This episode of Founders' Field Guide is brought to you by Microsoft for Startups, Microsoft for Startups is a global program dedicated to helping Enterprise ready B2B startups successfully scale their companies. The program has been around for a couple of years, but I recently became intrigued when former investor like the best guest, Jeff Maas, took over Microsoft for startups, provides companies access to technology, including Azure, Cloud and GitHub, coupled with a streamlined path to selling alongside Microsoft and their global partner ecosystem.

Microsoft for Startups has a very compelling approach to working with startups and driving their long term business value. If you're a founder running a B2B company targeting the enterprise, you should definitely check them out at Startup Stop Microsoft Dotcom.

To hear more about the program, stay tuned. At the end of the episode to hear from me, Jeff Marr and Greylock partner Sam Mohammedi.

Hello and welcome everyone. I'm Patrick O'Shaughnessy and this is Founders Fialka. Founders Field Guide is a series of conversations with founders, CEOs and operators building great businesses. I believe we are all builders in our own way and this series is dedicated to stories and lessons from builders of all types. You can find more episodes at Investor Field Guide Dotcom.

Patrick O'Shaughnessy is the CEO of O'Shannassy Asset Management, all opinions expressed by Patrick and podcast guests are solely their own opinions and do not reflect the opinion of O'Shannassy asset management. This podcast is for informational purposes only and should not be relied upon as a basis for investment decisions. Clients of O'Shannassy Asset Management may maintain positions in the securities discussed in this podcast.

My guest today is Todd McKinnon, co-founder and CEO of OCTA, the leading provider of identity management for enterprises. Todd started OCTA in 2009 after realizing that enterprises would need a robust solution for identity management in a world where everything was quickly moving to the cloud and today accounts over 7000 enterprises as customers. Our conversation focuses on how Todd decided to leave Salesforce to start octa the painful early years of growing the business, how companies can create and define a new market, the different roles he's had to play as the company grew and went public, and the frameworks he's put in place to continue to innovate and test new things as a public business.

I hope you enjoy our conversation.

So, Todd, I always try to come up with a clever way to start these conversations, and for you, I thought a neat entry point would be to ask what the best slide in the PowerPoint deck that you presented to your wife about starting OCTA was there's a lot of competition there for that title.

I wrote the slide deck in twenty eight for context for folks listening. It was a reaction to when I came home from my job at Salesforce. One day I was running engineering at Salesforce and at the time that was really the preeminent Selous today. But at the time it was really the preeminent cloud company. Also, we just had a baby, so we had a six month old daughter. My wife was at home with the baby. I was busy at work and I came home one day.

I'd been thinking a lot about it and the transition to the cloud and I thought a lot about this. And I'm going to quit my job. She'd been at home with the baby all day and she'd been watching the news about the financial crisis. It's like that never ending stream of news about Lehman Brothers is collapsing and will the financial system uphold? And it's the worst financial crisis and the worst economy since the Great Depression. And I came home and said, I want to quit my job.

She looked at me. I remember it like it was yesterday. She said, What are you crazy? But she used a more colorful language than that. It's funny now because it kind of worked out OK, but it was really scary for her and for me at the time. We wanted to talk it through and make sure we were making the right decision. So I did anything a logical engineer would do as well. Maybe not anyone, but I wrote a PowerPoint presentation for the title of it was My Proposal to Quit My Job and start a new company subtitled Why I'm Not Crazy.

So it was probably like thirteen slides long or something like that. And part of it is if you look back on it now, you can link to it in the show and it's this online. Part of it is sounds pretty forward looking. It's cloud computing is going to change the world and all the big companies in the next ten years will be built on top of cloud computing. And about the recession, you know, Microsoft and Oracle were started in a recession.

So it's actually an OK time to start a company. So I sound pretty forward looking, but then I'm not that forward looking because if you look at the next 12 slides, they're all basically CIA for when it didn't work out. You know, I can get a new job. We have enough money saved up. Back to your question. I think that the best slide in it has to be where I predict that the wild upside scenario for my entrepreneurial plan would be OCTA goes public and is worth one hundred to one hundred and fifty million dollars.

Mission accomplished. Yeah, hindsight is 20/20, but it's a scary thing to quit your job, especially when was such a good job and the situations and economy situations and so forth. But you could see at the time working at Salesforce, that cloud was a big deal. It was going to have an impact on every layer of the technology stack. It's no guarantee that you'll be successful. Started a new company in those times, but there's no more fertile environment to start new companies when there's a time of transition.

Talk to me a little bit about those very early days and what you sought out to do at the very beginning. I know obviously OCTA has changed a lot from day one until now. What did day one look like? What were you in the founding team thinking about and trying to tackle?

The original idea was to take advantage of the shift to the cloud. So at Salesforce, we were very successful and very disruptive and it was very hard for people to compete with us. And we were delivering a ton of value to customers. But also at that time, Salesforce is an application company. Right. But also at the time you saw Google released Google Apps for Domains. So you could see it wasn't just going to be business apps in the cloud, it was also going to be collaboration apps, email.

And at the same time, around that time, about twenty six Amazon came out with Amazon Web Services. And then you could see that, hey, now it's the infrastructure layer. So if you take collaboration apps, you take business apps, you take infrastructure. It was going to be the whole stack was going to move to the cloud. So I got really excited about when that shift happened over the next decade or so. What are the inevitable next set of things that are going to be required?

What are the inevitable tools and other platforms and other systems that are going to be required because of all that shift to the cloud? And so the original idea is actually to build a system that was a monitoring system for other court applications. So if you were it in a company, this product would tell you if all of your other systems were up and running, because the products that did that at the time were all predicated that the company was running the software in the new architecture.

They weren't running the software, but they still needed a way to monitor it. So that was the original idea. In fact, the original name for the company was called Sure, your SaaS applications assure that they're up. But then my wife and my co-founder told me that that sounded like a French perfume. That name was not long for this world. We talked to a bunch of perspective I.T. people that would buy the service. And while they were.

Excited about the cloud, they were kind of lukewarm on the monitoring idea, their thing was like, hey, we get this from the cloud because we just want to work there. Maybe some big companies would be into it. But what kept coming up over and over again was just basic problem of we can't log into these things. When they were all in our data center, these applications, we would just hook them up to Microsoft Windows login or active directory, and it would be easy.

But now Salesforce comes from the cloud box, comes from the cloud work that comes from the cloud. It doesn't work as well. Can you solve that basic problem? For me, that was like gold because that was something people had a pain at that moment and that would pay for at that time. And then also, I knew enough about the architecture and the broad things you would have to implement to make that really easy was a company that really could evolve into a platform on its own.

Pretty early on, we pivoted to identity management and to the if you look at the mockups that we drew really a couple of months into the company, when we pivoted from Sacyr to OCTA, the mockups look strikingly similar to the product today. Obviously it's evolved, as you said, but it's identity management. It's a complete solution. It has people data and application data and policy between the two. And so it was a pivot, but it was early, which is the best time to pivot.

It's often very hard to imagine the scope of the challenges in the early days when we look back now from a successful outcome. But I'd love you to describe what it felt like, what the challenge itself of building that early Mark felt like from an engineering and company building perspective back then.

A bunch of emotions, I remember. But one of them was that it was striking in that if I didn't do something, nothing happened. It sounds strange, but coming from a big company, you could really put your kind of shoulder to the wheel and work really hard for a couple of days. But then a couple of days after that, if you kind of maybe didn't work as hard, things would still happen. And decisions are being made and things are moving forward.

When I started OCTA, I just remember thinking, like, if I don't do everything today, there's nothing happening and we're not making any progress. And that was a very different feeling. And I had to get used to that. You had to get used to the frenetic energy of doing everything and make brick by brick trying to build it every day. So that was a big difference. The other thing I remember, too, is that starting a company felt to me for the first time in my career that it was the situation where no matter how hard I worked or how smart I was about my decision or how well I did my job, there was just a decent chance that it wouldn't work.

It was just out of my control. And that was hard, too, because before that it was if I worked hard, I would be successful. Most likely the companies were established, industries were the fine. But with OCTA in this, like with all new initiatives, whether whenever you're trying to do something new and create something new, there's always an element of timing and luck and chance that it just won't work out. And people that can be successful in that environment have to be able to just I can't be the same.

They have to be able to believe even when they don't believe, you have to believe, even when you don't believe, because you have to get used to that doubt and keep pushing forward, even when deep down inside, you know that there's a chance it might not work.

What did the very first functional meaning used by customers version of the OCTA product look like?

It accomplished a very tactical purpose, which was it made it super easy to log in to your cloud applications with your Windows password. So you come to work and you type in your windows. Everyone had Windows PCs, so you type in your Windows password into your computer and it would get you into Salesforce or Box or Workday. Any of these court applications that weren't on your own network.

Obviously, everyone listening has experience logging into stuff. It's like this core action of the digital world. I don't want to take for granted that anyone, myself included, really knows much about what's going on behind the scenes here.

So I'd love you to just give us sort of a crash course in identity management, which is sort of the category that I think of is as leading. Talk to us about what the history of that has been for computers, why Cloud made it different and why it's so generally important.

Identity management is systems and processes and technologies that identify who users are and what applications they can access or what computers they can access. It's something that's existed since the first mainframe. IBM mainframes used to have identity management systems inside of them, but it was all very proprietary to that system. It was the system was the mainframe and the applications were the applications on the mainframe and the users were the users that would submit jobs on the punch cards or later in the terminals as it's evolved over the years, the main changes have been like with a lot of computing.

There's been more computers and more users. And if you look at the big arc of what's happened over the years, you had mainframes with few computers and. Relatively few number of users, fewer number of applications, and then you got so many computers and all those dimensions increased, obviously, then you got a client server where you really start to get an explosion of the number of computers, obviously, and by association, the number of users and the number of applications.

And then in the client server era is when you really first started to see identity management systems that were prevalent, whether it was the most prevalent being Microsoft Windows had a system called Active Directory, which is basically the user database for your company's I.T. teams list of who could log into which Windows servers. But what really happened between client server, Internet and cloud was that you drew it on a graph, just saw exponential explosion in all of the dimensions I talked about, you saw an exponential explosion in the number of computers, the number of applications and the number of users, especially when you get to mobile, it's just through the roof.

And so all of a sudden, this what was really a sleepy industry. That's identity management industry. It was a really kind of something that was embedded in other platforms like Oracle or Microsoft. And it was important for those platforms, but not important enough to be its own standalone platform or company. You saw such an explosion that when we came along, it was the perfect time to pull that system out of all the other platforms and have it be its own platform.

There's so many applications and so many users and so many computers that you had to manage it as its own primary thing because it unlocked the choice and the flexibility to get to all those computers, to unlock all those applications and to do all simply and securely.

How does that literally work on the back end as you're describing this sort of transition from the early days to today? I don't think I'd have a good guess for what literally is happening on your service or platform versus what used to happen. Let's say just locally. What was the major innovation in the early product?

I'll tell you when it doesn't happen. When it doesn't happen is the experience everyone has experienced. When every system you use throughout the day, every computer, every phone, every application doesn't know who you are. I mean, you have to authenticate to it. You have to type in your password again. You have to maybe do a new six digit code to get into it. You have to pull up your account independently that identity management is not happening in the big picture.

It's happening at each individual application. That application is checking your password, checking your user record, looking you up in a database that's local to that system and then doing its thing. But when act are involved, it's basically all that is done centrally. So there's one system that has kind of a meta map of all of the applications that you should access and all the and your one credential that you can use to authenticate yourself. The authentication happens with OCTA and then it's an integration challenge.

At that point. It's an integration challenge of OCTA handing off that authentication to all of those disparate computers and applications. And then even not at the time when you actually log in. But even before that, OCTA keeps the different user records and directories in sync across the different systems so that based on the policy of your company, it says, who are the right people that can access this application from this device? It's really a moving from a distributed system to a centralized system that is integrated to all the distributed systems.

That's what makes it difficult to do invaluable. In the early days of OCTA, the biggest pushback we've got was there's never been a company that's done this before. There's never been a company that's been successful in this market. And that was because it wasn't, like I mentioned before, the technology trends had driven to it being a big enough problem. And then what we did is we made it really easy to integrate these things. We built the system that was easy to build an integration to every application environments.

I love thinking back to the early days and I found this interesting Ben Horowitz quote, which I love your reaction to. He said, I was excited, but the first couple of years were tough times. So tough that they made most people want to quit. Sales were slow and money was running low. Faced with the prospect of running out of cash and no raise, it would have been easy to hide from the problems, make excuses or give up.

Todd and Freddie felt the pressure, but they did not succumb to it, reworked their strategy, improve the team and found a way out. What does that make you think of most tangibly in the early days of OCTA brings me back to that time.

It's physically painful. I think as an entrepreneur you get these things burned in your psyche and yeah, it was a tough time. And I think for all new endeavors I mentioned earlier about believing when you don't believe, I think for all new creative endeavors, you have to take a risk and put something out in the world that the timing may not be right and it might be a timing thing or it may just be something that will never work.

So you have to thread the needle between building something before everyone else knows it's obviously needed. But you have to build it not so early that it kind of falls on a world that. Doesn't need it, so you have to thread that needle, and I think for us, cloud was being adopted, but we were selling cloud security and cloud identity, which is the later parts of cloud to be adopted because they were adopting cloud systems, but they weren't totally sure about putting their security on the cloud.

The first couple of years we built the product and it worked, but the market was still not quite there. We weren't quite to the point where there was enough cloud or enough confidence in it for OCTA to be successful broadly. So we had a tough particularly like 2011. It was a tough year and have been outlines there. We were trying to sell the product. Sales weren't going very well. We were trying to close our series B round and I remember we had the target for the quarter was we wanted to get two hundred and fifty thousand dollars of new bookings for that quarter.

And we had a term sheet signed for the Series B that basically we committed the sales plan. We said we're going to hit two hundred fifty thousand and the actual number we delivered was like one hundred thousand. So quite a bit lower. And to his credit, David Weidemann from Coastal Ventures didn't pull the turn. She stayed with us and he did take a quick trip up to San Francisco to see what the heck was going on. But we were able to convince the team and the investors that we needed more time, needed to get a little bit better.

The market needed to improve. And I think the biggest thing was the market caught up to us. More applications, more devices, more applications made the problem really painful enough. And the product got well enough to buy 2012. We were kind of off to the races.

I'd love to hear the progression in the early days towards something that I call default mode. I think the technical term is like you become a cognitive reference, like Kleenex or something. That sort of is the thing that people think of when they think of a category or vertical and I think is achieved that in its vertical in authentication and identity management, it just sort of almost like striping payments or something. It's just sort of the one that people go use by default.

Obviously, at the beginning that wasn't the case. So to what do you attribute that transition from not being a default solution to being that default mode solution?

I think it's part of the pain or the apprehension we've talked about is necessary in that. To achieve that position, you have to define the category, so to speak. You have to create the category. And as I mentioned, the first several years of OCTA, it was there's never been a big independent identity company, not a big enough problem by us being out there, just being the one that proved that wrong, being the one that made it clear that if you really did make it easy to integrate all these applications and you made it easy to roll out and you built these parts around the core platform, you could make something out of a market people thought weren't there.

And I think you have to go through that pain. You have to go through that uncertainty to define the market, which leads to being that default choice. I was telling someone the other day that someone was asking me about what the name OCTA meant. I said, it's a real word. It means it's a skill for cloud cover. A doctor is for cloud cover and for OK does have cloud cover. It's a scale pilots use. When I said to myself when we picked it, it was very early and we thought it would be cute and funny to have this name at the tie.

But but now it's just a company that does identity management, which is kind of cool. It kind of looks like no one really knows what it means anymore. It's just the company that does what this category that we defined is.

In what ways has that most expanded so early use case being one thing now, OK, to doing a lot of things. What are the most interesting ways that what you can do for customers has grown?

There's a few of them. The biggest one probably is we originally started, as you can tell, by the way, I talked about the early thinking and so forth as it was for employees. It was we sell it to companies and their teams install it and then employees log into it to get their work done. The biggest change was that about three or four years into selling the product we had, our customers started to use it for their customers. They would come to us and say, you know, we're using this for our own employees, login for all their applications, but we have this system that we're building for our customers.

Or I remember there was a big pharmaceutical company called Allegan, and it was they were using it for their employees. But then they came to us and said, we have this new app where we have all these doctors around the world that are prescribing some of our medications and we want to make the system where they log into that. So we want to use OCTA for that. And we looked at each other and said, I mean, technically it would work, but it's not really how we intended it to happen.

So there was a bunch of customers that wanted to do that and that led to our second big part of our business, which is customer identity. So now about twenty four percent of our revenue is our customers providing login for their customers, be it on their support side or on their maybe their mobile app or their their regular website where the login for that. So, for example, Major League Baseball dot com, if you log into the MLB app, that app that log in is through OCTA.

We were talking a bit about platforms versus applications and I wonder if those are the two probably primary. Taxonomies that you would place technology companies in, if there are others, let us know, but I'd love to pick kind of each apart and hear what you think about the future of these kind of different business types or business models in the technology space, starting maybe with platforms.

I think there's definitely a concept of platform, which is just basic infrastructure for a wide range of applications. And the best examples, of course, are operating systems, Windows OS. And I think that when we look at what all these organizations are doing as they transition to the cloud, there's this new concept of what the operating system will be, and it's independent of any one computer or any one application. They're looking for all of their providers and all of their services be the basis or foundation for multiple types of multiple pieces of functionality that might manifest itself in the simplest way as an application vendor, just trying to add more modules.

There's also another dimension where companies want to move from the infrastructure up into the application layers or the solution layers. Probably the most successful company ever in the history. Doing this is Microsoft, where they started from programming languages and operating systems and then moved up to have arguably what is the core of the company today, which is the office business with the office suite and then later exchange and collaboration moving from the infrastructure up. When I look at companies out there and OCTA included, I think about how we can broaden on both dimensions.

So providing just broader functionality, whether it's workforce identity and customer identity, but also how can we move up the stack and the solutions or even down the stack and the infrastructure? So I think it's really exciting to think about all of these emerging companies and all the established companies who's going to be most successful most quickly in all those dimensions, broadening out functionality, moving up into solutions and moving down into infrastructure. And I think one of the most exciting things to watch is going to be who can do that, the best and the most effective going forward with so much to potentially do.

How do you make the decision with even as a big company now still a limited set of resources on where to focus next? And I want to make sure I understand both directions. I think going up more closer to applications or solutions is pretty clear. Everyone uses applications all the time and know what that means. I don't know if I follow what it means for you specifically to go down into infrastructure. Can you just say a little bit more clarifying the difference between kind of what you do now and what the infrastructure version of OCTA would look like?

A couple of ways to think about it. One way is if every authentication involving technology in the world, it's far beyond the websites everyone uses or the mobile apps everyone uses. It extends to things like how machines interact with each other and how machines on the network identify themselves. It extends to how, with some of the ambient computing things like Alexa and Google home, we walk into these rooms, how we're identified in that environment, the requirement for identity and the requirement for authentication and security goes far beyond the interactions between people and applications that we cover today.

If you define that workforce, people at work, logging in applications or people ads with customer websites, logging into those websites and mobile apps so us extend into an infrastructure would mean APIs and SDK and capabilities to facilitate login and identity across everything. Every interaction between machines and machine to machine and people to machines in every scenario, which is pretty broad. I mean, it's pretty broad and expansive compared to what we do today.

You mentioned the core maybe insight or motivating factor that you had to leave Salesforce was this massive shift to the cloud.

I think there's an argument to be made that there's plenty of room left to run in that transition. But I'm also curious whether since you see kind of so much in your connected to so many other things in technology ecosystem, if you see any other signs of a similar size shift or maybe not as big, but an important or notable shift that might represent the sort of opportunity to build that. The shift to cloud did represent that in 2008.

One area that is interesting, I think the way people consume information and the move from television and linear television to streaming and web and the migration of various media, whether it's radio or TV to audio format of podcasting, whether it's from publications to substory and people writing newsletters, media transitions are always there's a lot of money to be made and there's also a lot of impact they have on politics and culture and society. So they're always impactful. But this one is given how connected we all are and how the potential for value creation and the right ideas to spread.

I think the whole transition going on in media. Going to be incredibly impactful and profound, I'm curious, both in that transition through two lenses, kind of what you think first is opportunity and second has implications. So starting with opportunity, what opportunities do you think that this media format shift represents?

I guess there's optimistic and there's pessimistic views on it. I think the optimistic view, which I tend to take, is that it's going to provide a lot more accuracy and clarity and satisfaction for people as they get information and they get entertainment that's more tailored to them and what they enjoy. And I think that that's the fundamental difference, I think between media were coming from a media where we're going to is just how personalized it is and how targeted it is.

And it's something that we're not just as media consumers. We're still not totally used to it. Right. We're at least people of a certain age are used to looking at a webpage or looking at a movie or looking at a podcast that's produced generically for a mass audience, not something that's targeted specifically for them. So I think that that's pretty exciting and interesting and could lead to a lot of good outcomes.

I'm curious what you think about the future of I'll call it our own digital identity and sort of the degree to which I as a person that's always connected to devices and on the Internet and stuff, are you owns and has sort of control or sovereignty over that identity. Is that something that you think is important? If so, why? And could OCTA be involved in that sort of thing?

I think it's absolutely important. It's so important. I think that technology won't reach its potential if the industry and I guess society doesn't figure out a better story for it. Right now, the solution is basically everyone does their own. Every media outlet has their own identity. Every company that you log into as a consumer has their own version of it. Social media definitely has their own. The big device, Eco-Systems, Apple, Google, Microsoft, they have their own.

And I think that unless we get a way to simplify the experience for consumers across all of it, across these well-established platforms, and this is something people don't realize a lot. It's especially for the smaller companies, a smaller technology companies, them dealing with the privacy and the security implications of this customer data is really hinders their ability to innovate and to deliver services in ways it puts the big platforms as at an unfair advantage. So do you think about something like GDP in Europe, which is a privacy regulation that really was not directly, but really in a lot of ways came down because of the big social media companies and what they do with data, GPS and a lot of ways has hurt the small providers because they're the ones that don't have the resources to comply with handling this data and doing it in a secure and scalable way.

GDP and a lot of ways has hurt some of the businesses that ostensibly it was supposed to help. So anyways, I think it's very, very important. I am very much focused on, over the long term, having to help with this. And I think one of getting back to something we were talking about earlier is that for us to be most effective, we have to get to a big scale in terms of our business users, companies, integrations, because the more scale we get, the more we can help set the standard in the world to make it more uniform, more controlled by the end user, more representing both the big companies and small companies.

And that's why when I talked about earlier us focusing on some of these network effects and these positive returns to scale, that's why we're focused on that. I think it's unrealistic to think that technically, physically, everyone will connect to everything through OCTA, but it's not unrealistic to think that we can help set a standard that then will be adopted by everyone because so many people follow it. That then will solve a lot of these issues, these issues of complexity for the end user, privacy and security issues for the providers.

And the end result of it is to accelerate the adoption of technology in a positive direction, which is kind of our core vision, our core vision of actors to enable everyone to use technology in a safe and secure way.

Do you think that the way that we are as people digitally will be a lot different in 20 years along simple dimension's like will we still use passwords? How portable will our value and our sort of settings and our identity be across the Internet? And how do you think it'll all look in 20 years?

The things that are very clear are that there will be more technology, there'll be more applications, they'll be more specialised types of devices. All of these trends are continuing. We have to make it better. We have to make it easier. And you're always going to have passwords that always be a fallback and a way to do something if you need to get in the back door or get in the emergency hatch or some situation. But we have to make it simpler and easier because the ease of use and the security concerns are too much of a drag on the technology.

So it's I'm confident. Figure it out and make it a much more portable and seamless experience over the next several years. I'd love to abstract away from exactly what OCTA does and focus now more on how it does it. Sort of the company building aspect of this that you've experienced from I love the way you described it. It were at the beginning. If you didn't do something, nothing got done to obviously a much different scenario. Now, if you had to segment OCTA into chapters thus far, how many would you pick and what would those chapters be?

The first chapter would be found into that summer of 2011. I remember that. I mentioned that in that summer we had target was 250000 an hour and we did 150 and that was not good. The third quarter of that year, I remember like it was yesterday, it was the target was about three hundred and twenty thousand. And we did close to four hundred and relatively small amounts now compared to what we do now. But I mean, at the time it felt like we had just won the World Series, the World Cup and a gold medal all in one.

It was like, I remember that joy, like it was yesterday. And from then on it felt like we had something working and we could scale the business up. That's the first chapter. The second chapter would be another time. I remember real clearly is 2014 when we on one day Microsoft announced a competing product. So they basically announced like the octo killer. And that was pretty scary. But the reason it was a chapter, Mark, is because it really changed the game and the world from company that was maybe couldn't build a company in this space and maybe couldn't build it.

Maybe it wasn't a big enough category for an independent company to the biggest software company in the world wants to do it. It must be pretty good besides the fact they had a competing product and also they were pushing everyone to the cloud with Office 365 Anzour. So they were pushing everyone into the cloud in the next few years after twenty fourteen were really good for the company. And then the chapter we're in now is really started at the IPO. We went public in twenty seventeen and we talked about it as obviously was a big accomplishment, but we didn't want to be satisfied with just going public.

We knew that we had the shot to build this iconic long term technology company. So we actually talked about the IPO like a high school graduation. We said high school graduation is great, but you're kind of expected to graduate. So you don't want to be that person that your best days were the day you graduated from high school. We've moved everyone on past that and we're really focused on creating this broad platform, helping customers at scale, keeping the team as fired up and motivated and hungry for the future as they were as they've been all along.

And it's an interesting exercise to build a company at scale. A lot of the challenges are the same and a lot of them are different. And it's definitely a once in a lifetime opportunity.

Can you describe in each of those three chapters the most common nature of the challenges and sort of the role that you as a leader of the business had to play?

I'll start from the current chapter, and I think that a lot of my job now has been for the last few years. It sounds kind of obvious, but it's not doing a lot of the hands on work. I have great people all around me in every function doing amazing things. So a lot of my job is thinking about how to make sure that everyone stays hungry and stays ambitious and doesn't believe the hype. Like they don't look at the stock price.

They don't look at the accolades to the degree we've gotten them from the industry. They really think about more about the potential of what we can do and how what they're doing can contribute to it versus what we've accomplished. Like when I talk to new people that I interview, one of my favorite questions is like, what do you want to accomplish and what is your ambition? And kind of get into why you joining? And it's something I really like to hear is anything along the lines of I want to accomplish X, Y, Z?

I think this is an interesting potential and I think this is why that might be a good environment for me. Not a great example of an answer would be, well, you guys are grown really well and I think it's probably a successful company. So it's everything we can do to try to. Keep people hungry, keep fired up, and part of that is the most important part of that is outlining this clear, exciting vision for the future. What's two or three steps ahead that will keep people hungry and and motivated?

I think that's the current chapter. I think that if I go back to the period from Microsoft's competitive announcement to the IPO, that was really about everyone knew the market was the first product, the workforce identity, the market was big enough for that to be a sizable market. Those years were about trying to make sure we had a second product or this customer identity, establishing this as our second product and improving as getting ready to go public, that we weren't a one trick pony.

We weren't this company that was going to have some good growth sub one hundred million in revenue and then get to one hundred million or 200 million, hit a wall with a narrow product focus, which happens unfortunately to some companies. So that was, I would say, broadening the product portfolio before that. It was a lot of the first chapter was just convincing people in a world where this wasn't a defined category, it was far from a known thing that this would be a successful market or opportunity, just convincing them to believe, convincing them to get on board and take this leap with us and try to contribute to it.

And it's a different kind of person that you can attract to do that. I'm lucky we got some of those kind of people back in the early days.

What are the keys to getting those kinds of people early on? And I guess this is a question that stretches across octets history, which is what have you learned about effectively recruiting, identifying and winning over great talent and then fostering that talent internally?

For me, it's been clarity on what we're trying to accomplish and then an authenticity and a transparency about how we'll get there. What I found is that that really resonates with people. People are OK about the challenges. They're OK with uncertainty, but they just want to know where they stand and where you as the leader stands on these challenges. And then one of the mistakes I made early on was I thought that as the CEO and the leader, I had to have all the answers.

Sales aren't going well. We're missing this quarter. I better have an answer for it. And one of the growth areas for me was I just learned to kind of share it with the team and say I don't have the answers here in my opinions on things. And here's some of the things I think we might want to try. But I don't know all the answers. And I think a lot of times people, especially when they get into new management positions or new leadership positions, their first instinct is to act like people that are experts.

And I think, ironically, sometimes that's the worst thing you can do, because people can see through that the lack of expertise and the lack of experience. And so you lose credibility with them, where if you just flip that around and say, I have some ideas and some experience, that's put me in a position. But here's what I don't know. And here's how we can work together as a team to figure it out. That's refreshing to people.

It's an empowering to people and it's motivating people. And it's something that I've used and it's worked pretty well for me.

What are the biggest mistakes that you've made across any aspect of the business in the entire history of the business?

I think early on there's a really interesting balance between using your past experience as a roadmap for what you're trying to accomplish and taking lessons from the past and using them for your current situation. A balance between that and then thinking from first principles and thinking about how your current experience and your current environment is different and why it's unique and just intellectually figuring out what will work. And so one of my early mistakes was that I'd worked at Salesforce and Salesforce is go to market was largely in the early days around small companies.

And I got to Salesforce. They had about ten thousand customers and about one hundred thousand users. You're talking about 10 users per customer. So the original go to market for OCTA was similar around that. We wanted to sell to small companies. We wanted to sell to companies with just a few users and kind of work from the bottom of the market up to the larger enterprise. And what we found out, and this is a big part of that dearth of sales in 2011, was that identity management is different than Salesforce automation, identity management.

The more users you have, the bigger the problem is. So it's probably not smart to be selling to the 10 person companies, although you're a new company with a product that's maybe not fully there yet, you should be selling to the biggest company you can sell to because they have the biggest number of users with the biggest pain point. That was one mistake we made early on. And I think in general, I think that's a good thing to think through.

Like when you're making decisions or you're coming up with strategies, that's how am I balancing my past experience with things that have worked in the past with the ability to know uniquely about what's different about this. Like a lot of things in life, it's never totally black and white, but if someone can articulate the tradeoffs they're getting, that balance right is a powerful capability to have and making good decisions.

Can you talk about the balance between extreme singular focus on one hand and. I guess scattered effort and thinking, on the other hand, and what you've learned about where to live on that spectrum, and I'm asking the question because of your point about expanding beyond the sort of one trick pony idea or you had, I'm sure, maniacal focus on the one thing seems like focus tends to be rewarded. But I'm curious if there are exceptions to that rule that you've experienced.

I think that the focus is rewarded. The problem is, is that if you zoom out, there's a thousand people that focus on something, especially a new initiatives, only a small amount of them are going to work. That's kind of the uncertainty, just the chance that goes into the timing of the chance that goes in any new initiative with venture backed companies. There's thousands of them that are started. I forgot the number. I think the year OCTA was founded, there were eight thousand companies that raise some kind of early companies.

There is some kind of venture capital of that whole set of companies. Hopefully they all focused and hopefully they'll execute and hopefully they all did whatever they could do day to day to push forward. But only a small subset of them are going to survive. And so I think it's a little bit kind of depends on where you're viewing the landscape from the answer to that question. One thing we've done as the company has gotten into these chapters, where in now we've actually made our culture was very much you can kind of tell on some of these stories.

I'm told it was very much customer focused. We listen to the customers. We pivoted our product. It was we listened to the customers to launch the customer identity product. So it's very customer focused and very execution focused. We're very good at getting things done day to day, brick by brick. And that served us well. We were lucky to get the timing right and in terms of the market we were in and that execution has served us well.

But as we've gotten bigger, we've taken explicit steps to try more things and try a lot of new initiatives and have a framework for how we can double down on the new initiatives that work and just admit a mistake and move on from the initiatives that didn't kind of like what we've moved for is like in the early part of the company, we were zoomed in on this big canvas of innovation going on. Now that we've gotten bigger, we're kind of zooming out and trying to get more of that innovation going on within OCTA and then seeing which of those strongly executed bets pay off, doubling down on those and then letting the other ones die and moving on to other innovation.

What is the system by which you foster internal innovation? Because it seems as though obviously technology companies have dominated in the US and globally this cycle of the economy and the stock market, but also the ones that have done the best, seem to continually disrupt themselves or embrace something. They had an Amazon Web services, something seemingly unrelated to their core business. How do you do that? Is it structured? Is it unstructured? What is the standard for innovation?

Internally at OCTA?

I talked to entrepreneurs and talked to people all the time, and every entrepreneur wants their company to thrive and grow up and be the successful independent company. But then not many of them can name a big, successful, independent company. That's awesome. And they want to work out. So it's a little bit of a daunting challenge. And you look at the news about IBM recently, companies kind of divesting parts of their business and doing acquisitions to stay innovative.

And this is IBM Big Blue. It was the most iconic company ever. So it is pretty daunting. So it's something I as a company scale in the current chapter I thought about a lot. And I think that it's just putting a little bit of a framework in place for what I've talked about. So I think the first thing is you have to figure out a way to to foster ideas that are risky ideas that might not work out, because the natural rhythm in companies is to put budget dollars behind things that have a very high likelihood of working right, all things being equal in the budget cycle.

You're not going to invest in things that are just applied because you want things that have a high likelihood to work. So you have to have a way, a process internally to come up with ideas of things that you may be low likelihood of working, but that if they did work would have a big impact on your company. So we've put that framework in place. You also have to have, I think, a budget allocated toward funding these things over the long term.

You have to make sure they're working and making progress. But another downside of the traditional budgeting process is that things that start small and get big are not rewarded by the traditional budgeting process because they don't move the needle enough. In the early years, we're doing some work to make sure there's budgeting dollars set aside fund that these set of projects that are going to take a while to reach the scale where they would be relevant to to. But we have budget dollars set aside outside of the traditional budget to make sure we keep funding these things.

And if they start to work double down on them, if they don't shut them down the run.

It raises an interesting question, which is maybe having you explain to people out there that aren't familiar how a software business like yours works internally.

So talked about the. Products and you charge customers for those products, you make a lot of revenue. Five hundred plus million dollars of revenue or more growing fast. Talk us through for a software company where suppliers is like a funny thing. You're hugely dependent. Your background sales in before was engineering. So I know engineers internally are sort of like the suppliers in many cases of software companies. But for a company like yours, what does cost of revenue or cost of goods?

What does that mean? Where does that go to?

We've talked a lot about cloud and kind of the macro trends around cloud. The one of the biggest parts of cloud is that it's a subscription business. It's a recurring revenue subscription. So you're not selling the software as a perpetual license. It's recurring revenue. What that means for us is that the cost of goods sold is the cost to run the service. So it's the computing infrastructure, the data centers, all of our stuff runs on Amazon. We we use cloud for our data center.

So our cost of goods sold our subscription cost as well. So we do have capital allocation and then there's some cost of people to kind of monitor and manage the service. The way I look at it is first thing you have to have is you have to have high gross margins. So you have to know the basis of all of this has to be our gross margins have always been seventy five percent. Plus, you can't be selling dollars for 80 cents.

You have to have high gross margins at the foundation. And then above that, you have all of these costs, R&D, to build the software, you have to run the company. You have sales and marketing to sell and distribute the software. But those costs are paid for by this recurring cumulating business of customers that are paying you every year. So at a high gross margin, when I look at the company, I just think about it. We have the total addressable market for what we have is very big.

So we're trying to grow as fast as we can while at the same time making sure that sales and marketing dollars are paid back within a reasonable time in terms of the recurring revenue. So we don't want to be spending a dollar of sales and marketing and have it not make a dollar of recurring revenue or have it make a month of recurring revenue. We want to balance out those recurring revenue costs with the sales and marketing costs. But as long as you have a high gross margin and a big TAM growth is going to be rewarded.

How would you describe what you've learned about you mentioned earlier, this idea that you have to sell into for you guys have made sense to sell at the very largest companies? I deal with a lot of software companies that we've invested in or hope to that will be dependent on that activity, selling the service or product of a young company into a very large, older company. What have you learned about the best ways of doing that? Be honest. I think a lot of the tendency for a lot of companies that are selling to big companies is difficult.

We can do all this. We have perfect functionality. We have all your needs met. And so I think be authentic. I think people that work in big companies know that a new company is not going to have all the things solved. But the fact that you're a new company and that you're flexible and agile and you listen to them is an advantage. So resistant tendency to kind of be it to think that you're something you're not and and be open and honest with the company.

And then the other thing I would say is that also be confident about the value that you're providing to them. And I think a lot of companies make the mistake is that they're so happy to just be invited to the dance with the big company. They're not clear enough about the value and they don't charge enough. These big companies. You can if you do your job right, you can contribute a ton of them and you should for the sake of your business, you make sure you get paid for that.

I think that's a mistake that young companies are a lot of times are hesitant to charge or hesitant to really have the confidence that the value that they're delivering is worth what they're asking to be paid. And they should do that as much.

Obviously, without naming any names. I'm curious what you've learned from experiences with what you would call bad clients.

Maybe you haven't had some, but most companies of your size have had some bad customers or maybe just mis specified customers that ultimately it was the wrong decision to work together. What have you learned from those experiences and is there anything in there that you might recommend young companies that are selling into enterprises do to try to avoid those kinds of mistakes?

It's always dangerous to blame the customer for a problem. So I've always really shied away from putting any blame on the customer if something doesn't work out well. But the reality is that sometimes customers can't execute for whatever reason. They just have a hard time getting projects done. They have a hard time following up on what they said. They have a hard time being a good partner in getting your technology deployed. My recollection would be too many times we just have to just recognize that and not put as many resources into those certain customers because it wasn't going to be paid back.

They just can't execute on their side. And they were a good partner there. And I think that's part, especially when you're in the early days, you're scrapping for every customer. It's hard to admit to yourself that maybe this customer's fault, no one ever wants to blame someone else, but sometimes that's kind of where the blame is warranted.

When I did this same format with CIOs, Jeff Lawson, CEO and founder, they're one of my favorite questions to ask. Kim is when I can ask you to, which is it's almost like an unfair position that you guys get to see the future because you're an integral part or supplier to other people building new stuff. So I'm curious for any observations you have there if you do think you get to see the future a little bit, what you're seeing in terms of the cutting edge of new technologies being built today, the thing that always strikes me is that how much I think maybe this is a Silicon Valley perspective.

We think the world is further along technologically than it is. There's still a lot of value to be delivered to companies just doing basic things. We have a product that does it adds another layer of security by doing multifactor authentication. So not only password, but also checks a six digit code or send you a push notification. For us, it kind of seems like, man, doesn't everyone have that already? Isn't that on every application? But there's just so much out there that doesn't have basic security like that.

So I think the thing that keeps hitting me is how much opportunity there is basic steps to help companies be more secure and help people be more secure and at the same time helping them get online. We live on the Internet all the time and we think everything's online and but there's still a lot of businesses that have a lot of work to do, just getting online. And the potential there is tremendous. I mean, some of them aren't probably will never make the migration and they won't persist long term.

But the ones that do, I think they can have a great future.

What question, broadly speaking, are you trying to answer most right now?

What is the best way over the long term to persist the growth of OCTA that gets to so many core things about my job, which is it comes into picking the right markets, picking the right time to expand the whole conversation we had around innovation and foster innovation competitively. How to focus on that and what markets can we dominate and what markets will be harder to dominate. One of the great things about building a company that's becoming a platform and that is so central to so many things is that there's a lot of options, but it's kind of a blessing and a curse because there's so many options.

Sometimes I wish I would have just started an expense management company and just could work on either that or a video meeting software company. I would've been a good investment.

So let's imagine we were somehow able to convene a resume. I guess these days, a thousand person classroom and those thousand people are the equivalent of you in 2008, having just started OCTA, having just begun what they probably think is their life's work and get an hour guest lecturer to teach them, what presentation would you give?

The first thing I would say probably is if you're successful in this, you're going to be working on it and talking about it a lot for a long time. So make sure you're into it a little bit in jest. But that is something that is very true. The other thing I would say is that there is an advantage to just accept the fact by definition you should be doing something new and unknown and scary. And while your instinct is going to be to gravitate toward things that are more known and less scary and maybe not as new, resist that instinct.

You need something that's new and unknown and scary. And you just got to get used to that feeling because that's the only way you can really innovate and that's the only way that you can define the category for yourself. That's the only way that you can come out the other end and being the thing that is the marquee name in that space. And it happens fast like you keep working in. And one day you go from convincing people that what you're doing is not being done or it's not relevant or not a big enough problem to being.

Everyone obviously sees you as the standard in that space, and that's a very powerful position to be in.

Can you say more about that word? Scary. What does it feel like to be scared in the context that you mean it?

For me, it was this. I might be wasting my time. We only get so much time. In the early days of OCTA, the biggest fear I had and the most scared I was is that it's all going to be for naught and it's going to be four or five years and nothing can be. I could have done something else. That's what I meant by scared. I'm very lucky, like in terms of the financial position I was in when I started OCTA and just health and so forth.

People have real fears and real trepidation in life. But for me it was like the fear of not being successful in the fear of not spending my time wisely.

Well, I have the same traditional closing question for everybody and I'll ask you, which is for the kindest thing that anyone's ever done for you.

I remember I was a senior in high school and I grew up in the Bay Area as we were about four hours drive from the ski slopes. I really wanted to drive my dad's truck and take my buddy and go skiing. I was really into skiing and I was starting to like it and I wanted to go and he wouldn't let me he wouldn't let me take his truck because I thought it's not safe. And I got really mad at him and but he said, I'll drive you, I'll get up early, I'll drive you up there.

And he didn't ski, so he'll just sit there and wait for me all day while I ski. And he did it that just as one example of a million things my parents have done for me, but they just provided me.

The incredibly rock solid foundation and many acts of kindness, that being the one that pops into my mind, one thing I really remember about this conversation is just the amount of work that there seems to still be to do. I love your point around people's assumption that everything is kind of built and we're all using these tools and so the game is over. But really cool perspective on even though you've grown quite big, how much white or green space there still is, even for your company.

So thanks for all the lessons and great stories. It's been a pleasure getting to know you and learning a lot about OCTA. Yeah. Thanks a lot, Patrick. I tell the team that enjoy it and deserve because in five or 10 years you're going to look back and think that that was the cute little octa from twenty twenty.

I love it. A great place to end. Thanks so much for your time.

This episode was brought to you by Microsoft for startups, Microsoft for Startups is a global program dedicated to helping Enterprise ready B2B startups successfully scale their companies. In this five part mini series, we talk to Greylock Partners Sammo Tamati and Microsoft for Startups Jeff Ma about why companies should partner with Microsoft for startups in this week's episode. We talked with Sammo Tamati, a partner at Greylock, about what founders should consider when picking software partners for their growing business. Since you were invested before the thing itself was built, it's an interesting time in a company's life cycle because they had tons of choices to make around what toolkits to use, what partners to build on top of.

How do you guide companies like abnormal security that are at the start of their building phase and guide them on what's important when selecting partners, an infrastructure provider and any other suppliers is what I would call it as they build out their solution.

Part of why it's such a good time to start a company in twenty twenty is the availability of tooling in the ecosystem that you can build on top of whether that tooling and infrastructure is provided by major cloud provider or found in the open source or provided by a smaller company. It's never been easier to get new product to market quickly by leveraging twilly that's already out there. So the first thing we push founders on is to be judicious around what's going to be core competency and core IP for a company versus what's not.

And then for the things that are not going to be what should be. Most things in your software stock go leverage what's out there and so that you future proof yourself by building against someone else's infrastructure who does view it as their core competency and is going to continue to invest. So I think that's the first piece. Then when it comes to actually picking who to work with, there are really two dimensions we encourage companies to consider. I think the first is the technology side.

And if you just take cloud platforms, there's actually a lot of differentiation across these cloud platforms and they each have strengths and weaknesses in their product portfolios. Some of the cloud platforms have invested more in building services that next Generation II startups can build against. Others have stronger focus on ensuring privacy and security in the underlying services. So understanding what are the set of service, product and technology services that are most important to you as a new startup? And which cloud has the strongest offering in those areas?

That's one piece. But then the second piece and this is emerging is an important consideration is on the go to market side, which is if you're a new company and you want to target large enterprise from day one, fortune five hundred, a global two thousand accounts, you're going to need as much help as you can get. And so if you can work with an underlying technology provider, cloud provider that has relationships with those types of customers and has the ability and programs to help bring you into those accounts early on, that can make an absolutely, absolutely dramatic difference in your speed to market in the enterprise.

What other advice do you have for young founders that are building or new founders that are building a new enterprise solution and let's say partnered with someone like Microsoft and how they navigate and use that ecosystem to their advantage? Absolutely.

So the first is focus on the enterprise accounts from day one. Your entire DNA and muscle as a company gets built for the customer segment you focus on. So if you want to build for the enterprise, you should build for them on day one. We've seen companies that start in the SMB and then say, hey, we'll move up market. But then the challenge they began to realize is that product market fit they'd established was established with a very different customer segment that had different characteristics than what the Enterprise is looking for.

Then the second piece is pick the right enterprises to focus on. And I think this is where having partners like Microsoft can really accelerate things because there's a range of enterprises out there and there's a range in their approach to innovation and partnering with young companies early on and then setting up programs to actually make those young companies successful.

And so how do you leverage the names you're working with to identify and get access to those companies to find more episodes or sign up for our weekly summary visit, Investor Field Guide Dotcom.

Thanks for listening to Founder CEO Guy.