The following interview is a conversation we had with Stephen de Vries, CEO and Co-Founder of IriusRisk, on our podcast Category Visionaries. You can view the full episode here: $40 Million Raised to Build the Future of Threat Modeling

Stephen de Vries
Thanks so much for having me. 

Brett
Brett, how do I do on pronouncing the name? I know were joking about that in the pre interview and I think I got it wrong there as well. 

Stephen de Vries
You nailed it. You nailed it, risk. That’s it. 

Brett
All right, perfect. Off to a good start then. Now let’s talk about you here. So can we just start with a quick summary of who you are and maybe a bit more about your background? 

Stephen de Vries
Yeah, sure. So I’m a Co-Founder and CEO of IriusRisk. And my background, I started off doing programming in c for a bank in South Africa. Maybe you can still hear the accent in the late 90s, fixing the Y two K bug, which was extremely dull. But it got me into working in finance and working into that kind of high stress banking environment, and I kind of quickly graduated from that. Linux was just becoming a thing back then and I was extremely intrigued by how it worked. I moved from programming into systems and eventually then moved into one of the first companies that was selling firewalls. This was the time when companies were just connecting up their internal networks to the Internet. 

Stephen de Vries
And when you did that, you needed to install this thing called a firewall to protect you from the big bad world out there on the Internet where people were going to attack you. And so that was kind of my switch from a development more kind of systems background into cybersecurity. And the bug bit me there and I just kept on working in cybersecurity from there. The other really interesting space for me was then software security, or also known as application security, which became a thing in the early two thousand s. I was doing a lot of penetration testing, so typically customers would send us a range of IP addresses and say, this is our infrastructure, there’s stuff here. See what you can find and see what you can attack and let us know what are the security issues there. 

Stephen de Vries
And we would go and do this, we’d scan those ranges, find points of attack, try and attack it, try and break into the applications. And that evolved into being a software security problem. Companies were still sending us IP addresses, but increasingly they were sending us URLs. They said, yeah, I don’t care about my infrastructure, I’ve got that protected, I know what I’m doing there. But we’ve written this unique application. It’s now live on the Internet. What are the security problems in this application? And that’s really why I’ve been dedicated most of my time is working on this problem of software security. Right. How do we build robust and resilient software? 

Stephen de Vries
So coming out of that consulting background, co founded IriusRisk in 2008 as a consulting firm, and then that turned into a product firm in 2014, where we now sell the IriusRisk threat modeling solution to help engineers design secure software. Right from the start, and a few. 

Brett
Things that I want to dive deeper into. The first one is something you said there at the start, which is the Y two K scare. So I was born in 1990, I was ten years old when that was all happening. And I do remember it. I remember being scared and following the news. But a lot of the founders listening in, they are probably five years or six years or maybe even a bit younger than me, and they probably don’t understand what it was like at that time. Can you talk us through what it was like from your perspective during that scare? 

Stephen de Vries
Yeah. So imagine how scared everyone is right now, that AI is going to steal your jobs and the world’s going to collapse. Why it was like that, but for everything else. And it was a time when everybody realized more and more things are running on computers, not to the degree that it is now, but banking systems were running on computers that were just storing dates in two digits. And all of a sudden the year 2000 was going to flip all of that upside down, and suddenly your bank balance was going to turn into a negative number because the computer made a mistake in the date calculation. So it was an interesting time, but it was pretty dull work to actually just go through source code looking for two digit dates and change them to four digit dates. 

Stephen de Vries
But yeah, it was definitely a good learning experience for me. 

Brett
And I saw on your LinkedIn that you’re regional mountain starring champion. What does that mean? 

Stephen de Vries
So I live up in northern Spain, and I love to go hiking in the mountains over here. But when I tell people I like hiking in the mountains, they think I enjoy the exercise of the mountains and I don’t. I just like being in the mountains and staring at the mountains. So I like staring at the view and getting to a summit and just enjoying that feeling of being there. The actual walking is kind of like a chore, so if I could get to the top sooner, I’d probably take it. So that’s what that means. 

Brett
Got it. Makes sense. Well, I’m guessing the answer is going to be no to my next question, but because you’re from South Africa, did you ever participate in that crazy ultra run they have? I think it’s camadres. 

Stephen de Vries
The comrades. Yeah, the comrades. I used to watch it on television with a bowl of popcorn. Yeah, it was super entertaining. Never, ever took part. 

Brett
I’m reading a book on it right now, or I’m reading a book on ultra running, and they had a chapter on that. They said it’s a huge deal in South Africa. 

Stephen de Vries
Oh, yeah, it’s a massive run and there are injuries, there’s heartache, it’s a drama. It’s fantastic to watch. That’s awesome. 

Brett
I’ll have to watch that next year. Now, a few other questions I like to ask, and the goal here is really just to better understand what makes you tick. So, first one, what Founder and CEO do you admire the most and what do you admire about them? 

Stephen de Vries
So, I really admire Scott Farquar and Mike Cannon Brooks, who are the founders of Atlassian. And the reason I admire them is just the way they bootstrapped that company. This was in the early 2000s, there wasn’t as much vc funding out there, and they just built a system from the ground up, bootstrapped it themselves, and they built something developers needed. They needed a bug tracking system. They themselves were using bugzilla. They weren’t happy with it wasn’t working, and they just built their own system. And it just is such a great story of that pure PlG motion where you’re building something for developers. Developers love it, they buy a bit more of it, and the thing just has a life of its own. 

Stephen de Vries
And they’re now on the Nasdaq and the team ticker and hugely successful company, and I just really admired the way they did that. What was really interesting about them as well was the early pricing curve. It wasn’t a case of it’s first free, and then the next step is you need to pay for it, and then there’s just kind of a straight line or a gradual volume discount curve on the pricing. Instead, what they had was kind of like an s curve. They had it very cheap. For the first, I think it was ten users or so. So they said, well, if you’re a team of ten people, you’re scrappy. You’re getting started. You can’t afford a big enterprise license, so we won’t charge you a big enterprise license. And then they had the jump. 

Stephen de Vries
So it was up to ten users was kind of like a reasonable price, and then there was a jump. If you’re more than ten, well, then now you need to start paying real money. And then you got into that gradual volume discount price curve. But it was interesting. It wasn’t just a linear model. It was cheap for small teams. And then all of a sudden, it started becoming more expensive when you were not that small group. 

Brett
Super interesting. And now another question we like to ask about is books. And I can see there you got a lot of books on the bookshelves there and how we like to frame this question. And I stole this from an author named Ryan Holiday, but he calls it a Quake book. So he defined a book as a book that rocks you to your core, and it really influences and changes how you view the world and how you think about the world. Do any quake books come to mind for you? 

Stephen de Vries
Yeah. And I had to think about this one. So I think the book that had the biggest influence in that way was probably the Bhagavad Gita. I grew up in a protestant kind of christian upbringing, and around 16, started exploring other religions and seeing what was going on there. And I picked up the Bhagavad Gita. And what really struck me was how different it was to the Judeo christian view of the world. And the thing that struck me was, give too many spoilers, but for those who haven’t read it. But Arjuna is out on the battlefield, and he has to fight this big battle, and he has an existential crisis of, he looks at the army that he’s going to be fighting, and he realizes, well, his cousins are there. 

Stephen de Vries
These are people he knows, but here he is on the opposing side, and he has to now go into battle and wage war against these people. And he has this cris saying, I shouldn’t do this. Why am I killing this, killing these people? It’s pointless. And he asks his KrIshna, you know, what should he do here? And you’d expect Lord KrIshna to, you know, yes, be peaceful and don’t hurt anybody. You’re the right thing. Instead, Lord Krishna says, you got to do it. This is war. This is your war. You’ve got to wade war against these people because this is your role and this is essentially your path in the world. 

Stephen de Vries
And that kind of rocked me as a 16 year old because I think it’s, and it still sticks with me, that even as a CEO of a company, you often have to make those kinds of decisions where sometimes it’s not something that you like to do and maybe even it’s not even something that you agree with doing, but it’s the right thing to do, and then you just have to do the right thing and go ahead and do it. So I think that was probably the book that had the biggest influence very early on. 

Brett
I’ve not read that book, but I’m adding it to my Amazon cart now. That sounds awesome. Now let’s switch gears and let’s talk about the company. So I know we touched on it there a little bit earlier in the conversation, but just at a high level, can you tell us about the product and the value that it brings to customers? 

Stephen de Vries
Yeah, sure. So what our product is it’s an automated system where developers log into IriusRisk. They can design a software architecture or a cloud architecture that they intend to build by diagramming it out. So they essentially design their system within IriusRisk. IriusRisk will ask them questions about what they are building. And based on the combination of the diagram that they’ve input, the questions that they’ve answered, we will automatically generate a list of security threats and security controls that they should consider for that particular design. What we’re essentially giving them is the ability to analyze the design of a system before they go and build it. And so that upfront they know what is the security work that’s waiting for them for this particular system. And they can make trade off decisions right there. 

Stephen de Vries
They can say, okay, we realize there’s now a security threat if we do things this way and we choose consciously to accept that particular risk because we know it’s going to cost us way too much to mitigate it, or we choose to implement a control to reduce the risk. The point is that those kinds of design decisions can be made at a much lower cost when you’re doing them upfront, when you’re doing them at design time, not after you’ve gone and built the application, it’s already deployed. And now you ask the security folks, come in and have a look at and tell me what are the security issues with this? So that’s really the value that we provide is this very early insight into what could go wrong with the thing that you want to build? 

Brett
And can you paint a picture for us of what that tech stack looks like for these teams. Typically, if we’re looking at application security or software security, what are some of the different tools and categories of tools that they’re going to have? 

Stephen de Vries
Yeah, so it’s interesting because when we started off, went for let’s allow people to build middle of the road software applications, which at that time was web applications and mobile applications, and that was kind of it, right? So if you were building a web app, you could choose different text apps within the web app world, as long as it wasn’t too exotic. We had content that would work for you there. And over time, we’ve been expanding that knowledge base and following the market, and the market needs the big changes that we’ve added there have been cloud. So it’s now very important to be able to model your cloud risks in addition to your software risks. So it’s all one stack, right? What you’re building on the cloud and what you’re building with software on top of that, it’s all one piece. 

Stephen de Vries
So we’ve got content in for the three major cloud providers at the moment. And the other interesting area is more around device security. And this was really driven by market demand. Currently, the FDA will not license medical devices in the US unless they’re accompanied by a threat model. So they expect every device that you’re going to be building as a vendor to come with a threat model that says, look, this is how we analyze this device at design time. And these were the security decisions we took at design time. Here’s our model that explains that. So because of this, we’ve added a lot of content that’s very kind of device specific. 

Stephen de Vries
We’ve added protocols like a Bluetooth and maybe even older technologies like rs two three two ports and rs four eight five and can bus and things like that, just because those are the kinds of technologies that these device manufacturers are using. So now you can model quite a wide range of applications, from devices and firmware to automotive systems to also cloud, mobile and web applications. 

Brett
And I know in the news in the last year, there was a lot related to software security and S bombs. And I believe it’s regulation that’s already come out or it’s going to come out soon. Can you talk us through how that fits into this upcoming regulations and this big conversation that everyone’s having now about securing the software supply chain? 

Stephen de Vries
Yeah, absolutely. Let me take a step back and let’s just get some perspective here. If you’ve ever built a house, you’ll know that the architect of that house plays a pretty significant role in the safety of it. Right. They’re making those key decisions on, well, what kind of beam do I need to span this particular room, and what kind of loading am I expecting on the roof? And therefore, I need to build it in this particular way. So in the real world, we pay a lot of attention to the security of design, right? 

Stephen de Vries
We design something from a security perspective or from a safety perspective in the software world, it’s now 2023, and now is the first time when we’re saying maybe it’ll be good idea that we look at the design of the things we’re building from a security perspective before we go and build them. And we don’t just build stuff and then try and break it and see what breaks and then decide whether it’s good or bad. So, yes, there’s legislation. It’s fantastic that it’s coming in 2023, but it’s coming in 2023, the first time that it’s now becoming mandatory to look at the design of your system before you go and build it. So the legislation that’s out is really based on the executive order from the Biden administration on cybersecurity. It requires that all software vendors to the federal government. 

Stephen de Vries
So when the federal government procures software, that software should follow a NIST framework called the NIST SSDF secure software development Framework. And that framework has about 20 or 25 steps in it, activities that you should do as the vendor to make sure that your software meets the minimum bar of security. And some of those things are, you should scan your code, you should use components that are known free of vulnerabilities. And two of those steps are, you need to have a design. You need to have a secure design. At least show that you thought about security during design time. And what were the decisions you made at design time? 

Brett
And when we look at threat modeling, is that an established category that’s out there? Does Gartner recognize that as a category? 

Stephen de Vries
They do. They do. And at the Gartner security conference just last month. They did a good talk on threat modeling. I think as a category, it’s been around for a while, but it’s been around really as a manual activity. So when you go out to the market and you say, I can threat model, or I’m offering a thing that gives you threat modeling, what most people understand is you’re offering a consulting service, you’re going to do it for me manually. There’s going to be a person who does it or you’re going to train me how to do it. So I think what’s fairly new is that there is tooling that can help automate this for you and you don’t need to do as much manually. 

Stephen de Vries
So I think that’s where it’s a fairly new category for us, where I think we’re breaking new ground here and saying in the same way that the other software security tooling came about to make manual processes more scalable, we’re doing the same thing for secure design, security architecture and threat modeling, which is essentially the same thing. 

Brett
And you mentioned Gartner there. What’s your view on analyst relations and what role do they play in your go to market and the success and the growth that you’re seeing today? 

Stephen de Vries
Interesting question. Yeah, I think it’s interesting, and I think it depends on who you’re selling to. If you’re selling to the enterprise space, I think the analysts play a bigger role. If you’re selling to maybe directly to engineers or a b to C space or even B2B in mid market, probably not so much. I think the online services like Captera and the comparison sites, they probably have a bigger influence to play than the analysts. But in the enterprise space, we found that working with analysts makes a difference and they’re still seen as the reference. So we’ve seen good value with the analysts and the companies that we work with. 

Brett
And I’ve never worked in a big enterprise, so I think I just struggle to wrap my head around it. But from my understanding, is it really like the CISo or CIO? Just goes to Gartner and they say, hey, here’s my problems. I want the best in this category. Make some recommendations. Is that how it works? 

Stephen de Vries
To a degree. To a degree. I haven’t been on that side of it. So we’re very much on the vendor side of it. So we’re talking to the analysts saying, look, this is what we see, and this is where we see industry going, and this is what our product can do. And the analyst then presumably has the reverse of that conversation with their clients. I think the end clients of the analysts are asking those kinds of questions, and they’re also asking broader questions around, hey, I’ve got this kind of problem. I’m doing this kind of security activity, and it’s taking me too long, and I don’t have adoption within my engineering teams. How do I solve that? 

Stephen de Vries
And that’s where the analysts will say, well, you can do this number of different ways, and maybe you need to get training in, or maybe you need to buy some tooling to help you or x, y, and z. So I think the analysts, they will mention products. I don’t think they’ll essentially be kind of overly pushy on choosing a particular product, but they’ll try and stay consultative in that respect and just let you know that there are products that can help solve particular problems for you. 

Brett
And I saw on the website that you grew 80% last year. I’m sure there’s a lot of factors that led to that growth and led to that success. But if we had to break it down into a few things, what do you think you’re getting right? How are you rising above the noise? Because obviously there’s a lot of noise in cybersecurity. There’s a lot of money that’s gone to cybersecurity vendors. How have you achieved that growth? 

Stephen de Vries
So I think a lot of the growth, and by the way, that was one of our slower years. The year before, were at 112% growth, and the year before that, were at about 104%. So 85 was a slower year for us. And some of that was expansion via existing customers, which for me is the most satisfying growth that we can have, because it’s not essentially a customer who’s gone through a demo and a pov and they maybe see through rose colored glasses. This is going to be a great solution. And we buy a license. When they expand, they’ve been using it, they’ve been rolling it out, they’ve been seeing value, and then they choose to increase their usage of the product. So I find that expansion growth is a lot more satisfying internally. And we also celebrate that internally within the company. 

Stephen de Vries
When a customer does expand, because it touches the entire company, it’s something that the product team did to build a feature that the customer needed or solve a problem that they had. It’s our customer success team that listened to what they needed and responded to. It’s our support team, it’s our sales team, it’s our marketing team. Back office, everybody is involved in that expansion. So it’s something we really value is expansion within the existing customer base. A lot of the growth came from expansion. The new logos really came from financial services customers. 

Stephen de Vries
So we signed in a number of new financial services customers, which I think is ascribed to what’s happening in the market with the NIST guidance that has come out that specifically wasn’t a driver, but it’s more a symptom of what is going on in the market, that there are a lot more eyes on building quality software, and not just building quality software that’s free of vulnerabilities, but showing that you’ve built it free of vulnerabilities and that you’ve done your due diligence, you’ve taken all the steps necessary to really think about security beforehand. So I think those have been good drivers for the growth last year. 

Brett
Something else I saw on your website that I thought was really interesting was the Forrester study that you conducted that talked about the ROI and the economic impact of threat modeling. Obviously, across every industry right now, there’s a lot of tension when it comes to buying, and I think ROI is something that’s on everyone’s mind right now. Can you talk us through that study, what it was like, and maybe just a range of what it costs so founders can understand what that would look like if they were to pursue something similar. 

Stephen de Vries
Yeah. So it was a great experience working with Forrester on that. And they interviewed four of our customers and they created essentially a fictitious customer who was a conglomeration of these four and said, well, these are the characteristics of this fictitious customer based on the real data of four of our existing customers. And what they measured was what were they doing before using us? How much was that costing them in terms of lost productivity, in terms of security issues that had to be remediated later on during the development process when it costs more to do so, and then compared that to after. They’re using IriusRisk, they’re getting that guidance upfront and they can start addressing these issues at design time and they don’t have to wait until they’ve gone and built the application. 

Stephen de Vries
So there were substantial savings on doing it versus a manual approach, versus using IriusRisk. And I can’t remember the exact values there, but there were substantial savings and a good return on investment there by using IriusRisk instead of using this old kind of manual approach that really doesn’t scale. 

Brett
And what was the cost of a study like that? Is it ten grand, fifty k, one hundred k or two hundred and fifty. 

Stephen de Vries
K, I am not sure I can disclose exactly, but let’s say less than fifty. 

Brett
K. Okay, less than 50k. We’ll take it. Now let’s switch gears a little bit and talk about money or talk about funding. So as I mentioned there in the intro, you’ve raised nearly $40 million in funding so far. What have you learned about fundraising and what advice would you have to cybersecurity founders who are just starting their fundraising journey? 

Stephen de Vries
Yeah, so I’ve learned a lot about myself in the fundraising process, and I know that I think investors expect an overly optimistic Founder to always come through with, we’re going to change the world. It’s going to be ultra amazing and everything is going to be 1000 x. And my personal style isn’t to present that way, so I’ll just present the numbers as they are, the projections, as we realistically think the projections are going to be. And often I’ll have investors. Their feedback to me is, yeah, that sounds kind of uninteresting. And I’m like, yeah, but it’s real. This is what we can actually deliver and we’re going to do that. 

Stephen de Vries
And their feedback is that, let’s call it maybe a humbler presenting style that isn’t, we’re going to go to Mars in a year, it’s more like we’re going to the moon in five years, is something they’re not used to. But when they see it, I think they recognize that, yeah, this is something that’s trustworthy and it’s not a crazy expectations with an over optimistic Founder. And they internally, mentally, then need to discount everything or divide everything by ten to come up with what is actually going to happen here and what are we actually going to deliver. So my advice to the Founder is just be authentic and you don’t need to try and present a version of what you think investors expect from a Founder. 

Stephen de Vries
There are a lot of different styles and there are a lot of different ways you can be so just be the way you are. And if they’re good investors, they’ll recognize that. 

Brett
Now, let’s imagine you were just starting the company again today from scratch. What would be the number one piece of advice you’d give to yourself? 

Stephen de Vries
So literally, we made a really silly, stupid mistake with the company, didn’t have a huge impact, but it would be something that I’d call out, which was, we essentially founded the company as a consulting firm, 2008, ran it as a consulting firm, and then 2014 decided to start building a product. And we had a kind of an overlap of about a year or so where we’re doing bit of consulting to fund the product development. And then 2016, we had a product and we could essentially stop doing consulting and we just kept on with the same company. Right. We just changed the business model and so on. 

Stephen de Vries
Why that was a mistake was that when you then apply for some of the grants that are available in the EU and I’m sure in the US and other geographies as well, or when you apply for things like startup accelerators, they will just ask you a very simple question, how old is your company? And all of a sudden you’re being penalized because you started the software business. Maybe this year, but you’ve got seven years of history as a consulting firm and now suddenly you’re a seven year old company. So my advice would be, if you do that, just shut down the old company, shut down the consulting business, it’s no longer a business. Wrap it up and start a new business. 

Stephen de Vries
And if you’re doing software business, start a new software business at a particular date, and you can then take advantage of a lot of the grants and awards and presentations and accelerators and all those kinds of things that you can do with a new company. 

Brett
That’s super useful advice, because just on this show alone, I’m speaking to more and more founders who are starting off with a services business, really developing an understanding of the problem and then building out software from there. So that’s going to be super relevant, I think, to anyone who’s in that space. And I think they would probably do what you did right. You would just kind of have it in one company. You wouldn’t even think to separate it. So that’s awesome advice. Now let’s talk about personal skill sets. So what do you think is the most important skill for a B2B Founder to have to thrive today and to be a successful entrepreneur, you. 

Stephen de Vries
Got to be a good listener. So in my personal journey, I came from a very technical background. I was doing this activity of threat modeling. I was training people on it, I was doing consulting around it. But I knew zero about sales, almost nothing about marketing, customer success and all these other aspects of a business. And I was very fortunate with our early investors. They really guided me in those blind spots like, hey, you need to think about outbound selling. Well, what’s outbound, right. And recommending how we approach things, recommending people that we talk to. So in order for that to work, you really need to be receptive to that. And you need to essentially know that you don’t know and say, okay, I don’t know enough about marketing. Let me go and find out. Let me listen to people. 

Stephen de Vries
And you’re going to hear a lot of different opinions, and you don’t need to follow everyone’s advice, but you need to listen to everyone’s advice. So just listen to it, take it in, and then make an informed decision about which way to go and how you want to do it. And that’s been very, extremely rewarding for me to go on this journey about learning how to run a business. What are the different aspects? What does good look like for customer success? What does good look like for marketing or for outbounding? And it’s been a privilege really working with really talented people in those areas and learning what those areas are all about. 

Brett
And final question for you before we wrap, let’s zoom out three to five years into the future. What is that vision? What are you hoping to build over the next three to five years? 

Stephen de Vries
So we’re building a company that essentially helps engineers understand their architecture. And we believe that software architecture and cloud architectures, essentially, when I’m talking about architecture, I’m saying how things are connected to each other and what kind of data is flowing, where that problem space is going to become more and more important over the next few years as things like low code, no code, even aigenerated code, become more prevalent, the act of writing little bits of code, little units of computation, microservices, functions, all of those things are going to become commoditized. What’s going to become less commoditized and where the interesting problem space is, how do I connect all that stuff? And when I connect it, what are the security issues with connecting it that way? 

Stephen de Vries
So where we are going to be in three to five years is to be able to automatically analyze a lot of architecture, regardless of how you’ve deployed it. So consume a Kubernetes file, or just consume your cloud environment and automatically identify what are the architectural risks that you’ve introduced with this particular design and give you that information up front. So I think we’re looking at least 85% growth again this year in terms of the company, 2024. I don’t see any reason we’d slow down. The market is just now beginning to pick up with these tailwinds of the regulation. So I think this is the right time to be in the software security industry. 

Brett
Amazing. I love it. Love the vision and love everything that you’re building. All right, we are up on time, so we’ll have to wrap here, if any founders listening in. They want to follow along with your journey as you build and execute on this vision. Where should they go? 

Stephen de Vries
So if they want to follow me, they can catch me on LinkedIn. I’m Stephen Devries, and if they want to try out our free version of IriusRisk, it’s available on our website. If you don’t know how to spell that, try googling it. Google will correct your spelling. If you just Google IriusRisk threat modeling, you’ll probably find us there. Amazing. 

Brett
Steven, thank you so much for taking the time, especially at 08:00 p.m. On a Friday night. I really appreciate it and really enjoyed our conversation. This was a blast. Really appreciate it. 

Stephen de Vries
Likewise. Thanks so much for having me, Brett. 

Brett
All right, keep in touch. This episode of Category Visionaries is brought to you by Front Lines Media, Silicon Valley’s leading podcast production studio. If you’re a B2B Founder looking for help launching and growing your own podcast, visit frontlines.io podcast. And for the latest episode, search for Category Visionaries on your podcast platform of choice. Thanks for listening, and we’ll catch you the next episode.