How ThreatLocker Created a New Category to Reach $200M

Omer Khan [00:00:03]:
Welcome to the SaaS podcast. I'm your host, Omer Khan. AI has changed the playbook for building and growing SaaS. Every week I talk to founders who are writing the new one. He was $150,000 in credit card debt, buying $80 of groceries on three credit cards for a family of five. Eighteen months in, still zero paying customers.

Omer Khan [00:00:24]:
Then an accelerator told him and to scrap the whole idea. My guest today is Danny Jenkins. He ignored them and built ThreatLocker into a cybersecurity company approaching 200 million in ARR, protecting 70,000 companies. In this interview, Danny breaks down the test that made him create a new category instead of chasing a small market.

Omer Khan [00:00:46]:
How he was so scared to ask his first customer for the sale that he was shaking. And the only two things he says actually matter when you're starting out. Quick heads up before we start. I was getting over a bad cold, so my voice is a bit rough. Apologies for that. I hope you enjoy it.

Omer Khan [00:01:07]:
Okay, Danny, welcome to the show.

Danny Jenkins [00:01:08]:
Omer, thank you for inviting me today.

Omer Khan [00:01:10]:
It's my pleasure. So tell us about ThreatLocker. What does the product do, who's it for and what's the main problem you're helping to solve?

Danny Jenkins [00:01:19]:
I mean, our goal is we understand that cyber attacks are getting worse and worse every single year. We understand that it's no longer just an IT issue, but it's in a real business issue. And we understand the solution isn't complicated. What's complicated is the implementation of the solution.

Danny Jenkins [00:01:35]:
So what we did is we came out with the idea of building cybersecurity. What is now referred to as zero trust wasn't then but on the basis of basic controls, least privilege and, and actually stopping ransomware attacks, cyber attacks, phishing attacks being successful and everything else.

Danny Jenkins [00:01:49]:
Rather than trying to detect everything just to build a really good controls platform that hardens people's environments and ultimately all but stop cyber attacks.

Omer Khan [00:02:00]:
Great. And give us a sense of the size of the business. Where are you in terms of revenue, customers, size of team?

Danny Jenkins [00:02:07]:
We protect about 70,000 companies worldwide. We've got. And that's a lot through MSP Networks, but also a lot through Direct. And we've got about 6 to 7,7000 direct customers. And they range from small businesses through a local MSP right up to.

Danny Jenkins [00:02:24]:
I can't give some of the names, but some of the world's biggest companies, I mean literally companies you wouldn't even think about mentioning that I'm not allowed to mention. But the biggest and the most valuable companies in the world are Our customers and revenue revenue were just approaching 200 million.

Omer Khan [00:02:38]:
Awesome. So the story, I guess the business was founded in 2017, but maybe start by telling me a little bit about your background. Like you grew up in England. Like how did you get into the cybersecurity space in the first place?

Danny Jenkins [00:02:55]:
So essentially I grew up in the uk. I was very short as a child. I grew very late as a teenager. Today I'm 6 foot tall, but back then I was 5 foot 2 at 16 and I had a rough time at school and I left school at 15.

Danny Jenkins [00:03:09]:
I didn't graduate high school, I didn't do my GCSEs. I was like, I'm out of here as quick as I can. And this is the 90s, so the Internet doesn't really exist. I love computers.

Danny Jenkins [00:03:21]:
I created, you know, there was one computer class if you like, and I created, what's the word I'm looking for scripts, but malware to delete people's work from their computer. That bullied me.

Danny Jenkins [00:03:36]:
So I was like, oh look, I can just edit the autoexec bat file and when the computer starts it will delete anyone's homework from their floppy disk. So I do stuff like that when I was in high school and that's what got me into it.

Danny Jenkins [00:03:47]:
And what I did is, and it's going to be hard for anyone in today's age to understand this is I wrote a letter to every computer company in the town I lived in saying I'm looking for an apprenticeship. And one of them came back to me and I got a job.

Danny Jenkins [00:04:00]:
Started off physically building computers, started working on a novel network servers, small business server. This is before people even connected to the Internet. If they did, it was like a dial up, check your email and disconnect. And that's really what got me into the IT industry. And I just had this passion to understand how technology works.

Danny Jenkins [00:04:19]:
I want to know everything about it. I want to know how Windows works, how the registry works, how Netware works, how printers work, how they communicate with each other. And what really got me into cyber security was I ended up moving to Ireland.

Danny Jenkins [00:04:31]:
And when I was in Ireland, I got a job for a manufacturing company that manufactured building materials. And I worked in one of the local offices and they had like 146 sites worldwide. But the corporate headquarters didn't have an IT person because they only had like 20 or 30 staff.

Danny Jenkins [00:04:50]:
And that's where the CEO, the chairman, this is a 4 billion dollar company at the time. And I went, I went back to, I was in the, the division if you like.

Danny Jenkins [00:05:02]:
And I keep getting calls saying, hey, can someone come up from division to help corporate, the corporate headquarters help with their words not working, the spell checks not working, printers not working. And the other guy was like, I don't want to go up there, can you go up there?

Danny Jenkins [00:05:15]:
So I just kept driving up to corporate headquarters and suddenly I was fixing problems that had been going on for years. So then they offered me a job as the IT in corporate headquarters. And at this point every division was completely separate and there was no real security threats.

Danny Jenkins [00:05:32]:
And then suddenly the love bug came out and the Blaster virus came out and they were like, oh, we have 14 different IT divisions, 146 sites worldwide. And when they screw up, it affects the whole company. So it started becoming a corporate issue of cybersecurity. And I was 20 years old at the time.

Danny Jenkins [00:05:50]:
I happened to be the person there to solve the issue. So that's what really got me into security to begin with.

Omer Khan [00:05:57]:
Where did the idea for ThreatLocker come from? Because you built from what, if I understand correctly, you built an early version of the product. But it wasn't like you didn't jump in with both feet straight away.

Danny Jenkins [00:06:14]:
I was struggling. So I had an email security company and anyone here who's ever sold to IT and to tech people before knows this. They don't show up at calls, they cancel on you all the time. They're the worst buyers in the world. They forget everything they are going to do.

Danny Jenkins [00:06:30]:
So I, I'd had an email security company and I'd sold that to one of our customers and it was a very small business. It ended up with lifestyle business, oem. And I was thinking about what I wanted to do next. So we did some ethical hacking. It turned into mostly ransomware recoveries.

Danny Jenkins [00:06:44]:
I was doing consulting for other companies at the same time and there was a case in Australia where I'd been an MSP had brought me in to help recover from a ransomware attack. This is 2014. And the attacker had got in, encrypted, everything, databases, SQL, Exchange, everything, backups gone.

Danny Jenkins [00:07:04]:
And they come in through a piece of malware that a user had ran. And I got onto the. About a week into the recovery, the owner of the company called me and said he was like a 60 something year old man. He got very mad with me and he said, well, when is this going to be fixed?

Danny Jenkins [00:07:19]:
I was like, I don't know, it is. I was like, you've got to be real here. Everything is gone. You've paid $22,000 ransom. The ransoms were cheaper than. The decryption keys do not work. We're reverse engineering the code. We're doing low level disk recovery.

Danny Jenkins [00:07:33]:
We're doing everything we can to get you back up and running and I don't know that you're going to be recovered. And suddenly his voice breaks and he gets very emotional on the phone. Now, you know I'm British. Last time I cried, I left Britain. Haven't been back since. So I don't really do well.

Danny Jenkins [00:07:50]:
When some guy starts crying on the phone to me, I'm like, look, I'm going to do what I can. This guy did not go out of business. We managed to recover everything, but at the end he said to me, well, why did our security tools not stop this?

Danny Jenkins [00:08:00]:
And I said, well, because your security tools are looking for known threats. You need to block everything by default and just approve what you need. And his IT team said that I was nuts and that was not viable.

Danny Jenkins [00:08:11]:
And I eventually tried to prove him wrong and found out there really was no products that were viable for a 50 employee company to implement a security that was required to defend against ransomware or any kind of cyber attack. So this was 2014.

Danny Jenkins [00:08:30]:
At the same time, we're also looking after our kids school it and every day there was malware, there was viruses, and the teachers were running things they shouldn't do, the students were running things they shouldn't do. And it was literally 20 hours a week we were spending trying to keep our kids school.

Danny Jenkins [00:08:46]:
And my wife was doing most of the work. And again, same problem. How do we block things by default? So this idea, well, what if we built something that was easier? My problem was I didn't want to sell to it again.

Danny Jenkins [00:08:58]:
So at the same time I'm looking at this health tech, there's edtech, there's other solutions out there where I could actually sell to people where they want to take my call. I built ThreatLocker and I was spending 15% of my time on it. So. So it's 2017 and we have this concept.

Danny Jenkins [00:09:16]:
We've got a driver built, we've got a service built. It's been very, very difficult to get to a point where we can. And look, all it does is block. And the blocking part's the easier part. It's the allowing that's actually more difficult. And that's where ThreatLocker actually does most of our research is how do we allow software?

Danny Jenkins [00:09:31]:
And WannaCry came out and what I'd done beforehand is I'D realized that the size of the whitelisting market at the time, so that's one of our components, was a total market size, if we stretched was potentially a few hundred million dollars and in order to succeed it was going to cost us $100 million plus to run this service.

Danny Jenkins [00:09:53]:
So we would have to go and take 70% of the market. And that didn't seem viable at the time. When WannaCry came out, we just tested it and it blocked it. And I sat there and thought, okay, what if we change the size of the market?

Danny Jenkins [00:10:10]:
What if instead of, you know, trying to take a corner out of an existing market, we go out and create this entire new market, this entire new category and we just say that we are actually changing it. So this is not just for big businesses, it's for small businesses, it's for medium businesses, for businesses that are dynamic.

Danny Jenkins [00:10:26]:
And change in airports and hotels and hospitals and all of these types of businesses. Could we make it work then? And that was the turning point in May 2017 where we said, okay, I'm taking no other work on, I'm quitting everything else. All of our other income was drying up. How do we go and make this work?

Danny Jenkins [00:10:42]:
And that's, that's the point that WannaCry really said we have to make this work. And at no point from then onwards was this ever going to be a small lifestyle business. It was going to be a multi billion dollar company.

Omer Khan [00:10:54]:
So it was about 18 months late 2018 that you landed your first customer worth about 5k I think. Tell me about what those 18 months were like. What were you doing every day? Was it working on the product? Were you trying to find customers every day? How did you spend your time?

Danny Jenkins [00:11:20]:
Well, so in 2017, so we spent all of the time trying to build the product and make it mvp. And mvp, by the way, minimal viable product. When you create an endpoint security product, it's until you start deploying it, it's shit. And the reason being is because you're trying to predict what everyone's systems look like.

Danny Jenkins [00:11:41]:
So you could build test systems and you could do whatever you want, but what gets you real value is hey, this is how Dell Support Assist works, this is how this software works.

Danny Jenkins [00:11:50]:
So we're working on the products, trying to create a stable version that we can at least get turned on on our kids school would be nice. And they were the first user of ThreatLocker.

Danny Jenkins [00:11:58]:
And then we realized, hey, we need to build a sales team, we need to build marketing, so we need to raise capital and we're at this point, our savings are gone, we remortgaged our house and now we're burning into credit cards. So we go through an accelerator.

Danny Jenkins [00:12:14]:
By the way, I would say, and this is my opinion from one experience, but I would say going through an accelerator and committing three months to accelerator was one of the bigger mistakes we made. It was a waste of my time, it exhausted the family, exhausted everything. And so we went.

Danny Jenkins [00:12:38]:
But we went to this accelerator, went to dc, I stayed up there for three months. When I came home at the weekends and I was working on the product of the weekends and I was going through this, hey, we're going to train you to raise capital.

Danny Jenkins [00:12:47]:
We're going to help you grow your sales team, we're going to help you. And all they did was mostly talk about, you should pivot your business. Don't do zero trust, don't do white listing, do edr, do edr. That's the future. And the last day I was there, there was one of the.

Danny Jenkins [00:13:02]:
And quite often there are really good people that surround themselves, but a lot of the people that surround themselves with accelerators, let's face it, I'm a busy person. Most people who are actually doing well in their life are busy, so they don't generally go down.

Danny Jenkins [00:13:12]:
And we try, I try and make an effort to give back to the community, but I can't spend months of my time in accelerator.

Danny Jenkins [00:13:18]:
So the people who are spending a lot of time there tend to be one of two types of people, one of which is trying to sell you something, which probably is the better ones you want to talk to. And the other one are people who just like the sound of their own voice.

Danny Jenkins [00:13:30]:
And I remember they were getting so mad because I was like, I'm not going to pivot this to edr. And she said to me, you don't know how to take advice. It's like, I do. I just don't take advice from stupid people. And I just. We never got funding. They promised to introduce us to investors.

Danny Jenkins [00:13:45]:
We never got the investors, we never got any customers from it. We, we just wasted three months there. But we went back, I said, look, this is what I need to do the products now at MVP stage. So I have to actually have back surgery as well.

Danny Jenkins [00:13:58]:
So I spent six weeks not being allowed to sit down, which was tough. So I go through my back surgery. I keep coding alignment.

Danny Jenkins [00:14:05]:
Literally I had a lay back and chair and I just kept coding, building the product, get it to MBV stage, and then I start to hire someone I've got very little money, but I figure, hey, if I can get someone just to dial and book me meetings.

Danny Jenkins [00:14:17]:
So I got a guy working in my house four hours a day, dialing and saying, hey, I'm calling from the Ratlock. I want to talk to you about our whitelisting product. And this guy was awesome, by the way. I wish he was still with us. And he.

Danny Jenkins [00:14:32]:
So after, eventually, he gets me a couple of demos set up, and a lot of time he would get them on the phone and they start asking questions. Who would hand the phone to me, and I'd answer the questions. So he gets this demo set up, and it's. It's like August or something, the end of 2018.

Danny Jenkins [00:14:48]:
And the guy's like, does it do this? Does it do this? We do this demo, and I'm showing him, do you want to start a trial? And I remember. So we deployed the agent, and we're looking at his unified audit. And we're like, holy crap, look at all this stuff coming in.

Danny Jenkins [00:14:59]:
So we're literally writing code, pushing it to try and understand how to learn his environment, because we've never seen an environment like this. And we're about six weeks into the trial now. Everything's going relatively smoothly. He's had some hiccups, but we've managed to keep everything relatively smoothly. And then he says.

Danny Jenkins [00:15:16]:
So I said to him, well, I'm really nervous, and I'm $150,000 in credit card debt. At the point that week, I'd had to buy groceries, and I had to put $80 of groceries on three credit cards for a family of five. It was rough. So I'm like, we are absolutely screwed. And the.

Danny Jenkins [00:15:37]:
I call this guy, and I'm literally shaking, and I don't know how to. I'm not a sales guy. I don't have to ask for an order. So I'm like, well, how's it going? Is there anything wrong? You've got the machine secured. I was like, well, what would it.

Danny Jenkins [00:15:49]:
What do you need to do to make a decision if you want to buy this? And the guy's like, oh, how much is it? And I'm like, oh, it's $50 an endpoint. And. But I'm. But I start discounting myself in the same conversation. But we can work with you.

Danny Jenkins [00:16:03]:
And he's like, so it's five and a half thousand. Yeah, just send the order of cost. We'll sign it now. And like, it was such a relief because I was so scared. We just got this $5,000 order.

Danny Jenkins [00:16:13]:
And at that point we were able to go and get some angel investors because now we had someone willing to pay money for ThreatLocker. So people were like, this might be interesting. So he got some angel investors, and then we started to really rinse and repeat and slowly grow.

Omer Khan [00:16:25]:
So was that 5,000amonth or a year?

Danny Jenkins [00:16:29]:
Yeah, it was paid up front, which gave us the. And it was like a defense contract that made parts for planes for the air Force or something. So paid up front, and it allowed us to essentially get through the next few weeks. We then got a investment check for angel investors.

Danny Jenkins [00:16:48]:
So we raised like, $200,000 from angel investors, multiple investors, and that kept us through the next year.

Omer Khan [00:16:54]:
I mean, you talked about, like, what a financial strain this was for you and your family and that, you know, everything is going on. Credit cards, 18 months to land that first customer. Like, what. What kept you going? And especially with this accelerated experience where they're telling you you're going down the wrong path.

Omer Khan [00:17:20]:
Like, was there a time where you just felt like, maybe, maybe I should just go and get a job again?

Danny Jenkins [00:17:26]:
There was never a situation where I said, this isn't worth it. I was just trying to figure out, how do I deal with today's problem? And ultimately the goal is get this successful and do I need to go and do some work to get paid so I can buy groceries, maybe, and we'll deal with that.

Danny Jenkins [00:17:44]:
We considered filing bankruptcy, actually, at CF bank, and I remember calling a bankruptcy firm, asking, is there a way I can keep the business? We got no revenue. It's got no money. How do we do this so I don't lose the business in the bankruptcy?

Danny Jenkins [00:17:57]:
Because I would rather have said, hey, I'm going to file bankruptcy, than actually. And we didn't. Thankfully, we managed to get that, we managed to move than actually lose the business. The goal was always, how do we. We have to change the world? I mean, it's. For me, it was very clear. And it wasn't about money.

Danny Jenkins [00:18:14]:
Of course, no one builds a business saying, you know, I don't want money and I don't want to be successful. But it was about, this is the only way the world isn't going to be destroyed from ransomware attacks. There's no way you can stop cyber attacks without doing this, and we have to make it happen.

Danny Jenkins [00:18:31]:
So there was never a doubt. Should we continue? It was hard. It put a lot of strain on us. But at the end of the day, I always figured, look, at the end of the day, if I Lose everything. I can always just build back up again, but I'd rather take that risk and actually do something worthwhile.

Danny Jenkins [00:18:50]:
And I think it was probably tougher on my kids. We weren't the. I was constantly traveling. I was constantly working, but that's part of their life. They've always known what we do. And my wife founded the company with me, which made it a little bit easier because we're in it together.

Danny Jenkins [00:19:04]:
It wasn't like one of us is burning our dreams on this hopeless company, and the other ones, like, well, we can't afford to pay the mortgage. We were in it together.

Omer Khan [00:19:12]:
You. You had moved the family to Florida around that time, is that right?

Danny Jenkins [00:19:18]:
No, we moved them in 2010.

Omer Khan [00:19:21]:
So you. Okay, so you'd been there for a while.

Danny Jenkins [00:19:23]:
Okay, yeah, we've been there for a while. It's. You know, we had a house, and actually, we had. We'd moved houses, so we had a second house. Well, we didn't have to. We'd moved. This is our second home. We lived in or owned in Florida. And it was. You know, it was. It was.

Danny Jenkins [00:19:38]:
You know, everything was kind of, you know, settled as a family. We had some other problems as well at the same time, because, you know, just as we think we're getting further, like, in. As I was in the accelerator, I think it was Hurricane Irma came through and wiped out, like.

Danny Jenkins [00:19:55]:
And I'd said it to our neighbor before. I said, you know, you should thin that tree out. She had a massive live oak tree or some kind of oak tree. I don't know if it was live oak. And I said, and she said, oh, no, that tree's fine. And it came down on our house.

Danny Jenkins [00:20:07]:
It ripped all the pool pipes out the ground. It took the gable down. It totaled the car. It took the roof out. We got like 50 cents, maybe even less than 50 cents on the dollar from the insurance company on the cost of repair.

Danny Jenkins [00:20:18]:
So we end up having to sit on the roof, me and my wife, on the roof, in the middle of the heat, like, nailing roof panels on and fixing the roof so we could. The water would stop coming in because the tarp had blown off a few months later.

Omer Khan [00:20:29]:
So in the middle of building this business and trying to land the first customer, you're also repairing your roof?

Danny Jenkins [00:20:37]:
Yeah, repairing the roof. The car had been totalled. And what made it worse, because this was a point where just before we. We hadn't completely ran out of money, but we were really running down our money, and we weren't on credit cards. Yet.

Danny Jenkins [00:20:49]:
But bank of America, we had a car loan with them and the, our car had been totaled and there was a $7,000 delta on the finance. And 60 days afterwards they came in and said, if you don't pay it today, we're going to report it on your credit.

Danny Jenkins [00:21:02]:
And I'm like, if my credit gets wiped on this, I'm going to, this is really going to think. So we had like, I think we had like $9,000 in the bank and we, there was $7,000 left. We had to pay that $7,000 to bank of America that day. And we were paying it every month still.

Danny Jenkins [00:21:14]:
And they're like, no, it's got to be paid right now. And it didn't happen. So all of this is kind of coming together and falling apart. The worst time. But again, we just like, okay, what do I need to do today?

Danny Jenkins [00:21:25]:
We'll do what we've got to do today and then we'll do what we got to do tomorrow.

Omer Khan [00:21:27]:
I mean, that was the thing that I wondered a lot when I was researching for this interview. And like, like all this shit that life was throwing at you while you're trying to get this business off the ground, I was like, what kind of mindset? And we talk about resilience a lot, right?

Omer Khan [00:21:41]:
But what kind of mindset does that do? You actually need to be able to deal with that on a day to day basis. And I love this thing that you say, what do I need to deal with today? I'll deal with that and I'll worry about tomorrow. Tomorrow.

Danny Jenkins [00:21:54]:
Yeah, look, and I think that there's a certain type of person that has to start a business. And that type of person is not someone who is easily stressed or easily miffed or easily defeated. Because starting a business is one of the hardest things you'll ever do in a business in a career sense.

Danny Jenkins [00:22:21]:
And this idea that people start businesses so they don't have to work 40 hours a week or they don't want to talk to their boss is crazy. Because, you know, even Today I'm working 100 plus hours every week. I sleep very little. And it doesn't get easier. It absolutely does.

Danny Jenkins [00:22:34]:
You think, oh, once I get more money, once I get funded, once I get more customers, it'll get easy. Never ever gets easier, only gets harder. But I think you just have to be at that mindset that I'm going to do it.

Danny Jenkins [00:22:43]:
And I also think you need to be the type of person that doesn't dwell on what's wrong. Because I always say if you want to feel better about your life, ride the elevator in a children's hospital. And then you'll feel better about your life because everyone else is in a worse situation than you.

Danny Jenkins [00:22:58]:
So if you just have to say, I'm doing what I'm doing, and I'm going to do what I need to to make it better, and if something's wrong, what do I need to do to fix it? Well, there's a hole in the roof. Let me get on the roof to fix it. There's a problem with the code.

Danny Jenkins [00:23:12]:
Let me write the code to fix it. And then when there's another problem, and yes, sometimes, you know, everything piles on at the same time. You just say, let me take the most critical thing. Let me move on to the next most critical thing. And we'll just keep doing that.

Danny Jenkins [00:23:23]:
And that's eventually how you end up growing a business. And at the beginning, you know, everything is one of the things. You know, actually one of the things the incubator said to me, the accelerator they called themselves, but was, hey, you got to file a trademark. So at this point, we're about $50,000 in the bank.

Danny Jenkins [00:23:41]:
We haven't got into credit cards, and we got to file a trademark, and it's going to cost. So this legal firm comes in, why is it important you file your trademark? Why is it important it's done right? And so we look at all this and listen to them, and we're like, okay, we need to file a trademark.

Danny Jenkins [00:23:55]:
So we look online. What's required to file a trademark? It says you should use a lawyer, but you can do it through the US Trademark office by yourself. And it's say, I can't remember the number. Say, it's $300 to do it directly through the trademark office.

Danny Jenkins [00:24:07]:
So the lawyer says, it's going to cost us 12 grand to file a trademark. I think I can't remember the exact number. And I can't afford to spend $12,000 on filing a trademark right now. And we did ourself.

Danny Jenkins [00:24:18]:
And, you know, it's interesting because when you're starting a business, there's a lot of people who are starting a business will go to someone who's running a really successful company for advice. But if you come to me and say, I'm running a really successful company, what should I do to file a trademark?

Danny Jenkins [00:24:32]:
I'll go and find the best damn lawyer you can and make sure it's filed properly. But if you say to me, I've got $50,000 in the bank, should I spend $12,000 on filing a trademark. I'd say no, do yourself and it's going to cost you a fortune in the future if you do it wrong. But guess What?

Danny Jenkins [00:24:47]:
Spend the 50,000 on dollars on what you need to do as a business today. And when you're starting a business, you need two things. You need a product that solves a real problem. And you need the customers to know the product exists. You need the buyers to know the products exist.

Danny Jenkins [00:25:00]:
Everything else is white noise like, and just ignore it because yes, it will be important. And it cost me at least $50,000 three years later because we filed the trademark wrong. We had long standing litigation that could have, that would have.

Danny Jenkins [00:25:13]:
We spent 50,000 plus dollars in motions because we forgot to put a period where we should have put a period or we did something wrong. But if I'd spent the $12,000 on the trademark registration, I wouldn't have spent it on marketing it and I wouldn't have a business to defend the trademark for later on.

Danny Jenkins [00:25:29]:
And the $50,000 at the point in time I spent it was irrelevant because we had a lot more money in the bank.

Omer Khan [00:25:34]:
Right. So you've got that first customer that takes a lot of pressure off. You said you were able to go and raise some capital from that. Where did customers 9 through 10 come from? Was it just more cold calling? Do you remember?

Danny Jenkins [00:25:53]:
So, and here's the other thing. I actually don't remember second customer. So I think, I think nine through 10. So here's what's happening is this is another failure I see a lot of.

Danny Jenkins [00:26:07]:
And of course one of the things about going through and accelerating, one of the nice things about it is you do meet a lot of peers in the same situation. Pretty much all of them actually all of them now are no longer in business. But you do get to see what people are doing, what they're doing wrong.

Danny Jenkins [00:26:22]:
And one of the things I see from a lot of people starting a business that's failing is they assume I've got a lead that leads got to close. And they'll assume that because the customers or prospect is being nice and talking nice, it's going to close. I tend to run a different approach on this.

Danny Jenkins [00:26:39]:
You need to have 100 leads to close 10. Now our close rate back then was more like 45%. But you have to think about that. So what we did is this guy was calling, he had a lot of demos going on.

Danny Jenkins [00:26:52]:
This was the first one that closed and there was some of those other demos would have closed. What we found very quickly was that customers started talking to their friends, their peers.

Danny Jenkins [00:27:00]:
It ended up being on Reddit and Discords and other things like that, where people would then start coming inbound saying they wanted to look at what you were doing. I remember we did a webinar, and it was a. It was a company called MSP Webinars, very small. There was like 10 people on the webinar.

Danny Jenkins [00:27:17]:
And we'd ask someone, we want to do a demo on a cold call, and they say, no, we don't do demos, but go to MSP Webinars. If they're doing that webinar, we'll watch it. So we go to this MSP webinars, we do this webinar, and there's about 10 people on it.

Danny Jenkins [00:27:28]:
But those 10 people start talking really, really quickly. And the guy was unbelievable because he went and tested the product after doing the webinar live, and he did about five hours of videos on his YouTube channel.

Danny Jenkins [00:27:40]:
And I was watching it, and I was yelling at the screen because he kept clicking on things that he shouldn't click on. I was like, that's not how you do that. And it's.

Omer Khan [00:27:47]:
But.

Danny Jenkins [00:27:48]:
But what we learned was, hey, if the customer's clicking on something wrong, then it's an us problem. We need to make sure they don't. We need to make sure we guide them into the right direction. So we watched it, we changed it, but in the meantime, we're like, oh, this YouTube.

Danny Jenkins [00:28:00]:
And then he clicks on something and the webpage crashes, and we're like, oh, no. But we fixed it all, and we just got through that. So that got quite a few leads into the pipeline. We'd hired a salesperson, really on. And we had the cold call, and then we hired a salesperson.

Danny Jenkins [00:28:16]:
And that was a mistake, not hiring a salesperson, but the type of salesperson we hired this guy, he talked the talk, and you could bring him into NASA and he's not going to embarrass you, but he didn't deliver anything. And at this point, I remember it was like June 2019, I think, at this point.

Danny Jenkins [00:28:37]:
So we've gone through our first round. We've got this salesperson, we've got loads of leads, and now he's managing the close. I'm not asking for the close, but no one's closing at all. And I'm doing 10 demos a day. I'm coding all night. Nothing's coming in as an order, and we've got so many leads.

Danny Jenkins [00:28:56]:
I said, well, we've got to Hire another salesperson. So we hire the second sales guy still with us today. And honestly, when I got on the call, when he got on with the customer, I didn't think he was good. I thought he was terrible, actually.

Danny Jenkins [00:29:09]:
The person will probably hopefully hear this and not take it with too much offense. But I was like, he's not very smooth talking. He's very blunt, he's very direct. He comes across unpersonable. But suddenly we started closing and I was like, wait there. How have I got this rock star who's a smooth talking, like sounds really professional.

Danny Jenkins [00:29:30]:
Close. Nothing. And then I've got this other guy who comes in and literally he would just say, oh, we'll schedule another call for next week to do the trial. And he wouldn't even ask, and he'd just say, okay, I've sent you a quote. You can sign it if you want. And it was almost just.

Danny Jenkins [00:29:43]:
And we just started getting these deals in and you know, I think we were $300,000 of ARR at the end of 2019, which is really small by today's numbers. But I was like, we're getting these deals in and they're just coming in and the person's his.

Danny Jenkins [00:29:59]:
And what I realize is at that point, I personally realized that sales is not necessarily about a magic conversation. It's about showing the customer what you've got and asking them do they want to buy it. That's going through that process. It's not about. You said something magical.

Danny Jenkins [00:30:15]:
And now we have a great sales team of about 180 people. They all have different personalities. Some of them are better than others that selling. But we realized back then that, hey, I just need someone who's going to call the customer, who's going to make sure that they keep the customer on the phone. And he did fantastic.

Danny Jenkins [00:30:32]:
And he did that. And then we get to December and I think we raise another $500,000 of revenue. Sorry, not revenue of investment from. We'll call them. They consider themselves a fund, but they're angels. So we get this second raise and we've got $300,000 of ARR. And we're adding 40, say $40,000 of ARR a month.

Danny Jenkins [00:30:57]:
And then we, we go to this guy, says, hey, one of our partners is going to come your cfo. And I was like a little bit nervous. I was like, yeah, I don't want someone coming in, tell me what to do. But the whole docs nothing had any guaranteed controls. So he's going to become a cfo.

Danny Jenkins [00:31:14]:
He's not going to get paid for a while. We can pay him in the future if we want, and we want to keep him on. And we're not guaranteeing any board seats. We're not guaranteeing everything. We put. We put in one of the investors on the board, but it's not guaranteed we can take it away.

Danny Jenkins [00:31:26]:
So I'm a little bit nervous about this whole thing, but we're like, hey, someone's willing to put $500,000. And there was a couple of people, but one person led it into the company. Let's take the money. And I remember. So we're in January, and I'm like, okay, so we've got $500,000 of cash in the bank.

Danny Jenkins [00:31:40]:
This is what I want to do now. Now we're in 2020. I want to go to as many trade shows and speak in front of as many people as possible and tell them why, what we're doing, why blocking by default is so important, how malware works, how you can defend it and what we're doing.

Danny Jenkins [00:31:54]:
And I booked, like, 10 smaller trade shows, and I booked RSA. And this is just before the whole world shuts down. And the CFO said to me, what if this doesn't work? Because a CFO will always want to take. Let's test something. Wait a bit. Test something. Wait a bit. Test something. Wait a bit.

Danny Jenkins [00:32:13]:
And I'm like, so here's the thing. The product works. We know the product works. And yes, it's got bugs and it's got lots of things that probably need to be fixed, but it works. We need to tell the world the product exists. That's the second part of this.

Danny Jenkins [00:32:25]:
If it doesn't work, it's not going to work because people aren't willing to buy it. And in that case, it's better to die fast than die over five years. So I was like, we'll die fast if it doesn't work. So we spent $300,000 on these trade shows, and we were adding $40,000 of ARR in December.

Danny Jenkins [00:32:45]:
I think we'd added 20 in November. And then we had like, 60 and 60 again. Ish. And then in March, we had $130,000. And the entire world just shuts down because now we hit Covid. So no more trade shows. I'm like, oh, no.

Danny Jenkins [00:33:01]:
And my problem was my entire strategy was, how do I get people to know what we do? Because people aren't searching for what we're selling. So it's not like I can put AdWords out there. How do I get people to know what we do. And thankfully I'd done so many trade shows.

Danny Jenkins [00:33:15]:
We had this massive pipeline already built up and we, we started selling to those pipelines and you know, we added 130. And then I think we added another good month and we finished 2020 out with 1.9 million in revenue. And so. Oh no, 2.3. Sorry, 2.3 we added. So we went from 300k to 2.3 million in revenue.

Danny Jenkins [00:33:35]:
And we, we then. But in we. In July, I think we started going back to trade shows which because. And at the beginning we were very much focused on enterprise. But then MSP, they carried on doing trade shows in 2020 when it was crazy.

Danny Jenkins [00:33:52]:
I mean anyone who went to a trade show in 2020 was off their rocker. You know, I say I went to eight trade shows between July and October 2020. I got Covid at one. So the, the so and, and it was. But we started selling again.

Danny Jenkins [00:34:07]:
We got in front of people we educated and, and pretty much what we've done since then is just keep repeating at bigger scale everything we do.

Omer Khan [00:34:16]:
Can you just explain for people who don't know what an MSP is? Because that's a pretty important part of what happened next.

Danny Jenkins [00:34:26]:
Yeah, so I think so. MSPs are essentially. So we are selling ultimately we're selling to tech computers, but we're selling to an IT person. An IT person, a security person. And you'll see in this world that MSPs and IT people get confuse titles all the time and where they cross over to security or not.

Danny Jenkins [00:34:42]:
But at the end of the day there's someone who's technical installing an agent on your machine and configuring it, whether it's a security manager, an IT manager, a ciso. MSP is eventually IT people for small businesses. So. Or IT companies for small businesses. So if you're a small business, you can't afford to hire your own IT team.

Danny Jenkins [00:34:56]:
You hire an MSP, they look after all your IT for you, you pay them $150 a month for a computer and they come and fix all your problems. They put your security tools on and they do everything else. So it was our way of getting in front of small businesses.

Danny Jenkins [00:35:09]:
And one actually one of the things I said day one when I went back and said I'm going to change the market. So we had a few hundred million dollars market and I need to turn this into a $10 billion market. One of the things I said was I want to sell to two companies.

Danny Jenkins [00:35:23]:
I want to sell to a small business. And I want to sell to a large business because I figured if I can sell to a small business and a large business, I can sell to the entire world.

Danny Jenkins [00:35:33]:
But I put a condition in there that I cannot include someone who's already using someone who's already in that $200 million of market size. So if they're already using whitelisting, if they're already blocking by default, I have to exclude it. And what we realize is selling to small businesses isn't effective because they're not the IT people.

Danny Jenkins [00:35:47]:
We need to go to an msp. And the large businesses, obviously you go to the IT security team. And the small businesses were relatively easy because they weren't asking how much revenue do you have? How much money do you have? The large businesses? I think our first massive enterprise we signed was JetBlue in 2021.

Omer Khan [00:36:04]:
Okay. So I think it was around that time. So you've got these enterprise customers kind of showing up. But you had this realization at one point that about half your revenue was coming through MSPs.

Omer Khan [00:36:20]:
And I'm curious, was that an intentional thing that you had been doing to win this business or was it more like for whatever reason you were attracting both these direct customer relationships as well as these MSPs?

Danny Jenkins [00:36:37]:
I suppose where it became intentional was it was getting really hard to sell. I needed high number of endpoints. So let's just say the first customer there were 110 endpoints. So $5,500 at $50 a year and it took six calls and a lot of work to get that 110 endpoints.

Danny Jenkins [00:36:57]:
And I, which meant I either had to increase the price or I had to figure out how do I get more endpoints. So sell to bigger businesses. Now selling to bigger businesses is fine, but when you sell to bigger businesses and you've got five employees, no one's buying from you.

Danny Jenkins [00:37:15]:
So, and so what we realize is MSPs are small businesses mostly they're 20 employee companies, 50 employee companies, 10 employee companies, 2 employee companies in some cases. But they often represent much more endpoints than they are in size.

Danny Jenkins [00:37:30]:
So if you're a 500 employee company, you have 500 endpoints and your revenue is represented that you have 500 employees. So whatever the average revenue is, say you've got $100,000 revenue, you've got $50 million of revenue. So you're decent sized company.

Danny Jenkins [00:37:52]:
If you're an MSP, you might have $2 million of revenue, but you potentially represent with a Handful of employees. So you're a small business, but you represent thousands of endpoints. And because you're billing these customers to help them.

Danny Jenkins [00:38:09]:
So we could go to an MSP and we could sell a thousand endpoints, but with the same, hey, you're talking to the CEO. We're a small business, you're a small business. No one really cares. When you go to a bank, they're like, well, where's the support team? How big are you?

Danny Jenkins [00:38:24]:
Who am I going to call if there's a problem? You're telling me you're the, you're the tech lead, you're the cto, you're the chief sales guy. They don't want to do that. So the MSPs allowed us to break through that.

Danny Jenkins [00:38:35]:
And we went from 50% MSPs in and then in July 2021, and now it's back to, I think, more enterprise business than MSP business again. But, but in July 2021, there was a vulnerability at a product called Kaseya, which is a tool that MSPs use. And it pushed ransomware out to like 40,000 businesses worldwide.

Danny Jenkins [00:38:57]:
And threat lock was the only thing that blocked it. So it became like instantly overnight. I was begging people not to install. I was literally like, don't install any more agents. Don't install any more agents. Our data centers are on fire. Everything is 100% utilization. And I'm like, I don't know what to do.

Danny Jenkins [00:39:14]:
Can you please stop installing it? And we went from adding, I think three or four hundred thousand dollars of every ARR a month in June of 2021 to one and a half million overnight like that. Because suddenly the entire MSP community knew that this is how we stop these attacks.

Omer Khan [00:39:33]:
So was it more like a pivot towards MSPs? Did you intentionally decide this is where the future is, this is where we need to focus?

Danny Jenkins [00:39:43]:
No, I don't think it was a pivot. I think MSPs are very important vertical, but they become one vertical. So if we look at today, I think over half of our business is non MSP right now. And 75% of our new business is enterprise. But MSP is the most important.

Danny Jenkins [00:39:59]:
But if you look at it as enterprise versus msp, then you think about pivot. But if you look at it as, I want to sell to Orlando Magic is a customer of ours. So a lot of sports teams actually are customers of ours. So we consider that a vertical sports teams.

Danny Jenkins [00:40:13]:
We have hospitals, that's a vertical healthcare, we have banking. It's a huge Vertical that we sell to, we have airlines and transportation. So we got biggest airports in the world, some of the biggest airlines in the world is customers. And that's a vertical. MSP's is a vertical. So I don't think it was necessarily a pivot.

Danny Jenkins [00:40:30]:
It was, let's concentrate on this vertical as one of the verticals we do, but it is one of many verticals.

Danny Jenkins [00:40:36]:
And it became a really, really important vertical because as a startup, but also it gets us to, I mean, our goal, our mission as a company is to make sure the entire world adopts a zero trust approach to security.

Danny Jenkins [00:40:50]:
If you, when you think about verticals in general, you think about the consumer of the product, the end user. But you could say we're in the aviation verticals. We got Jeff Blue, Heathrow, Colorado or Denver Airport, we got Melbourne Airport, a whole bunch of airports, airlines that we have as customers.

Danny Jenkins [00:41:08]:
But inside that vertical, there's also a bunch of small aviation companies. So that's where the MSPs become really important because instead of having us considering, hey, we've got this small aviation company that makes parts for a plane. The MSP is the vertical and they sell to the small aviation company.

Danny Jenkins [00:41:25]:
So it allows us to capture the small business part of the world, which is 30% of the world, if not more, whereas we couldn't do that. And if our mission is to protect the entire world, we have to figure out how we're going to do the small business part.

Danny Jenkins [00:41:37]:
And the MSP becomes a really, really important part of that.

Omer Khan [00:41:42]:
It sounds like throughout the business this whole concept of zero trust has been controversial, that it's been back from the accelerator telling you that you weren't doing the right thing. And presumably it's because as you said, the protection part is not that hard. It's like the implementation or something along those lines.

Omer Khan [00:42:06]:
I'm guessing because with Zero Trust, there's a lot of work on the customer to figure out what they allow in or allow through. Right. So is that part of the reason why people thought it was a bad idea at the time?

Danny Jenkins [00:42:22]:
So I think there's two parts to this. So first of all, if you go back to 1995 or 2005 or 2015, either implementing and zero trust isn't a product, it's an idea. And there's two ways you can have an idea. You could say, let's just forget technology.

Danny Jenkins [00:42:38]:
You could say, I'm going to leave my front door unlocked and anyone can come into my house that doesn't have a criminal record. And that's you know, and that's pretty much how public facilities happen. If you go to a shopping mall, anyone can come into the door unless security locked them because they've been shoplifting before.

Danny Jenkins [00:42:56]:
And then someone comes in, they shoplift, they get put on the list, they're not allowed back in. And that's, you could do that with your house, you could do that with shopping malls. And if you think about computers, that's how computers are treated. That.

Danny Jenkins [00:43:07]:
Now it could be anyone can access my files, it could be anyone can log into my email. It could be anyone can access, run any software they want in my environment. Unless we've explicitly said it tonight and that's how typical antivirus EDR security works throughoutLocker, the idea of zero trust and different levels of security.

Danny Jenkins [00:43:26]:
But let's just start with what we started, application control. We said you can't run software unless it's been explicitly approved by the business. Now people don't change the software they run every day. It's relatively easy.

Danny Jenkins [00:43:37]:
But to get to a point where you know what's running is terrifying because if you're an airport, you probably have 10,000 different apps across your business. So historically creating that database, creating that list, maintaining that list, updating that list was really, really difficult.

Danny Jenkins [00:43:50]:
So a company like ThreatLocker, we're 800 plus employees, I think 1000 endpoints in our org, it takes us two hours a month to maintain it. But in the old way it would have taken us two full time people to maintain it. So ThreatLocker came in and made it easy.

Danny Jenkins [00:44:06]:
But the other reason I genuinely believe this is considered controversial is because it's threatening. Because for, I mean threatening to our industry as a whole. Because for the last three decades the industry has peddled we have a better mousetrap, we have a better antivirus.

Danny Jenkins [00:44:27]:
Get our next gen, get our edr, get our threat hunting, get our sim, get our soc, all creating more revenue for the industry when you actually implement zero trust. Now I'm not saying these tools don't add some value, but the threat now gets stopped.

Danny Jenkins [00:44:47]:
And so what happens is we have an industry that recognizes that zero trust is the best way. It's difficult to achieve and we have to and it's hard to make technology that isn't easy makes it easy. And that's what we've done.

Danny Jenkins [00:45:03]:
But what other players in the industry say is rather than them coming in and saying oh, because they're already the best at detection maybe or they're perceived best at detection, but it's not Good enough. So they'll come in and they'll say things like, zero trust is great, it's just impossible.

Danny Jenkins [00:45:20]:
So you'll have all of the CEOs selling the weight loss pill saying exercise is great, but it's just too hard. You should take weight loss pills. So trying to tell people don't even bother doing that is too hard.

Danny Jenkins [00:45:33]:
Whereas what we're saying is we're just going to make this easier and easier and easier and let's just focus on that. So it's been very controversial in that people are scared, it's difficult.

Danny Jenkins [00:45:42]:
But what we've done is say, well, we're going to make it easy and we're going to let our customers tell everyone else how easy it is and how manageable it is. And then we're going to let the competitors just keep saying we're doing it's hard. Because that's the only argument.

Danny Jenkins [00:45:56]:
You can't argue against a zero trusted approach other than it's going to be too hard and it's not hard. But if you say that you scare people, you create fear, so then they stick with the old approach.

Omer Khan [00:46:07]:
I'd love to keep talking, but we should wrap up and get onto the lightning round. So I've got five quick fire questions for you. Ready?

Danny Jenkins [00:46:15]:
Yes.

Omer Khan [00:46:16]:
Okay. What's a common piece of business advice or startup advice that you disagree with?

Danny Jenkins [00:46:21]:
I don't know what's common, unfortunately, but I would say the worst thing you can do is analyze and you are told that a lot as a dinghy. Market research is overrated. The fastest way for you to know if your product is not viable is.

Danny Jenkins [00:46:38]:
Well, is get it in front of someone and ask them if they're willing to pay money for it. If you interview 100 people, they're going to. The data collection mechanisms are so unreliable you're just going to waste time. Just develop and sell. That'll tell you if it works.

Omer Khan [00:46:52]:
What is a great book that you have read recently?

Danny Jenkins [00:46:55]:
Okay, so I don't have an answer to that because I've been disappointed with nearly every book I've read. I prefer to consume very summarized, direct content that solves real problems. And I'll give you an example of this.

Danny Jenkins [00:47:08]:
A book I tried to read and got halfway through and said I got my answers in the first three pages and shouldn't have read anymore. There's a book called the. It was written by the CRO of HubSpot. It's called the Sales Acceleration Formula and there's nothing wrong with the book by the Way, it's absolutely right.

Danny Jenkins [00:47:22]:
It says you should measure your sales team. There isn't a right or wrong. See what date, use data to determine the type of people you're hiring, what you're doing. My problem is the book is 250 pages and it tells you that in the first three paragraphs.

Danny Jenkins [00:47:34]:
And you could have read that in a blog post instead of a book. So I would say that was the fact of the book. So I'll say that was a valuable book. But I would say consume shorter content and save time rather than reading 400 pages when you could consume it in two.

Omer Khan [00:47:51]:
What's a lesson that you've had to learn the hard way?

Danny Jenkins [00:47:54]:
Oh, lots. So, I mean, I gave the example of the trademark, but I think I wouldn't have changed. Given the same set of scenarios, I wouldn't have changed it. I think the one lesson that I've learned the hardest way is that money and does not solve problems, it changes them.

Danny Jenkins [00:48:17]:
When you're a startup, you have one problem and I do not have an. You do not have enough finance to solve your problems. Once you have pretty much all the finance you need to solve your problems, it now becomes I can't find the right developer, I can't find the right team, the everything else.

Danny Jenkins [00:48:33]:
So that's, that's probably the, the hardest one, which is, as a startup, money's your only problem. Later on it will not be your only problem. And once you, when you have no money, you have one problem and that's I need money.

Danny Jenkins [00:48:44]:
When you have money, you have a hundred problems because now you need to solve them all and money didn't solve them like you thought it would.

Omer Khan [00:48:50]:
What's a tool or habit that saves you the most time?

Danny Jenkins [00:48:54]:
Tool or habit? I think standing. I think that the one thing, I don't know if it's a habit, but. But the one thing I would say you should do is keep everyone involved in anything as close to together, possibly. And I mean physically.

Danny Jenkins [00:49:10]:
I genuinely believe that if you are sitting across the room from someone, whatever problem a customer has that's going to take 8 hours can solve to solve, can be solved in 15 minutes if you physically stand next to each other. So I sit most of my time on the office floor with everyone else.

Danny Jenkins [00:49:26]:
If a customer has a problem, I will walk over to the person and then if they say, well, this person's working on something, I'll walk over to them. I think, get as close as you can and solve things as fast as you can. Always urgency is probably important. But making sure you keep everyone together.

Omer Khan [00:49:43]:
Great. And what do you enjoy doing outside of work?

Danny Jenkins [00:49:47]:
There's not much outside of work. I suppose the one thing that we've managed to keep throughout this is me and my wife ice skate together and we ice skate together. We do some. And I use this as we started as adults, but we do pair skating together. So we'll skate together.

Danny Jenkins [00:50:03]:
We'll lift and spin and we try and do that every Friday morning. I'd like to do it more, but it's. It gets our mind off work because pretty much everything else is work.

Omer Khan [00:50:14]:
Well, Danny, thank you so much for joining me. Great story, great conversation. If people want to check out ThreatLocker, they can go to ThreatLocker.com and if folks want to get in touch with you, what's the best way for them to do that?

Danny Jenkins [00:50:27]:
Probably LinkedIn. If you want to message me on LinkedIn, you might take a while to get a reply, but someone's always. Unfortunately, at this point, there's three people, but they'll get the important stuff in front of me. So reach out to me on LinkedIn.

Omer Khan [00:50:38]:
Awesome. Thank you. It's been a pleasure and I wish you and the team the best of success.

Danny Jenkins [00:50:44]:
Thank you.

Omer Khan [00:50:44]:
Cheers.