So, uh, but it's, uh, but you have to think about that. So what we did is this guy was calling, he had a lot of demos going on. This was the first one that closed and some of those other demos would have closed. What we found very quickly was that customers started talking to their friends, their peers. It ended up being on Reddit and ah, discords and other things like that, where people would then start coming inbound saying they wanted to look at what you were doing. I remember we did a webinar and um, it was a, ah, it was a company called MSP Webinars. Very small. There was like 10 people on the webinar and we'd ask someone, we want to do a demo on a cold call, and they said, no, we don't do demos, but go to MSP Webinars. If they're doing that webinar, we'll watch it. So we go to this MSP webinars, we do this webinar and there's about 10 people on it. But those 10 people start talking really, really quickly. And the guy was unbelievable because he went and tested the product after doing the webinar live, and he did about five hours of videos on his YouTube channel. And I was watching it, and I was yelling at the screen because he kept clicking on things that he shouldn't click on. I was like, that's not how you do that. And it's.

Speaker A: But.

Speaker B: But what we learned was, hey, if the customer's clicking on something wrong, then it's an us problem. We need to make sure they don't. We need to make sure we guide them into the right direction. So we. We watched it, we changed it, but in the meantime, we're like, oh, this YouTube. And then he clicks on something and the webpage crashes. And we're like, oh, no. And. But we fixed it all. And we just got through that. So that. That got quite a few leads into the pipeline. We'd hired a salesperson, really on. And, um, uh, we had the cold call, and then we hired a salesperson. And that was a mistake. Uh, not hiring a salesperson, but the type of hire salesperson. You. We hired, uh, this guy, he talked the talk, and you could bring him into NASA and he's not going to embarrass you, but he didn't deliver anything. And at this point, I remember it was like June 2019, I think, at this point. Uh, so we've gone through our first round. Uh, we've got this salesperson, we've got loads of leads, and now he's managing the close. I'm not asking for the close, but no one's closing at all. And I'm doing 10 demos a day. I'm coding all night. Nothing's coming in as an order, and we've got so many leads. I said, well, we've got to hire another salesperson. So we hire the second sales guy still with us today. And, um, honestly, when I got on the call, when he got on with the customer, I didn't think he was good. I thought he was terrible, actually. So, uh. And the person will probably hopefully hear this and not take it with too much offense. But I was like, he's not very smooth talking. He's very blunt. He's very direct. He comes across unpersonable. But suddenly we started closing, and I was like, wait there. How have I got this rock star who's a smooth talking, like, sounds really professional close nothing. And then I've got this other guy who comes in, and literally he would just say, oh, we're scheduling another call for next week to do the trial. And he wouldn't even ask. And he just say, okay, I've sent you a quote you can sign if you want. And it was almost just. And we just started getting these deals in. And, you know, I think we were $300,000 of ARR at the end of 2019, which is really small by today's numbers. But I was like, we're getting these deals in and they're just coming in and the person's his. And what I realize is at that point, I personally realized that sales is not necessarily about a, um, magic conversation. It's about showing the customer what you've got and asking them do they want to buy it. That's going through that process. It's not about. You said something magical. And, uh, now we have a great sales team of about 180 people. They all have different personalities. Some of them are better than others that selling. But we realized back then that, hey, I just need someone who's going to call the customer, who's going to make sure that they keep the customer on the phone. And he did fantastic. And he did that. And then we get to December, and I think we raise another $500,000 of revenue. Ah, sorry, not revenue of investment. Um, from. We'll call them. They consider themselves a fund, but they're angels. Um, so we get this second raise, and we've got $300,000 of ARR. And we're adding 40, say $40,000 of ARR a month. And then we, we go to, um, this guy says, hey, uh, one of our partners is going to come your cfo. And I was like, a little bit nervous. I was like, yeah, I don't want someone coming in, tell me what to do. But the whole docs, nothing had any guaranteed controls. So he's going to become a cfo. He's not going to get paid for a while. We, uh, can pay him in the future if we want. And we want to keep him on. And we're not guaranteeing any board seats. We're not guaranteeing everything. We put. We put in one of the investors on the board, but. But it's not guaranteed. We can take it away. So I'm a little bit nervous about this whole thing, but we're like, hey, someone's willing to put $500,000. And there was a couple of people, but one person led it into the company. Let's take the money. And I remember, so we're in January, and I'm like, okay, so we've got $500,000 of cash in the bank. Um, this is what I want to do now. Now we're in 2020. I want to go to as many trade shows and speak in front of as many people as possible and tell them why, what we're doing, why blocking by default is so important, how malware works, how you can defend it, and what we're doing. And I booked like 10 smaller trade shows, and I booked RSA. And this is just before the whole world shuts down. And the CFO said to me, what if this doesn't work? Because a CFO will always want to take. Let's test something. Wait a bit. Test something. Wait a bit. Test something. Wait a bit. And I'm like, so here's the thing. The product works. We know the product works. And yes, it's got bugs and it's got lots of things that probably need to be fixed, but it works. We need to tell the world the product exists. That's the second part of this. If it doesn't work, it's not going to work because people aren't willing to buy it. And in that case, it's better to die fast than die over five years. So I was like, we'll die fast, uh, if it doesn't work. So we spent $300,000 on these trade shows. And, um, we were adding $40,000 of ARR in December. I think we'd added 20 in November. And then we had like 60 and 60 again. Ish. And then in March, we had $130,000. And the entire world just shuts down. Uh, because now we hit Covid. So no more trade shows. I'm like, oh, no. And, um, my problem was my entire strategy was how do I get people to know what we do? Because people aren't searching for what we're selling. So it's not like I can put AdWords out there. How do I get people to know what we do? And thankfully, I'd done so many trade shows. We had this massive pipeline already built up. And, uh, we. We started selling to those pipelines. And, you know, we added 130. And then I think we added another good month. And, uh, we finished 2020 out with 1.9 million in revenue. And, uh, so. Oh, no, 2.3. Sorry, 2.3 we added. So, uh, we went from 300k to 2.3 million in revenue. And, um, we, uh, we then, um. But in we. In July, I think we started going back to trade shows, which. Because. And at the beginning, we were very much focused on enterprise, but then MSP, uh, they carried on doing trade shows in 2020 when it was crazy. I mean, anyone who went to a trade show in 2020 was off their rocker. You know, I say I went to eight trade shows between July and October 2020. I got Covid at one. So the, the. So, uh, and, and it was, um. But we started selling again. We got in front of people we educated and, and pretty much what we've done since then is just keep repeating at bigger scale everything we do.

Speaker A: Can you just explain, um, for people who don't know what an MSP is? Because that's, uh, a pretty important part of what happened next.

Speaker B: Yeah, So I think, um. Uh, so MSPs are essentially. So we are selling ultimately we're selling to tech computers, but we're selling to an IT person. An IT person, a security person. And you'll see in this world that msps and IT people get confused titles all the time and where they cross over to security or not. But at the end of the day, there's someone who's technical. Installing an agent on your machine and configuring it, whether it's a security manager, an IT manager, a CISO. MSPs are eventually IT people for small businesses. So, uh, or IT companies for small businesses. So if you're a small business, you can't afford to hire your own IT team. You hire an MSP, they look after all your IT for you. You pay them $150 a month for a computer and they come and fix all your problems. They put your security tools on and they do everything else. So, uh, it was our way of getting in front of small businesses. And one. Actually one of the things I said day one, when I went back and said I'm going to change the market. So we had a few hundred million dollars market and I need to turn this into a $10 billion market. One of the things I said was I want to sell to two companies, I want to sell to a small business and I want to sell to a large business. Because I figured if I can sell to a small business and a large business, I can sell to the entire world. Uh, but I put a condition in there that I cannot include someone who's already using someone who's already in that $200 million of market size. So if they're already using whitelisting, if they're already blocking by default, I have to exclude it. And what we realize is selling to small businesses isn't effective because they're not the IT people. We need to go to an MSP and the large businesses, obviously you go to the IT security team. And the small businesses were relatively easy because they weren't asking how Much revenue do you have? How much money do you have? The large businesses? I think our first, uh, massive enterprise we signed was JetBlue in 2021.

Speaker A: Okay. So I think it was around that time. So you've got these enterprise customers kind of showing up. Um, but you had this realization at one point that about half your revenue was coming through MSPs. And I'm curious, was that an intentional thing that you had been doing to win this business or was it more like for whatever reason you were attracting both these direct customer relationships as well as these MSPs?

Speaker B: I suppose where it became intentional was, um, it was getting really hard to sell. I needed high number of endpoints. So let's just say the first customer There were 110 endpoints. M so $5,500 at $50 a year and it took six calls and a lot of work to get that 110 endpoints. And I, which meant I either had to increase the price or I had to, um, figure out how do I get more endpoints. Uh, so sell to bigger businesses. Now, selling to bigger businesses is fine, but when you sell to bigger businesses and you've got five employees, no one's buying from you. So, and so what we realize is MSPs are, uh, small businesses mostly they're 20 employee companies, 50 employee companies, 10 employee companies to employee companies in some cases. But they often represent much m more endpoints than they are in size. So if you're um, a 500 employee company, you have 500 endpoints and your revenue is represented that you have 500 employees. So whatever the average revenue is, say you've got $100,000 revenue, uh, uh, you've got $50 million of revenue. So you're decent sized company. If you're an MSP, you might have $2 million of revenue, uh, but you potentially represent with a handful of employees. So you're a small business, but you represent thousands of endpoints. And because you're billing these customers to help them. So we could go to an MSP and we could sell a thousand endpoints, but with the same, hey, you're talking to the CEO. Uh, we're a small business, you're a small business. No one really cares. When you go to a bank, they're like, well, where's the support team? How big are you? Who am I going to call if there's a problem? You're telling m me. You're the tech lead, you're the cto, you're the chief sales guy. Uh, they don't want to do that. So the MSPs allowed us to break through that. And we went from 50% MSPS, uh, and then in July 2021 and uh, now it's back to I think more enterprise business than the MSP business again. But in July 2021, uh, there was a vulnerability at a product called Kaseya, which is a tool that MSPS use. And it pushed ransomware out to like 40,000 businesses worldwide. And threat lock was the only thing that blocked it. So it became like instantly overnight. I was begging people not to install. I was literally like, don't install any more agents, don't install any more agents. Our data centers are on fire. Everything is 100% utilization. And I'm like, I don't know what to do. Can you please stop installing? And we went from adding I think three or four hundred thousand dollars of revenue every ARR a month in June of 2021 to one and a half million overnight like that. Because suddenly the entire MSP community knew that this is how we stop these attacks.

Speaker A: So was it more like a pivot towards MSPs? Did you intentionally decide this is where the future is, this is where we need to focus?

Speaker B: No, I don't think it was a pivot. I think MSP is a very important vertical, but they become one vertical. So if we look at today, I think over half of our business is non MSP right now. And 75% of our new business is enterprise. But MSP is the most important. But if you look at it as enterprise versus msp, then you think about pivot. But if you look at it as I want to sell to, so Orlando Magic, uh, is a customer of ours. A lot of sports teams actually are customers, ours. So we consider that vertical sports teams. We have hospitals, that's a vertical. Health care, we have banking, it's a huge vertical that we sell to. We have airlines and transportation, uh, like, so we got biggest airports in the world. Some of the biggest airlines in the world is customers. And uh, that's a vertical. MSP's is a vertical. So I don't think it was necessarily a pivot. It was, let's concentrate on this vertical as one of the verticals we do, but it is one of many verticals. And it became a really, really important vertical because as a startup, but also it gets us to, I mean our goal, our mission as a company is to make sure the entire world adopts a zero trust approach to security. When you think about verticals in general, you think about the consumer of the product, the end user. But you could say we're in the aviation verticals. We got JetBlue, Heathrow, Colorado, Denver Airport, we got uh, uh, Melbourne Airport, a whole bunch of airports, airline, um, ah, that we have as customers. But inside that vertical there's also a bunch of small aviation companies. Uh, so that's where the MSPs become really important because instead of having us considering, hey, we've got a small aviation company that makes uh, parts for a plane. The MSP is the vertical and they sell to the small aviation company. So it allows us to capture the small business part of the world, which is 30% of the world, if not more and more, whereas we couldn't do that. And if our mission is to protect the entire world, we have to figure out how we're going to do the small business part. And the MSP becomes a really, really important part of that.

Speaker A: It sounds like throughout the business this whole concept of zero trust has been controversial, that it's been back from the accelerator telling you that you weren't doing the right thing. And presumably it's because, as you said, the protection part is not that hard. It's like the implementation or something along those lines. I'm guessing, because with zero trust, there's a lot of work on the customer to figure out what they allow in or allow through. Right. So is that part of the reason why people thought it was uh, a bad idea at the time?

Speaker B: So I think there's two parts to this. So first of all, if you go back to 1995 or 2005 or 2015, either implementing, and zero trust isn't a product, it's an idea. So, and there's two ways you can have an idea. You could say, let's just forget technology. You could say, I'm going to leave my front door unlocked and anyone can come into my house that doesn't have a criminal record. And that's pretty much how public, uh, facilities happen. If you go to a shopping mall, anyone can come into the door unless security's locked them because they've been shoplifting before. And then someone comes in, they shoplift, they get put on the list, they're not allowed back in. Uh, and that's, you could do that with your house, you could do that with shopping malls. And if you think about computers, that's how computers are, uh, treated now. It could be anyone can access my files. It could be anyone can log into my email. It could be anyone can access, uh, run any software they want in my environment, unless we've explicitly said it's denied. And that's how typical antivirus EDR security works. Uh, ThreatLocker. The idea is zero trust and different levels of security. But let's just start with what we started, Application Control. Uh, we said you can't run software unless it's been explicitly approved by the business. Now people don't change the software they run every day. It's relatively easy. But to get to a point where you know what's run is terrifying because if you're an airport, you probably have 10,000 different apps across your business. So historically creating that database, creating that list, maintaining that list, updating that list was really, really difficult. So a company like Threatlocker, uh, we're 800 plus employees, I think a thousand endpoints in our org. It takes us um, two hours a month to maintain it. But in the old way it would have taken us two full time people to maintain it. So threatlocker came in and made it easy. But the other reason I genuinely believe this is considered controversial is because it's threatening. Because for uh, I mean threatening to our industry as a whole. Because for the last three decades the industry has peddled, we have a better mousetrap, we have a better antivirus, get our next gen, get our edr, get our threat hunting, get our sim, get our soc, all creating more revenue for the industry when you actually implement zero trust. Now I'm not saying these tools don't add some value, but the threat now gets stopped. So what happens is we have an industry that recognizes that zero trust is the best way. It's difficult to achieve and it's hard to make technology that makes it easy. And that's what we've done. But what other players in the industry say is rather than them coming in and saying oh, um, because they're already the best at detection maybe and that, or that perceived best at detection. So they, but it's not good enough. So they'll come in and they'll say things like zero trust is great, it's just impossible. So you have all of the CEOs selling the weight loss pill saying exercise is great, but it's just too hard. You should take weight loss pills. So uh, um, the uh, trying to, trying to tell people don't even bother doing that, it's too hard. Whereas what we're saying is we're just going to make this easier and easier and easier and, and let's just focus on that. So it's been very controversial in that people are scared. It's difficult. But what we've done is say, well, we're going to make it easy and we're going to let our customers tell everyone else how easy it is and how manageable it is. And then we're going to let the competitors just keep saying we're doing it's hard because that's the only, that's the only argument. You can't argue against a zero trust approach other than it's going to be too hard and it's not hard. But if you say that you scare people, you create fear, so then they stick with the old approach.

Speaker A: If people sign up for your product but don't stick around, the problem usually isn't the product, it's that every user gets pushed down the same path no matter what they came to do. Product Fruits fixes that it adapts to each user and guides them to the result they want. That's how Fitness Player grew paid conversions by 50%. Go to productfruits.com to book a demo. Mention SaaS Club and you'll get a free 30 minute onboarding teardown. They'll show you exactly where users drop off and how to fix it. Let's uh, I'd love to keep talking but we should wrap up and get uh, onto the lightning round. So I've got uh, five quick fire questions for you. Ready?

Speaker B: Yes.

Speaker A: Okay. What's a uh, common piece of business advice or startup advice that you disagree with?

Speaker B: I don't know what's common unfortunately but I would say um, the worst thing you can do is analyze and you are told that a lot of the thingy, market research is overrated. Uh, the fastest way for you to know if your product is not viable is well, is get it in front of someone and ask them if they're willing to pay money for it. If you interview 100 people they're going to. The data collection mechanisms are so unreliable you're just going to waste time. Just develop and sell. That'll tell you if it works.

Speaker A: What is a great book that you have read recently?

Speaker B: Okay, so I don't have an answer to that because I've been disappointed with nearly every book I've read. I prefer to consume very summarized direct content that solves real problems. And I'll give you an example of this. A book I tried to read and got halfway through and said I got my answers in the first three pages and shouldn't have read anymore. There's a book called the it uh, was written by the CRO of HubSpot. It's called the Sales Acceleration Formula. And there's nothing wrong with the book, by the way. It's absolutely right. It says you should measure your sales team. There isn't a right or wrong. See what date, use data to determine the type of people you're hiring, what you're doing. Uh, my problem is the book is 250 pages and it tells you that in the first three paragraphs. And you could have read that in a blog post instead of a book. So I would say, uh, that was the fact of the book. So I'll say that was a valuable book. Uh, but I would say consume shorter content and save time, uh, rather than reading 400 pages when you could consume it in two.

Speaker A: What's, uh, a lesson that you've had to learn the hard way?

Speaker B: Oh, lots. So, um, I mean, I gave the example of the trademark, but I think I wouldn't have changed, given the same set of scenarios, I wouldn't have changed it. I think the one lesson that I've learned the hardest way is that, um, uh, money and does not solve problems, it changes them. Uh, when you're a startup, you have one problem and I do not have. You do not have enough finance to solve your problems. Once you have pretty much all the finance you need to solve your problems, it now becomes, I can't find the right developer, I can't find the right team, everything else. So, uh, that's probably the hardest one, which is, as a startup, money's your only problem. Later on it will not be your only problem. And once you, when you have no money, you have one problem, and that's I need money. When you have money, you have a hundred problems because now you need to solve them all and money didn't solve them like you thought it would.

Speaker A: What's, um, a tool or habit that saves you the most time?

Speaker B: Tool or habit? Um, I think standing, uh, I think that the one thing, I don't know if it's a habit, but, but the one thing I would say you should do is keep everyone involved in anything as close to together possibly, and I mean physically. I genuinely believe that if you are sitting across the room from someone, whatever problem a customer has that's going to take 8 hours can solve to solve, can be solved in 15 minutes if you physically stand next to each other. So I sit most of my time on the office floor with everyone else. If a customer has a problem, I will walk over to the person and then if they say, well, this person's working on something, I'll walk over to them. I think get as close as you can and solve things, um, as fast as you can. Always. Um, urgency is probably important, but making sure you keep everyone together.

Speaker A: Great. And what do you enjoy doing outside of work?

Speaker B: Um, there's not much outside of work. Um, I suppose, uh, the one thing that we've managed to keep, uh, throughout this is me and my wife ice skate together. Ah. And we ice skate together. We do some. And I use this as we started as adults, but we do pair skating together. So we'll skate together. We'll lift and spin. Uh, and we try and do that every Friday morning. I'd like to do it more, but it's, uh, it gets our mind off work because pretty much everything else is work.

Speaker A: Well, Danny, thank you so much for, uh, joining me. Great story, great conversation. If people, uh, want to check out Threat Locker, they can go to threatlocker.com and if folks want to get in touch with you, what's the best way for them to do that?

Speaker B: Um, probably LinkedIn. If you want to message me on LinkedIn, you might take a while to get a reply, but someone's always, uh. Unfortunately, at this point, there's three people, but they'll get the important stuff in front of me, so reach out to me on LinkedIn.

Speaker A: Awesome. Thank you. It's been a pleasure, and, uh, I wish you and the team the best of success.

Speaker B: Uh, thank you.

Speaker A: Cheers.