[00:04.440 --> 00:10.200]  Welcome back to the Career Hacking Village. Many of us think, do I really want to go
[00:10.200 --> 00:16.700]  work for somebody else? Do I want to, you know, report into an employer? Maybe I really want to
[00:16.700 --> 00:22.700]  start off on my own. So we're very happy that one of our own, who has done a phenomenal job
[00:22.700 --> 00:28.660]  starting his own company, wanted to share with us sort of the back end of what it's all about.
[00:28.660 --> 00:33.060]  So Bryson, share with us what it is about starting your own company.
[00:33.060 --> 00:38.720]  Welcome to Entrepreneurial Adventures, Starting Your Own Company. Kathleen, I'm going to correct
[00:38.720 --> 00:44.080]  you on one thing you said, done a phenomenal job. All I can say is I've been doing this for
[00:44.080 --> 00:49.480]  eight years, and I've started three different companies. I gave a keynote at a college a few
[00:49.480 --> 00:54.820]  years ago, and we were talking about entrepreneurialism. And somebody asked me,
[00:54.820 --> 00:58.320]  well, what's the metric of success? Like, how do you know you're successful? And I was like,
[00:58.320 --> 01:02.160]  I have no idea how to measure that. Every day that we get to continue to make payroll,
[01:02.160 --> 01:07.160]  and the company stays alive, is how I see success. So I don't know if it's been phenomenal,
[01:07.160 --> 01:13.800]  but I do appreciate the opportunity to continue to pursue the ideas and the passion with all of
[01:13.800 --> 01:20.200]  the great folks that I work with, and the fact that our companies have done so much for the community.
[01:21.240 --> 01:29.700]  All right, so I got a tweet that I wanted to include from Mark, and it was a great quote.
[01:29.700 --> 01:35.500]  An entrepreneur is someone who will jump off of a cliff and assemble an airplane on the way down.
[01:35.500 --> 01:39.360]  I guess the definition of success here is you don't crash.
[01:40.700 --> 01:49.540]  So who am I? I'm the guy who dresses up like a unicorn. So I founded Grimm eight years ago.
[01:49.780 --> 01:59.680]  While serving a large client, they gave the initial spark for the idea that became Scythe,
[01:59.680 --> 02:04.620]  and that's now my full-time job. I co-founded the non-profit, the ICS Village,
[02:04.620 --> 02:09.840]  and I'm a senior fellow at the R Street Institute, as well as the National Security Institute for
[02:09.840 --> 02:14.120]  National Security and Cybersecurity. So I have experience with a non-profit,
[02:14.380 --> 02:22.980]  a services company, and a product company. All right, this is me. I am not a lawyer.
[02:25.200 --> 02:33.840]  This is not legal advice. I'm not even one of the best entrepreneurs out there.
[02:36.260 --> 02:42.940]  I just want to really highlight this one. So besides my two dogs, that golden couch there
[02:42.940 --> 02:48.020]  is where I sat on day one, eight years ago, when I started Grimm and went, okay,
[02:48.020 --> 02:55.080]  so I've done the big adventure. Now what? That's where it all began. So starting with,
[02:55.080 --> 03:02.400]  why do you want to do this to yourself? Asterix, the reason we have so many people here on the
[03:02.400 --> 03:11.300]  screen is that it takes more than you to start a company. Your friends, your family, all of them
[03:11.300 --> 03:15.720]  are going to be a part of this journey for better or worse. And so when you're thinking about that
[03:15.720 --> 03:22.760]  question of why do I want to start this company, you need to think through why do we want to start
[03:22.760 --> 03:32.660]  this? The startup curve. When you actually finally take that leap, it's the honeymoon period. It's
[03:33.300 --> 03:38.520]  jumping into the great unknown. And it is so great. And it is wonderful for as long as it
[03:38.520 --> 03:45.840]  lasts. In my experience, it took about three to six months before that reality sets in.
[03:45.840 --> 03:51.020]  And then you're down in the, okay, what have I really gotten myself into?
[03:51.980 --> 03:59.660]  For the first two to three years of a company, you will find yourself every single month being
[03:59.660 --> 04:05.400]  confronted with some insurmountable challenge, some existential threat to your ability
[04:06.240 --> 04:12.660]  to continue to go. And you'll make your way through it. And at some point, you'll hit that
[04:12.660 --> 04:19.700]  point where things start to click. Things start to work. Those crises don't keep happening.
[04:19.700 --> 04:25.020]  And at some point, then people start to know who you are.
[04:25.260 --> 04:30.520]  And they start to come to you for that solution. And it takes off.
[04:31.520 --> 04:39.640]  So to be an entrepreneur, I believe requires only two primary skills. Passion,
[04:39.640 --> 04:47.360]  intolerance for bullshit. You don't need to be the smartest. Look at me. What you do need
[04:47.360 --> 04:54.680]  is a passion for an idea that each day that you're not doing that idea, it hurts you.
[04:54.680 --> 05:02.340]  There's an itch that this idea needs to get out there into the world. And when you're in charge,
[05:02.340 --> 05:09.320]  you are in charge. You are the CEO and you're the janitor. Nobody else is going to clean up.
[05:09.320 --> 05:14.940]  Nobody else is going to pick up everything. The buck literally stops with you. And so that
[05:14.940 --> 05:21.240]  tolerance for bullshit is you need that patience and the wherewithal that each day you're getting
[05:21.240 --> 05:25.300]  up, you're going at it and you're doing whatever needs to be done, which are going to be some
[05:25.300 --> 05:31.460]  really glamorous things on the high points and some not so glamorous administrative, HR,
[05:32.340 --> 05:38.240]  state registration, all of the litany of things that need to be done because nobody else is there
[05:38.240 --> 05:44.920]  to do them. That's your job. So you don't need to be the smartest. You do need to have some
[05:44.920 --> 05:51.440]  that you believe in. Do not do this for the money because that's one of the big jokes is
[05:51.440 --> 05:54.540]  starting your own company is one of the fastest ways to lose money.
[05:56.060 --> 06:01.260]  So what is the idea? The ideation phase. All right. First of all, if you've got an idea,
[06:01.760 --> 06:08.300]  talk to people. Then talk to some more people. Have them introduce you to even more people and
[06:08.300 --> 06:15.600]  talk to those people. And by talking, I mean, listen. So a lot of folks get so afraid to share
[06:15.600 --> 06:20.120]  their idea. They're like, hey, I don't want somebody else to steal my idea. Personally,
[06:20.120 --> 06:23.840]  if somebody else can do what I'm doing better than me, I am happy for them to do it because
[06:23.840 --> 06:29.460]  I shouldn't be doing it. But people are afraid. People are scared that if I give somebody something,
[06:29.460 --> 06:35.120]  they're going to take it away from me. You have to kind of get out of that because you're going
[06:35.120 --> 06:41.180]  to find that if your idea is really that good, most people can't execute it. There's a great
[06:41.180 --> 06:46.840]  phrase, and I think it's usually attributed to Ben Franklin, even though he probably didn't say it,
[06:46.840 --> 06:55.060]  which is that genius is 99% perspiration and 1% inspiration. Great ideas are a dime a dozen.
[06:55.140 --> 07:00.640]  The execution, the follow through, the day in, the day out of doing that makes the difference.
[07:00.640 --> 07:05.920]  And then, again, you, the entrepreneur, it's your network. It's who you talk to. It's them
[07:05.920 --> 07:10.920]  being willing to help you. And I can speak from personal experience. When I first started my own
[07:10.920 --> 07:17.720]  company, I came out of a very small closeted world in the intelligence community. I didn't have
[07:17.720 --> 07:24.360]  really a lot of contacts in the civilian world. And it took me a while to figure out how important
[07:24.360 --> 07:30.600]  that was. And as I started building those relationships, by asking and asking for help,
[07:30.600 --> 07:39.160]  people want to help you. Let them. The best technology doesn't win. So, the idea here is
[07:39.160 --> 07:43.660]  that we're looking for this concept of a value proposition. By talking to lots of folks,
[07:43.660 --> 07:49.520]  we figure out how to explain our idea, how to shape the idea, and more importantly,
[07:49.520 --> 07:55.020]  why would someone buy this idea? That's the value proposition. It's a very short,
[07:55.020 --> 08:03.220]  this is what we do that makes us money. And then, the expression of that idea that comes into code,
[08:03.220 --> 08:08.520]  into practice, that is the minimum level of features that somebody would buy it,
[08:08.520 --> 08:16.400]  is the minimum viable product. So, products versus services. This is important because
[08:16.400 --> 08:21.520]  we need to understand the economic model of what's underpinning our idea. If we're a services
[08:21.520 --> 08:27.020]  organization, we're going to grow organically. We're going to have people, one hour of a person's
[08:27.020 --> 08:35.320]  effort equals one hour of pay. Products have the allure of one hour of effort is worth whatever
[08:35.320 --> 08:41.300]  somebody's willing to pay for that. That multiple is why you see those kinds of acquisitions that
[08:41.300 --> 08:46.040]  seem very exciting, where people pay a lot of money for a product. You don't get those same
[08:46.040 --> 08:55.040]  multiples on services because people don't scale. When I started Grimm, I had folks in the private
[08:55.040 --> 08:59.100]  equity and VC community coming to me and they would be like, well, what's your business model?
[08:59.100 --> 09:04.700]  And I would explain, well, we hire the best team of hackers. And I emphasize that the team because
[09:04.700 --> 09:09.300]  hacking really is a team sport these days. You can't just have the single prima donna who can
[09:09.300 --> 09:12.300]  make everything happen. It needs to be the best team. And they're like, all right, well, that
[09:12.300 --> 09:17.460]  sounds great. How are you going to grow that? I was like, well, as much as we can continue to
[09:17.460 --> 09:23.840]  find the best team that we can fit that with. They're like, well, that doesn't scale. No,
[09:23.840 --> 09:29.700]  it doesn't. Unless you're going to give up on that idea and try to figure out some other way of
[09:30.600 --> 09:35.660]  commodity people, which is really the pyramid of I have some expensive people and then I just hire
[09:35.660 --> 09:40.440]  lots of cheap labor. And even then, you're still scaling by person and the money that they're
[09:40.440 --> 09:50.060]  making is still one hour of work for one hour of pay. So you want to do this. First thing,
[09:50.060 --> 09:56.020]  incorporate. You need to establish a legal structure. So the different kinds of structures
[09:56.020 --> 10:01.560]  are limited liability corporation and S corporation or C corporation. To start with,
[10:01.560 --> 10:05.980]  the simplest one is a limited liability corporation, which is just providing you
[10:05.980 --> 10:12.540]  the legal protections so that you as an individual have legal protection and coverage
[10:13.100 --> 10:20.700]  for doing work. Check the name availability. The IRS and states have the ability for you to look
[10:20.700 --> 10:28.040]  up the names that already exist. There are also ways that you can use names that don't necessarily
[10:28.040 --> 10:36.780]  have collision. Like I used an acronym to start Grimm, SMFS, to keep this PG rated. I will not
[10:36.780 --> 10:41.520]  share what that stands for, but use your imagination. And then we use Grimm as the
[10:41.520 --> 10:46.260]  doing business ad. So that's the trade name that actually ties to our logo and what we're doing,
[10:46.260 --> 10:51.820]  just like Scythe. With the IRS then, you need to go and register for an employee identification
[10:51.820 --> 10:56.160]  number. So you go to the IRS website, you request an employee identification number,
[10:56.160 --> 11:01.020]  they come back to you. That's basically the social security number for you. Why does the
[11:01.020 --> 11:05.980]  IRS want it? Because they want their taxes. They want you to pay them money. When you make money,
[11:05.980 --> 11:13.620]  they want it. Then at the state level, you need to create a local registration for each state
[11:13.620 --> 11:17.260]  that you're doing business in. If you have an employee in that state, you have to register in
[11:17.260 --> 11:22.180]  that state. If you sell in that state, you'll have to register in that state. I'm not going
[11:22.180 --> 11:28.940]  to go into a lot of the details, but the clever states to register in are one of the most well
[11:28.940 --> 11:38.260]  known, which is Delaware, and they are the the paragon for the ease of use and simple business
[11:38.260 --> 11:42.460]  friendly laws. A couple of others that are variations of that that are also well known
[11:42.460 --> 11:49.760]  are Nevada and Wyoming. As always, I'm not a lawyer. So make your own choice. And then a lot
[11:49.760 --> 11:54.160]  of places, you also need to register down at the county government. While you're doing this,
[11:54.160 --> 11:59.240]  I also recommend that you register with the U.S. government for procurement purposes.
[11:59.420 --> 12:02.480]  So this is not the U.S. government. This is not the side of the U.S. government that wants to
[12:02.480 --> 12:07.140]  take money. This is the side of the U.S. government that helps you get money. And so the two ways to
[12:07.140 --> 12:13.740]  do that are with the SAM system. I believe that's just sam.gov. Register for a CAGE code, and then
[12:13.740 --> 12:18.400]  Dun & Bradstreet will give you the same thing. Register and you'll get a DUNS number. They're
[12:18.400 --> 12:24.460]  free. It doesn't cost anything. It's actually fairly easy to do. And that just sets you up in
[12:24.460 --> 12:27.980]  place that if you ever need to do any kind of that stuff, and there are a lot of commercial
[12:27.980 --> 12:32.960]  companies that also will sometimes request a CAGE or a DUNS number, you're already set up and you
[12:32.960 --> 12:39.140]  don't have to worry about it again. So starting with your best friend forever. This is, of course,
[12:39.240 --> 12:46.640]  a common challenge. Business never goes as planned. And you can destroy a lot of relationships and
[12:46.640 --> 12:52.320]  friendships by doing that. So starting with, be clear on what are the roles, what are the
[12:52.320 --> 12:58.240]  expectations. One common mistake that a lot of people make is they immediately set the percentages
[12:58.790 --> 13:04.840]  of equity at the start. You don't necessarily have to do that. So, for example, you might decide,
[13:04.840 --> 13:10.300]  hey, we're going to start this business. And after the end of the year, we're going to look and see
[13:10.300 --> 13:14.880]  what's happened. And then maybe that's when we'll assign what the equity percentages should be.
[13:14.880 --> 13:20.380]  And the advantage for doing that is that you can actually make it fair. Maybe somebody started off
[13:20.380 --> 13:26.080]  and then, for whatever reason, decided to go do something else. You're not now still tied to that
[13:26.080 --> 13:31.440]  person with them owning a percentage of the company because it's not even a financial question.
[13:31.440 --> 13:36.560]  It can also be a question of control. Equity decides who gets to make the decisions in the
[13:36.560 --> 13:41.560]  company. So what if things change? What does success look like? That's something where
[13:42.100 --> 13:47.800]  that question where I got asked at the college keynote, what does your success look like? And I
[13:47.800 --> 13:53.220]  was just like, well, I keep going. I don't have some measure of success for what I'm doing for
[13:53.220 --> 13:58.660]  any of these companies other than particularly with Scythe. I just have a particular idea that
[13:58.660 --> 14:03.960]  I think really can help the industry. And I want to see that get out there. Now, that's not to say
[14:03.960 --> 14:10.740]  that money is not important. Money is the lifeblood of a company, especially if you have employees.
[14:12.180 --> 14:17.640]  You don't put food on the plate with ideas. You put food on the plate with money. And so making
[14:17.640 --> 14:22.760]  sure that with your friend, you both have those ideas of expectations. Who does what? What's the
[14:22.760 --> 14:26.860]  compensation going to be? And then what are you trying to accomplish? And what does that success
[14:26.860 --> 14:34.580]  look like? To raise or not to raise? That is the question. So let's start with the easy one.
[14:35.220 --> 14:42.160]  Starting a services company, probably not. You're growing by people. As you make more money,
[14:42.160 --> 14:47.620]  you hire more people and you grow organically. Very little reason and very few investors that
[14:47.620 --> 14:51.720]  will invest in a services company. As with everything, there are no absolutes, but just
[14:51.720 --> 14:57.940]  as a general rule, probably not a good idea. Products, you probably are going to look to
[14:57.940 --> 15:04.000]  raise at some point because there's going to be some element of speed to market to expertise.
[15:04.000 --> 15:12.160]  So my own personal example, I had a consultancy, Grimm. Grimm generates a good amount of cash.
[15:12.160 --> 15:19.060]  We use that money to invest in incubating the idea of Scythe for a couple of years and doing R&D with
[15:19.060 --> 15:26.000]  the Fortune 50 client that we were working with. And then I realized, okay, I want to take this
[15:26.000 --> 15:32.200]  software to market. I know absolutely nothing about commercial software and how to go to market.
[15:32.200 --> 15:36.380]  And so it wasn't the money that was important to me for the investors, but it was finding the
[15:36.380 --> 15:42.760]  right investors who could help provide me that expertise and experience so that I didn't learn
[15:42.760 --> 15:48.040]  some costly lessons that might kill the idea and successfully bring it together. So you're not just
[15:48.040 --> 15:52.400]  looking at it from a money perspective. You're also looking at it, what do they bring to the table?
[15:54.630 --> 16:05.350]  I wanted to call out, Haroon Mir had a great video on bootstrapping ego and really looking at that
[16:05.350 --> 16:10.450]  perspective again, where we talked earlier on the BFF slide about control with equity. You're
[16:10.450 --> 16:15.850]  constantly in this balance because as you bring other people in, and of course they bring and buy
[16:15.850 --> 16:21.130]  their money in, what they're buying is part of the company. That equity in that company represents
[16:21.130 --> 16:26.610]  control. And so there's this balance of how much control do I want to give up for other folks,
[16:26.610 --> 16:31.730]  balancing that with the potential that that capital can be used to really grow us.
[16:31.730 --> 16:35.730]  So I highly recommend checking out this video by Haroon to go in more detail.
[16:35.930 --> 16:40.010]  So the types of investors, all investors are not created equal.
[16:40.510 --> 16:46.190]  So the venture capital types are, there's funds and there's private equity. So these are the big
[16:46.190 --> 16:50.990]  institutions. And the biggest thing that I would say is if you are looking at raising,
[16:50.990 --> 16:56.410]  it takes some time to start to learn what the different types are. And particularly at the
[16:56.410 --> 17:03.130]  seed round, there are not a lot of investors who actually invest small amounts at that level,
[17:03.130 --> 17:06.850]  because it's a different time commitment for them. It's a different amount of risk.
[17:06.850 --> 17:12.750]  And they typically have very large funds where them writing a $500,000 check is almost a waste
[17:12.750 --> 17:16.570]  of time for them because they need to write really big checks to get the funds that are
[17:16.570 --> 17:23.350]  sitting there out. Save yourself the time and ask upfront what they do. What kinds of check
[17:23.350 --> 17:27.550]  sizes do they write? What rounds do they typically come in? Because you're going to find that there
[17:27.550 --> 17:33.430]  are a lot of later stage investors who want to chew up your time early and they're not going
[17:33.430 --> 17:41.070]  to give you money. Angels are smaller investors. They typically are writing check sizes of 25k to
[17:41.070 --> 17:48.690]  $100,000, sometimes more, sometimes less. That's just a range. These are typically folks who have
[17:48.690 --> 17:56.810]  been successful. Typically they were entrepreneurs. They want to continue to keep their hand in
[17:56.810 --> 18:02.170]  supporting other entrepreneurs in the industry. They're going to be very friendly and supportive.
[18:02.590 --> 18:07.070]  There's always friends and family. Friends and family are a good way to get started.
[18:08.290 --> 18:13.630]  Then there's this other sort of side concept called incubators, where what they'll do is
[18:13.630 --> 18:20.370]  it's typically a program that provides you office space. Pre-COVID, office space used to be a thing.
[18:20.390 --> 18:24.350]  Now that it's not a thing anymore, I don't know what incubators do other than perhaps they connect
[18:24.350 --> 18:32.350]  you to online seminars where they'll introduce you to different executives that might be in
[18:32.350 --> 18:36.990]  an industry that's a potential buyer. They'll introduce you to other VCs and investors and
[18:36.990 --> 18:42.270]  introduce you to other entrepreneurs. And then finally again, the government has a small business
[18:42.270 --> 18:50.490]  innovation fund called SIPR. The link is here. And different elements of government will put out
[18:50.490 --> 18:57.810]  different proposals. So if your technology or your idea matches one of those potential areas
[18:57.810 --> 19:05.590]  of interest, this is free money. They don't take equity with this. It comes in phases.
[19:05.590 --> 19:12.010]  Phase one is typically I think like $150,000 to $150,000. Excuse me, phase two can be $150,000 to
[19:12.010 --> 19:17.670]  $250,000. And then phase three, where they're trying to help push and scale into the government
[19:17.670 --> 19:24.310]  as well as commercialization, you're looking at a good half a million, $750,000.
[19:24.710 --> 19:28.470]  And so again, that's like free money. So just something worth considering.
[19:29.830 --> 19:34.310]  All right, so you've decided after all this thinking, you've got this idea, you're passionate,
[19:34.310 --> 19:39.590]  you want to do it, you've fleshed it out, so you're going to raise. You need a pitch deck.
[19:39.610 --> 19:48.510]  There are five core elements to the pitch deck. One page, what's the problem? One page,
[19:48.510 --> 19:53.750]  how does your solution help with it? You could use a few more pages after that, but if you can't
[19:53.750 --> 20:00.830]  condense in one slide how your solution works, you probably don't have it refined yet. Proof,
[20:00.830 --> 20:05.370]  do you have beta customers? Do you have examples? Tell me what you've got other than,
[20:05.370 --> 20:09.070]  that sounds like the greatest thing since sliced bread, that tells me that somebody else
[20:09.070 --> 20:15.930]  thinks about this. This is how investors are trying to fit. Is this just a great idea in
[20:15.930 --> 20:21.330]  somebody's, you know, in the proverbial engineer's garage? Or is this something that other people are
[20:21.330 --> 20:28.170]  going to believe in? Funding, how much do you want? This took me a while to get around that.
[20:28.170 --> 20:33.330]  I'm supposed to actually say how much money I want to actually do this. I just got so carried
[20:33.330 --> 20:38.710]  up in the selling, I forgot I needed to actually say how much money do I want from you? And then,
[20:38.710 --> 20:44.410]  what am I going to do with that? And then your vision, what does that look like? The schedule,
[20:44.410 --> 20:49.290]  the milestones, when will we get to a minimum viable product? What does that look like?
[20:49.290 --> 20:55.510]  Now, a lot of people get caught up on this part because investors might ask for, hey,
[20:55.510 --> 21:00.390]  tell me the potential addressable market, which we'll talk about shortly. They might say, hey,
[21:00.390 --> 21:05.730]  how am I supposed to know how much money we're making in two years? They're not looking for you
[21:05.730 --> 21:11.910]  to tell them a correct number. What they are looking for is your thinking. How did you get
[21:11.910 --> 21:16.310]  there? Does that make sense? Is it logical? So they're really just trying to get a better
[21:16.310 --> 21:22.850]  understanding of going inside your head. At the end of this presentation, I have numerous lists
[21:22.850 --> 21:28.230]  of wisdom from different entrepreneurs. This part includes Rangoola as well, and a link to
[21:28.230 --> 21:33.250]  more details on how to put together your pitch deck. And again, don't be afraid to share your
[21:33.250 --> 21:38.170]  pitch deck. I've had numerous folks send me examples of their pitch decks. I have shared my
[21:38.170 --> 21:43.450]  pitch deck, which I have spent two years refining through different versions as I've continued to
[21:43.450 --> 21:49.450]  learn what the hell I've built and what the hell our team has built. And I don't know if that one
[21:49.450 --> 21:54.110]  ever goes away, if you ever figure out exactly what you built in completion. Maybe once you're
[21:54.990 --> 21:58.170]  Apple, you have figured that out. And even then, it seems like they're still coming up with new
[21:58.170 --> 22:05.750]  things. So the process. All right. So first, caveat. Everything Cishet white male founders
[22:05.750 --> 22:12.450]  tell you probably will not work if you're not in that group. I am a Cishet white male founder.
[22:12.450 --> 22:20.790]  So the point here, and my good friend Katie provided this quote here, is the raise process
[22:20.790 --> 22:27.410]  is a very insular community. I can speak to one bias that I personally experienced, which is the
[22:27.410 --> 22:33.590]  West Coast bias. A lot of VCs, a large portion of the money, are on the West Coast. Now, that has
[22:33.590 --> 22:38.170]  been shifting, and there have been numerous centers of additional innovation and investment outside
[22:38.170 --> 22:45.330]  of it, but it is the main draw. And numerous West Coast investors that I talked to, the first
[22:45.330 --> 22:49.070]  question they would ask me, because I'm on the East Coast, is, so when are you moving to the
[22:49.070 --> 22:54.630]  Valley? I'm like, well, I'm not moving to the Valley. I'm going to stay on the East Coast.
[22:54.630 --> 23:00.650]  And that was a non-starter. Then there's a challenge which we see in InfoSec and IT in
[23:00.650 --> 23:06.690]  general, which is the tech bros. The, hey, I'm a tech, you know, I'm a guy, and there's an inherent
[23:06.690 --> 23:12.850]  bias about anybody who doesn't fit the certain way that they look. And then, of course, the
[23:12.850 --> 23:18.250]  challenge here is because the community is so insular with the investments, it is based on
[23:18.250 --> 23:23.010]  relationships, but you're stuck in this chicken and this egg of how do you build those relationships?
[23:23.190 --> 23:29.090]  And so this is an area where, again, having built that network can help you crack it, but Katie
[23:29.090 --> 23:35.010]  sums it up really well. This is a very insular community, and you're going to hear a lot of
[23:35.010 --> 23:40.730]  advice from the Ted style talks of like, well, this is how you do it. And a lot of it won't apply
[23:40.730 --> 23:50.470]  because that privilege doesn't automatically just confer. So capital. All right. Taking capital,
[23:50.470 --> 23:56.950]  getting an investment is like getting married. You could have the prenuptial, which is a convertible
[23:56.950 --> 24:02.390]  note or straight equity. So there's really two different ways of doing this. One,
[24:02.390 --> 24:09.130]  convertible note is almost like a loan under set circumstances that once a round is finalized at
[24:09.130 --> 24:15.270]  some point in the future, the money that they invested converts into that equity in that future.
[24:15.590 --> 24:20.030]  And then, of course, there's just the straight equity, which is I'm buying this amount.
[24:20.410 --> 24:27.430]  I'm giving this amount. I get this amount. I think it is an apt metaphor to talk about this
[24:27.430 --> 24:32.850]  like marriage. Whoever you're jumping into bed with as a part of your company, they're going to
[24:32.850 --> 24:39.810]  be there for a long time. And if it goes poorly, it's going to be very, very messy. So think very
[24:39.810 --> 24:45.010]  carefully. Do not get caught up so much in the money assigned to a name and really think through
[24:45.010 --> 24:51.210]  who and why you want to work with the various folks that you're bringing into your idea.
[24:53.210 --> 24:57.770]  Some of these folks who are the major investors are probably going to want to have formal
[24:57.770 --> 25:04.590]  influence through your board. And there's really two formal roles there. One is a director,
[25:04.590 --> 25:10.850]  which means that they get a formal vote as a part of board assigned to the amount of their control,
[25:10.850 --> 25:15.570]  which we've talked about. And then observers, where they don't have a formal vote, but they
[25:15.570 --> 25:20.510]  are allowed to be and to talk at the board meetings. And then there could be other kinds
[25:20.510 --> 25:26.190]  of folks on the board, like some people bring in independents, some people bring in folks that
[25:26.190 --> 25:31.410]  represent that are independent, that represent different potential customer types for the
[25:31.410 --> 25:41.830]  industry. But that board is going to be the captaincy that provides the advice for execution.
[25:41.830 --> 25:47.130]  So this is probably the biggest thing that I've seen a lot of founders and CEOs struggle with,
[25:47.130 --> 25:56.130]  is in most places, you do not work for the board. The board works for and with you. They're there
[25:56.130 --> 26:00.810]  at the end of the day. They have their meeting, they say their things. It's the CEO who's
[26:00.810 --> 26:06.630]  responsible for going and executing that and making sure that that actually happens. And yes,
[26:06.630 --> 26:11.510]  they're accountable to the board, but don't get lost in the fact that the board is there to help
[26:11.510 --> 26:24.810]  you, not just tell you what to do. So addressable market. Addressable market is
[26:25.930 --> 26:30.690]  really, really, really, really, really, really, really hard to do. Like I said, it's more around
[26:30.690 --> 26:38.330]  the thinking. The best way to do an addressable market buildup is saying, okay, I think there are
[26:38.330 --> 26:42.790]  these kinds of customers. So I have a blue unicorn or red unicorn and a purple unicorn
[26:42.790 --> 26:48.090]  who represent different kinds of customers. And they're willing to pay roughly this amount,
[26:48.090 --> 26:51.030]  or this amount and this amount. And I think there's this many of them.
[26:51.050 --> 26:55.290]  This is the preferred way to try to build up an addressable market as opposed to
[26:57.910 --> 27:02.410]  vulnerability management. It's a $4 billion market. I think I can get 10% of it. Therefore,
[27:02.410 --> 27:11.050]  my addressable market is $400 million. And that's not going to cut it. They want to see
[27:11.050 --> 27:15.410]  you understanding, hey, I think that I can charge this kind of customer this amount. And I think
[27:15.410 --> 27:19.050]  there are this many of them, this many of them, and this many of them. And then put that together.
[27:19.050 --> 27:24.110]  And now you can show all of your thinking. Like I said, they're not looking for the correct answer
[27:24.110 --> 27:29.950]  because they don't know. This isn't a test. You're not being graded. It's really how believable is it
[27:29.950 --> 27:36.430]  and does it make sense? Is that something that somebody could see playing out as you execute?
[27:37.330 --> 27:43.930]  That's how you get your overall addressable market. So, economics. A person does not cost
[27:44.290 --> 27:49.570]  a person. Most people think of what a person costs, or in this case, a unicorn. I love my
[27:49.570 --> 27:55.290]  unicorn references. And it's not just the salary that makes up what a person costs.
[27:55.290 --> 28:01.270]  Whoop, going the wrong way. So, hourly salary is the base cost. And then on top of that,
[28:01.270 --> 28:06.910]  you have multiple elements. Fringe, general administration, and overhead.
[28:07.250 --> 28:15.390]  So, fringe is benefits. Health insurance, holidays, paid time off. What are the different
[28:15.390 --> 28:22.690]  kinds of benefits that are 401k match that are offered to an employee? Then you have the back
[28:22.690 --> 28:27.870]  office element. So, there's two elements of back office. General and administration is like
[28:27.870 --> 28:34.470]  headquarters. What does it cost to administer the overall company? Overhead are specific project
[28:34.470 --> 28:39.210]  costs. So, in a product company, you're probably not going to have specific project costs,
[28:39.210 --> 28:44.990]  but in a consultant company or a services-based consultant company, you might have specific client
[28:44.990 --> 28:51.070]  costs that you need to have. And those roll up, and that gives you this multiple. So, on average,
[28:51.070 --> 28:55.950]  you're going to see a multiple of an employee costing anywhere from about 1.3 times their
[28:55.950 --> 29:04.170]  salary up to the low to mid 2. So, up to about 2.5 for a very high-end expensive company.
[29:06.570 --> 29:13.010]  Hiring. Hey, you know people, right? And that's typically where you start is in the very beginning
[29:13.010 --> 29:16.870]  when you're looking for those first hires, you're probably going to be looking at friends in your
[29:16.870 --> 29:23.630]  network. One of the challenges that come with hiring and when a company is small is the mistake
[29:23.630 --> 29:30.410]  that folks make around rank. Chances are the person that you hire to be in charge of sales
[29:30.410 --> 29:38.070]  or engineering or business partnership, they're probably not going to be the same person that's
[29:38.070 --> 29:44.590]  in that role if you do become very successful. The difference between running a company in sales for
[29:45.530 --> 29:51.810]  a company that's small and 10 people, that job changes when it's 500 people. Their ability to
[29:51.810 --> 29:56.910]  grow with that becomes challenging and that rank can make it difficult for them to grow into that.
[29:56.910 --> 30:01.910]  So, that's something where in the very beginning try to punt that as much as possible. The real
[30:01.910 --> 30:06.910]  big part on this of course is incentive. What are the different kinds of incentives that I can offer
[30:06.910 --> 30:13.310]  for this? I remember when I first started Grimm and we were three people and I was looking to
[30:13.310 --> 30:18.850]  hire engineers and one of them was just like, well, how much of the company I'm getting?
[30:18.850 --> 30:23.970]  I was like, I mean, we've been in business now for a year and a half or a year, whatever it was,
[30:24.570 --> 30:29.530]  and you're not bringing anything to the table. You have a salary and all of the benefits,
[30:29.530 --> 30:33.210]  you put no blood, sweat, and tears in this, and fundamentally you're not going to help
[30:33.210 --> 30:41.310]  grow the company. Equity really wants to be tied to like serious growth. Now, what I've done is,
[30:41.310 --> 30:46.470]  so I want everybody to feel like they're a part of it, is hey, maybe you're not getting like
[30:46.470 --> 30:52.110]  significant equity, but we are going to align everybody by giving out, all employees are going
[30:52.110 --> 30:58.730]  to have options in the company, which ties to equity. So what an option is, is a way to be a
[30:58.730 --> 31:04.410]  non-taxable event. Again, not an accountant, not a lawyer, but the phrasing here is important
[31:04.410 --> 31:10.030]  because if I give you direct equity, which is worth something of value, that's a taxable event
[31:10.030 --> 31:15.830]  immediately. If I give you options, which are essentially saying, hey, today's price for what
[31:15.830 --> 31:22.210]  we're valuing this at, the company's going to grow, you get to benefit off of that delta,
[31:22.210 --> 31:27.470]  that's what an option does for you. So that as the company grows in value, you have an option to
[31:27.470 --> 31:32.570]  take advantage of that growth. And then finally, of course, is the bonus, which you want to make
[31:32.570 --> 31:36.890]  sure is clear on that. Keeping in mind, particularly as a young company, bonuses can be very
[31:36.890 --> 31:41.870]  challenging because you need that cash in the beginning to grow because cash is king.
[31:43.190 --> 31:50.410]  Cash is king or queen. Cash is royalty. We're going to be correct. So we talked about benefits.
[31:51.270 --> 31:55.070]  One thing that I'll throw out there to help make your life easier, I'm not necessarily
[31:55.070 --> 32:00.430]  advocating for it, I've never used them, is the PEO, the Professional Employer Organization.
[32:00.430 --> 32:05.130]  So there are companies out there that what they do is effectively you and your employees
[32:05.130 --> 32:13.750]  become an employee of their company. And you benefit from the scale of all of those employees
[32:13.750 --> 32:18.830]  to provide savings back that you're paying for. So they provide all of the benefits and the health
[32:18.830 --> 32:26.230]  insurance and the 401k, they'll do the HR stuff, and you pay for that, but it costs you less than
[32:26.230 --> 32:33.490]  it would to go and get it on your own, is the theory. So just another option on how to do
[32:33.490 --> 32:40.690]  otherwise, like we talked about earlier with tolerance for bullshit, you will have to go and
[32:40.690 --> 32:45.830]  learn all of this yourself. I personally went and I learned more about health insurance than I ever
[32:45.830 --> 32:51.230]  thought I would know in my entire life. And that's the way it goes if that's what you want to do.
[32:51.710 --> 32:59.230]  Back office, other considerations for back office, support for contracts. Most folks are not experts
[32:59.230 --> 33:04.370]  in reading through terms and conditions. You are going to get lots of terms and conditions because
[33:04.370 --> 33:13.090]  any customer is going to have a formal element there. Legal, you need to get counsel. We talked
[33:13.090 --> 33:18.770]  before, I'm not a lawyer. This is not legal advice. You will want counsel to help with some
[33:18.770 --> 33:23.310]  of these elements. As you grow, human resources will become more important because in the very
[33:23.310 --> 33:28.490]  beginning, everything's very simple. You don't really even need policies probably. At some point,
[33:28.490 --> 33:33.510]  I promise you, somebody will do something dumb. You will get to that scale. That's where you really
[33:33.510 --> 33:39.970]  need to preempt those with having human resources and policy to get ahead of that. Payroll, people
[33:39.970 --> 33:45.150]  need to be paid regularly. You cannot screw that up. Somebody should be doing your payroll.
[33:46.210 --> 33:51.430]  Accounting, accounting is critical because this is the system of record. If money is the lifeblood
[33:51.430 --> 33:56.030]  of the company, accounting is what tracks where all that money is going and keeps you out of hot
[33:56.030 --> 34:01.610]  water when the IRS comes knocking and saying, hey, we think you paid this amount. You owe us this much.
[34:01.830 --> 34:07.290]  And then finally, business insurance. You are going to need to have various kinds of business
[34:07.290 --> 34:13.150]  insurance, anything from general liability to errors and omissions if you're doing professional
[34:13.150 --> 34:21.370]  consulting, different kinds of property insurance. What I would recommend is that first contract that
[34:21.370 --> 34:27.150]  you get from a customer is going to stipulate exactly what amounts of insurance you need to
[34:27.150 --> 34:32.370]  have. You will have enough time between getting that first copy and having to sign it and execute
[34:32.370 --> 34:38.690]  it to go and get insurance from somebody specifically to those amounts. So just me providing
[34:38.690 --> 34:47.370]  like a little cheat there. They'll tell you what to get. Go get it when you need to get it. You
[34:47.370 --> 34:55.270]  actual office itself. So now that COVID completely is a thing and nobody knows what an office is
[34:55.270 --> 35:04.670]  anymore, the remote work from home element is much more common. Really pay attention to the culture
[35:04.670 --> 35:11.150]  and the scale to do that. In the old days, getting space was something a lot of people rushed out to
[35:11.150 --> 35:14.590]  go do. Like I need a place to hang my shingle because I don't feel like a real business until
[35:14.590 --> 35:20.110]  I do that. I think that the pandemic has helped make that easier where folks don't feel
[35:20.630 --> 35:25.970]  obligated to do that anymore. But it is a consideration if you want. And of course, we
[35:25.970 --> 35:30.910]  talked about incubators as an option, but there's also dedicated, of course, now shared workspaces
[35:31.750 --> 35:35.410]  depending on what you want to do. And then on top of that, of course, is where
[35:35.410 --> 35:41.250]  do you want to put your equipment? What are you doing for storage? And tracking different assets.
[35:42.150 --> 35:49.830]  Intellectual property. So intellectual property is how you formalize what's valuable inside your
[35:49.830 --> 35:56.650]  company. Most obvious that everybody knows about are patents. A patent is where you go and with a
[35:56.650 --> 36:06.310]  lawyer file for disclosing what the idea is. And there's different kinds of patents. I won't go
[36:06.310 --> 36:12.210]  into the details there. And then there's this concept of trade secrets, which are, hey, I'm
[36:12.210 --> 36:18.170]  doing something that's proprietary to me. And by not disclosing it, it's essentially my own IP.
[36:18.170 --> 36:22.730]  Not as well protected, though, as a patent where you formally identify that. And then two other
[36:22.730 --> 36:29.390]  elements, which are trademarks and copyright. Trademarks are I have a particular image,
[36:29.950 --> 36:37.850]  like the Scythe logo is trademarked. So that somebody can't come and work off of that.
[36:37.850 --> 36:44.670]  And then a copyright is anything, any written work that you publish is yours. Somebody can't
[36:44.670 --> 36:48.690]  take it and just do whatever with it, claim it as their own.
[36:50.610 --> 36:53.650]  Talk to a lawyer. They're usually not this good looking.
[36:55.930 --> 37:01.590]  How to get clients. So, we are running out of time. So, I'm going to try to speed through these.
[37:04.750 --> 37:11.150]  Go to market is this concept of once I've built an idea, how do I take it and scale that across
[37:11.150 --> 37:15.070]  being able to sell it? Acquisition, though, is where we're just looking at, like, how do we go
[37:15.070 --> 37:20.530]  and get those clients? And again, this is where your network comes in handy. They will introduce
[37:20.530 --> 37:24.570]  you to potential clients. They will introduce you to prospects who are like, hey, yeah, I'm
[37:24.570 --> 37:30.330]  willing to try that out. One of the most interesting things I didn't really understand until I became a
[37:30.330 --> 37:34.690]  software vendor, because everybody picks on the vendors, right? Oh, vendors are like this and
[37:34.690 --> 37:38.910]  vendors are like that. At least they have good swag. And I love the free booze at the parties.
[37:38.910 --> 37:43.030]  Like, that's all vendors good for. Is there a lot of folks who understand, particularly in
[37:43.030 --> 37:51.670]  the InfoSec community, we in InfoSec don't really solve problems, right? We solve pieces of it,
[37:51.670 --> 37:56.670]  which clients then build out to a defense in depth measure. And there are a lot of clients
[37:56.670 --> 38:02.670]  who understand that they need to invest or they want to invest in being early adopters on what's
[38:02.670 --> 38:07.650]  the next technology, because they believe that can help make everything better for everybody else.
[38:07.650 --> 38:12.890]  We talked about contracts. The tissue paper of contracts is what's called the non-disclosure
[38:12.890 --> 38:18.170]  agreement. This should be a very simple document. The good news is when you're starting out,
[38:18.170 --> 38:22.810]  most of your clients already have all this paperwork for you. And so you can just follow
[38:22.810 --> 38:28.150]  along with that. The contract for the work itself, being very explicit with expectations,
[38:29.730 --> 38:33.850]  the period of performance, and then of course, how and when do you get paid?
[38:34.350 --> 38:40.750]  One of the things that was the hardest part around doing a business is I thought that
[38:40.750 --> 38:45.490]  getting the work was the hard part. Doing the work was easy because we're an expert,
[38:45.490 --> 38:52.310]  we know what we're doing. I didn't realize the hardest part is getting paid. Clients do not pay
[38:52.310 --> 38:59.570]  on time. Clients, you have to chase them. You have to focus on getting paid. A lot harder than it
[38:59.570 --> 39:08.190]  sounds. In conclusion, every month, you will face a random existential crisis that no amount
[39:08.190 --> 39:14.270]  of planning can prepare you for. You'll get past it. You will survive. And at some point,
[39:14.270 --> 39:20.450]  it's not happening. And you're not alone in doing it. I wanted to throw out some resources here.
[39:20.450 --> 39:24.610]  There's a Security Founders Slack. There's a Future Founders channel for those who are
[39:24.610 --> 39:31.430]  interested in getting started but aren't quite there. Some recommendations that I have that for
[39:31.430 --> 39:35.820]  ones that have done well for me, Gusto providing all the payroll and benefits administration.
[39:36.270 --> 39:42.070]  Pilot is easy and cheap accounting. The challenge there is it doesn't handle a lot of complexity.
[39:42.250 --> 39:47.890]  They only show up monthly. I liked Brex because that was a credit card that I could find that
[39:47.890 --> 39:54.990]  was not tied to my personal credit. Since then, additional credit cards have come out that
[39:55.570 --> 39:59.990]  also do this. So, I'll just throw out a handout. I think Stripe also does that now and I think
[39:59.990 --> 40:05.370]  there's two others. And then, any entrepreneur that you know will be happy to help as best as
[40:05.370 --> 40:10.790]  possible. I like to think of being an entrepreneur as like joining an exclusive club where the only
[40:10.790 --> 40:14.470]  requirement is the desire to join because every member will help you.
[40:18.510 --> 40:24.630]  And then, I have numerous entrepreneurs here who have provided their advice. So,
[40:24.630 --> 40:30.550]  all of that will be available in the slides. And I'm ready to take questions, I think.
[40:31.230 --> 40:39.590]  And questions will be in Discord and other venues when we share them with the community. Bryson,
[40:39.590 --> 40:45.710]  this is great. Absolutely wonderful. We might not be able to get to the remainder slides
[40:45.710 --> 40:51.430]  in the YouTube recordings. Yeah, I don't expect that. I'm just going to make sure that the slides
[40:51.430 --> 40:56.430]  are shared so that everybody can go through them on their own. So, where should people
[40:56.430 --> 41:02.910]  find those slides? I will post that in Discord when I figure it out next week when this airs.
[41:03.030 --> 41:08.570]  Sounds great. I just want to make sure we have a solution provided before we do it.
[41:09.850 --> 41:16.430]  Well, great. That was just absolutely wonderful. I thought that you were very methodical about
[41:16.430 --> 41:20.950]  laying it out because there are so many people, as we know in the community, have a really great
[41:20.950 --> 41:26.450]  idea and they want to charge out and do it and don't understand that infrastructure and passion
[41:26.450 --> 41:33.130]  and your tolerance for bullshit are really key things that need to happen. Bryson, I know you're
[41:33.130 --> 41:37.590]  really busy. Thanks for all you do for the community and thanks for being part of DEF CON.
[41:37.590 --> 41:40.230]  Take care. Thanks for having me.