Ben Sabrin

CEO of Frame.io Emery Wells sold the company to Adobe in 2021 for nearly $1.3 billion. In our conversation, Emery shares his journey from NYC bartender to startup founder, including his work with Saturday Night Live that highlighted the pain points that led to Frame. We dive deep into his rejection of the lean startup concept, how he gets his team to obsess over design details, and the cultural reset at Frame that set the stage for its success. Some takeaways… → How to Get Your Team to Obsess Over Details In the early days, teams often presented unfinished work in demos, filled with caveats and incomplete elements. To address this, Emery introduced two types of weekly meetings: stakeholder reviews and build reviews. Stakeholder reviews allowed teams to present work in progress and gather feedback. Build reviews, on the other hand, required 100% finished, pixel-perfect work. Leadership pre-inspected presentations to ensure they met strict criteria, and if they didn’t, the meetings got canceled. While this process initially resulted in a lot of canceled meetings and friction, it ultimately established a culture of meticulousness, drastically improving product quality and polished demos. → Why Enterprise Software Sucks Enterprise software often lacks emphasis on brand, design, and quality of execution, traditionally leading to poor user experiences. However, with the consumerization of enterprise software, user expectations have shifted towards high-quality, intuitive experiences akin to consumer apps like Instagram. Today, end users within organizations can often influence purchasing decisions, making it more important for enterprise software to prioritize strong branding and user-friendly design. At Frame, building a strong user experience has greatly improved the brand and contributed to the company's success. → How to Get Your Team to 11/10 The hardest part about achieving 11/10 outcomes is pushing people beyond the point where they think they've done enough. The key is motivating the team to realize their full potential and surpass their perceived limits, but you must balance emotional boundaries and discomfort without causing burnout. If you do it right, the team will ultimately see they can achieve more than they initially thought possible. → How Emery Learned Culture Was Actually Important When 3 directors left and the VP of Engineering was replaced, Emery realized there was a cultural crisis at Frame. Previously, many different ideologies led to unhealthy internal debate, and they had no unified belief system. Emery then realized that culture is about shared decision-making approaches and a cohesive set of values, not just social norms. When Emery brought in new directors, they sat down to reset the culture and think hard about Frame’s cultural values, and it worked wonders. Full episode: https://lnkd.in/dVCx9S_Q

55

4 Comments

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

really liked the takeaways SeeMetrics distilled from this, esp about consensus security metrics still being unsettled as the technology, threats, and understanding levels are changing very quickly. https://lnkd.in/gZrxbsWQ

19

1 Comment

Ransomware can put SMB and critical infrastructure at risk. Kymberlee is taking the stage at Labscon to talk about the work we’re doing in this space

3

I often get asked “where do I start with TX-RAMP?” Companies know they need it - they’re told they do. But it’s not easy to know where to start. Here’s what you need to know 👇 1️⃣ File for your provisional certification. This will give you 18 months to get the full certification. 2️⃣ Download the TX-RAMP Security Plan Workbook. This serves as your questionnaire and list of necessary controls (117 for Level 1 certification, 223 for Level 2). 3️⃣ Build your program, one control at a time. Once your program is built, you can submit your workbook and other documents to the Texas DIR for their evaluation. No expensive, third party audits necessary! TX-RAMP Certification is a big project, even for companies that have an existing cybersecurity compliance program. There’s a reason they give you 18 months to go from provisional to full certification! Your certification lasts three years, but there are some ongoing reporting requirements to meet. You need to monitor, fix, and report vulnerabilities and breaches to the Texas DIR. More helpful info can be found in the guide below. https://lnkd.in/etitFTkY 

11

If it’s true that Thoma Bravo is once again exploring a SailPoint IPO, a few things need to happen for the exit to succeed. On the surface, this move seems like it's defying the odds for a normal four-to-seven year private equity holding period. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for over 1,000 days (and counting). Current market conditions are anything but favorable, at least for anyone other than the crème de la crème of the IPO pipeline. SailPoint is anything but typical, though. I'm not convinced they even needed to go private in the first place, but here we are. News of an impending IPO is exciting to anyone who (a) likes SailPoint, and (b) wants this IPO drought for our industry to end. This is far from a done deal, but it's credible enough to do some educated speculation about what it might take for SailPoint to go public again and stay there this time. My latest article is about the metrics, narrative, and alternatives that could lead to a second SailPoint IPO. You can read more by following the link on my profile.

37

4 Comments

A San Jose night full of good stories, laughs, and all things data security. Go beyond visibility, get the security, governance, and privacy outcomes you need with Varonis! Bo Lambert Cody Normyle Catherine Johnson Brian Vecci Inessa Rozenberg Alex Weber #varonis #datasecurity #dspm #datasecurityplatform

89

📢 Check Point Again a Frost Radar XDR Leader in 2024 In this report, Check Point was cited as a Growth and Innovation Leader in Extended Detection and Response (XDR). Check Point XDR/XPR Key Highlights: • Collaborative Threat Prevention • AI Copilot • Consolidated Threat Intelligence and Analytics • Infinity Playblocks Automation • Centralized IOC Management • Threat Intelligence & Event Correlation Download your free copy of the Frost Radar™ XDR Report to learn more about why Check Point is a Growth and Innovation leader in Extended Detection and Response 👉 https://lnkd.in/gecJVKrG Yael Cinamon

4

Apono is GA for Snowflake Just in Time / Just Enough Access!🚀 While other IAM tools rely on basic role/group in the IDP, which fails to scale, Apono uniquely delivers deep, direct API integrations in days to any new IAAS, DB, Server, Container, SaaS, or modern infrastructure. Following the recent credential configuration concerns relating to Snowflake, Apono responded quickly and is already GA for Snowflake. Feel free to check out the website for more info! #snowflake #incidentresponse #database #db #dba #databases #jit #justintime #jea #zerostandingprivilege #zsp

30

4 Comments

HubSpot - Security Shouldn't Be a Premium Feature In an era of rampant cyber threats, why is SSO-based 2FA still locked behind Enterprise pricing? Basic security measures like SSO+2FA should be standard across ALL paid tiers. Period. We're not discussing advanced security features here - just the basics of protecting our data and clients' trust. What do you think? Should fundamental security features be paywalled behind premium tiers? #cybersecurity #HubSpot #2FA #digitalsecurity #saas #productmanagement #infosec

17

1 Comment

It's a fucking honor to build products for the 99% of businesses that fall below the Fortune 500 poverty line 💪 While the Fortune 500 said SIEM was tired, the Fortune 5,000,000 showed us how to mic-drop! 🫳🎤 🧠 Affordable, predictive pricing *is* possible if you only store what matters 💾 Retaining / hunting thru petabytes of daily data *won't* break the model 💵 You can protect more than just your critical servers *if* the price is right Can't tell you how dope it feels to work with MSP partners / Customers to completely disrupt these perceptions—currently ingesting logs from 500,000+ data sources! Massive thanks to those Product Lab believers that demanded a new way to SIEM https://lnkd.in/eXKgmEHP and the team at ClickHouse who helped us reimagine a different approach to storage and scalability 🙏 https://lnkd.in/eVSh2Yfx

393

23 Comments

Made some words on Help Net Security about what it means to be an industry leading Enterprise DSPM. Sure, cloud is great and it's benefits are massive, but we can't ignore data on-prem and most importantly, sitting on mainframes processing transactions every day for the last 50-60 years! It's time for contextual visibility across all data domains to ensure proper security, compliance, privacy and governance. Enterprise DSPM the 1touch.io way enables teams to unlock the value of their sensitive data in a privacy-preserving way to drive new business and avoid running into the regulatory buzzsaw. https://lnkd.in/emwjfVG3

17

🕸 The Security Data Fabric Shift Explained🕸 Last month, Zscaler acquired Avalor for $350M. A security data fabric and vulnerability management startup that only came out of stealth in April of 2023. This acquisition sparked tons of interest and funding activity in the security data management space. It also reignited the platform v. best-of-breed debate and hinted at what's to come for AI in security products. However, this acquisition had many question marks surrounding it. In this deep dive, I cover: ✅ What security data fabrics and security data ETL are ✅ The flurry of activity that happened immediately after the acquisition ✅ Why the acquisition makes sense for Zscaler ✅ What other vendors are doing with data fabrics including CrowdStrike, Microsoft, F5, and SentinelOne. ✅ The implications for the security industry, including incumbents, startups, and security teams I also explore the growing importance of data and AI in security and how this acquisition positions Zscaler well for the next 5-10 years. What are your thoughts on this acquisition and the security data management space? Let me know what you think in the comments section! 👇 🔗 Link for the full post in the comments! #cybersecurity #datasecurity #AI #acquisition #innovation #infosec

62

23 Comments

✅ (9/38) CPG 1.I: Vendor/Supplier Cybersecurity Requirements In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at Vendor/Supplier Cybersecurity Requirements. ⏩ The tl;dr on this one - is define security requirements and use them as one of your criteria in vendor selection. This does not mean ignoring other factors, but security needs to be part of your consideration. We've previously discussed the outcomes we are looking for in supply chain security risk management, such as vulnerability and incident reporting and response, and described the need to get these documented in the contract. But this CPG is really your starting point before you even engage in those conversations. It directly relates to your vendor/product selection process and uses documented security requirements to define what is expected. As we are focusing on the CPGs, we'd of course recommend starting with relevant requirements that support your CPG program, but the reality is CPGs are only a starting point. Your vendor contracts will last much longer and need to withstand the test of time as your program matures beyond the CPGs. Consider your compliance and security requirements, and ensure that your vendor selection process does not create issues for you. For instance, there's no such thing as a NERC CIP certified product, run for the hills if your vendor tells you otherwise! But there is such a thing as a certifiable product, meaning it can be configured to meet your CIP and other security requirements. But how would you know if you have not documented them? I typically recommend breaking up the requirements into 2 categories: 🚦 Conformance and Performance ➡️ Conformance includes all the compliance, policy, regulatory and legal frameworks that govern what you MUST do. And your vendors must support for you to be compliant. This might be NERC CIP, NIST CSF or IEC 62443 or even state regulatory requirements. ➡️ Performance includes all the objectives that fall outside of these regulations, your critical functions, their dependencies and much of the thought process involved in a Cyber Informed Engineering strategy will lead you to the explicit requirements that may not map to a regulation, but are no less important. And then creating a vendor assessment process that is repeatable (it does not have to be a questionnaire) to evaluate solutions against these requirements and ensure that security is part of your procurement process. In our Notion CPG template at https://lnkd.in/ejWhFVJv we discuss this and more on managing your supply chain security requirements. The tools matter less than doing it and getting your organization onboard with the process. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #supplychainsecurity #securityrequirements

16

8 Comments

With everything going on with the CDK Global cybersecurity event (#ransomware), is your go to auto dealership doing what they are supposed to do to keep your data safe? If not, refer them to MaxDefense.io to see how we can reduce the #risk to your personal information! #atlanta #forsythcounty #gwinnettcounty #SMB #autodealerships #FTC #dataprivacy #cyberrisk #cyberinsurance #buyingcars #newcars #usedcars

8

The Redblock team is at Oktane. Okta's annual conference. Hit me up if you wanna see a demo of "How AI stitches disconnected identities and apps." 90% of business apps are disconnected from IAM. Neither SCIM nor SAML. If you are lucky, you have SSO instead of a saved password. As the number of web apps keeps growing, it has become a wild west. If you have to run a quarterly SOX audit on business-critical apps--it is an easy 60+ hours of effort. 👀 I will show how AI can bridge this gap — how you, as an Okta customer, can automate this Joiner, Mover, Leaver (JML) workflow. Using AI. 💡 Take, for example, QuickBooks Online. A popular app without any automation in Okta for provisioning and de-provisioning. How does AI solve this? Redblock’s AI Agents work like glue between Okta and Quickbooks: Okta ↔️ Redblock’s AI Agents ↔️ Quickbooks The AI orchestrates JML even if the target app has no automation. As a comparison, Human vs. AI ⤵️ 🤺 The Human in the Loop Workflow: 1. A user leaves the organization. Tickets filed to remove access 2. One of the tickets is removing this user access from Quickbooks 3. So an admin goes to Okta and removes the user from various groups 4. Since Quickbooks has no SCIM support, a separate ticket is filed for Quickbooks. 5. Another admin picks up the ticket, logs in to Quickbooks, and takes manual steps to deactivate.  6. Completes the workflow back upstream to fully offboard a user. 🤖 The AI in the Loop workflow: Step #3 from above: Simply remove the user from Okta. The AI will do the rest. DM me. #ai #cybersecurity #identity #iam

20

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

With Observo AI Point + Click = Pipeline Check out this ~2 minute video on how to build a pipeline to optimize noisy Windows Log to your SIEM! #LetsGoObservo #ObservabilityPipeline #SIEM #Windows #logs https://lnkd.in/eWnejeTg

5

I had a great conversation with Megan Gilbert and Fortune about the rapid evolution of AI, the rise of AI agents, and what this means for organizations looking to deploy them. At Okta and Auth0 by Okta, we’re working hard to ensure organizations can best capitalize on what these agents offer while deploying them safely and securely. Enabling trust and verifying their identity will be critical for these applications to be successful. Tune in to learn more: https://lnkd.in/e-ecCRnY

187