Picking the right battles

I shook my head reading about the recent disqualification of 4 badminton teams from the Olympics.  Unless there was a rule forbidding teams from throwing games, the disqualification is misguided.  In building products, we often pick strategies that offer differentiation on high value features while ceding ground on less-profitable features.  In my current gig, we prioritized adding more mobile friendly authentication methods over some missing features to support the desktops.  This means that we lose a few deals that require desktop support, but even if we had this feature, it wouldn't command premium pricing.  Contrast this with the newer mobile features that is helping us sell at a much higher price point because our competition do not have some capabilities.  This is a choice that we picked and would pick again if we have to.

Why should sportsmen (or women) not be afforded the freedom to choose the matches they want to win?  Is using the brain to get closer to the gold medal such a bad thing?  

Never thump a gift melon

On my way to work, I was listening to an interview on the radio.  The host asked the guest on the program why she claimed that none of the congressmen had read a bill that was being considered.  She gave a long reply for a full 3 minutes in which she provided various statistics to explain why the bill was not in the best interests of the community.  A great tactic to highlight her concerns, but a wee bit disingenuous.  I was glad when the host gently reminded her that she had not answered his question and forced her to explain why she made that claim earlier.

I see this pattern repeated in mock interviews I conduct for MBA candidates - those who are trying for admissions or internships.  A lot of times, the candidates are more interested in highlighting why they are such a great fit that they forget to answer all aspects of the question.  I am not suggesting that MBA candidates are bad listeners, but just that I would expect this group to pay more thought into how they answer questions in an interview.  When the supposedly well trained groups (like MBA candidates) themselves exhibit this behavior, it is no wonder that the rest of the society is tone deaf as well.

While on this topic, one of my favorite sales quotes is "never thump a gift melon".  Turns out you can check if a melon is ripe by thumping it and listening for a hollow sound.  But, thumping the melon can also hurt the melon (like bananas with dark spots on the skin).  Translated, the quote means that if you have verbal commitment on a sales deal, do not try to keep selling, for you might divulge information that could jeopardize its closure.  To do this well, the sales person should "listen" to the customer and know when their selection is final.  That would be a good time to navigate the conversation to the contracts/procurement process.

On the Product Management side, we are often coached that everyone has "two ears, but just one mouth".  Fairly straightforward idea that emphasizes the importance of listening well.  This is easier said than done and requires a lot of practice.  But, one incident from my early days in Product Management helped me a lot.  I was visiting a customer with my manager.  When the discussion veered around to problems that this customer still faced, I could not resist responding to each item on the list with details about how we planned to fix the issues in the next release.  Later, my manager suggested that it might be better to just let the customer vent about all problems and go back with a roadmap update later.  This approach involves fewer interruptions (so that we can get all the details about problems), does not make us appear over defensive and gives us the opportunity to have another contact with the customer (which can be key to building a relationship)

Tracking Market Statistics

As an entrepreneur and product manager, I am always on the look out for new opportunities.  One of the first things I am trained to do is to Can I expand into an adjacent market by adding a new feature?  What is the size of market for a completely new product which I can bring to market with existing technology?  Good market data is hard to find.  Sometimes, our companies have access to analyst resources like IDC, Gartner, Forrester, etc.  However, I have found a lot of great information pop-up in newspapers and other popular media outlets.  I keep track of some of the key statistics in a spreadsheet.  Here are some entries from my market data spreadsheet -

• Number of vehicles sold in 2010 = 12M
• WW PC sales (2011 estimate by Gartner) - 364M 
• WW PC sales (2012 estimate by Gartner) - 368M

Collecting this kind of information has helped me develop an instinct and enough data points to quickly size different opportunities.  What would be really terrific is if the marketing firms that keep track of such data democratize this information.  In other words, instead of charging $1,995/report, expose the high level data for free.  This would hook users like me and if I need more data, I wouldn't mind paying $20 for every additional piece of information.  Something like this (numbers are made up) -

 

Roomba - Product that I love

A friend asked me recently to think about some products that I would love to manage.  Roomba was the first thing I could think of.  I acquired my first Roomba almost a year ago and liked it so much that I bought another one as a gift for my parents.  The Roomba is a great product because it solves a very common problem  in an unconventional, but effective way.

As the parent of a toddler (think spills and dirt), I love switching on my Roomba when stepping out of the house and coming back to a clean room.  What a time saver!  Some features that I would introduce in the Roomba (or other products in the portfolio) would be -

1. Ability to clean stairs
2. Make it less noisy
3. Ability to mow my lawn 
4. Ability to remove dust from furniture (a la swiffer)
5. Ability to clear cobwebs

McAfee - Strategic value or Botched Acquisition?

McAfee was one of the absolute best companies that I have worked for in my short career. From 2006 through 2011 (just before its acquisition by Intel), McAfee nearly doubled its revenues at a healthy CAGR of 12.51% -

The only other large security company (500M+ in revenue) growing at a similar pace was Checkpoint

Intel acquired McAfee for $7.68B in 2011. As an insider, I was surprised that Intel never clearly articulated the rationale behind the acquisition. I also know that a number of senior execs left McAfee shortly after the acquisition was announced - Dave Dewalt, George Kurtz, Rosen Sharma, Dmitri Alperovitch to name just a few.

Looks like the exodus was a leading sign of a massive step backwards. Today, Intel announced its 2011 results with breakup of the Software and Services group which is the unit which includes McAfee and Wind River. Intel claims that it wrote down $204 in deferred revenue. The accounting period is also a little different (McAfee's fiscal year was aligned to the calendar year, Intel's FY is staggered by 3 months).

But, these adjustments should be more offset by the revenue from Intel's Wind River and other software operations. Wind River had revenues of $350M+ when it was acquired in 2009. In other words, McAfee's post acquisition performance has been disastrous. I'd guess that Checkpoint, Imperva, Palo Alto Networks, Splunk and even Symantec are the ones who have benefitted from Intel's acquisition of McAfee. Thoughts?

Identifying New Ideas for a Startup

One of the biggest challenges for an entrepreneur involves how to rate new ideas before you decide to chase it. There are different aspects that you can evaluate, but here is the fundamental list from Berkeley, especially for those interested in seeking VC money -

1. Unmet or Underserved need - we must start by critically analyzing whether the idea meets an unmet or underserved need. In other words, is there at least 1 customer whose hair is on fire when he hears about the idea from you?
2. Market size - Most successful entrepreneurs will tell you that chasing a large or growing market played a huge part in their success. Current thinking is that VCs are loathe to funding ideas which do not have a $1B potential.
   
3. Sustainable competitive advantage - do you have a secret sauce or technology that increases the barrier to entry or makes it extremely difficult for your competitors to battle you?
4. Scalable business model - can you build a scalable business around the idea. Are the fixed and variable costs such that you can increase and maintain high margins in steady state?
5. Why us? Why now? - do you have the right team with the experience, network or other necessary attributes to win with this idea? Is this the right time to go to market with this idea or will it take another 5 years for this idea to gain mainstream adoption.

At a minimum, you should be able to pass these five checks easily. Of course, it helps to examine the idea to gauge the attractiveness of the idea using personal metrics also. For instance, you may want to see how well aligned the idea is to your own interests, the cost of other opportunities you'll have to forgo, etc.

Corporate Blogs - the real audience

In the last 3-4 years, I have seen most software vendors starting their own corporate blog. I have seen first-hand how these corporate blogs help in lead-generation and sales. Most of us think that this requires a lot of thought-provoking, high quality content, but that is not necessarily true. This is because the true audience of the corporate blog is NOT the CIO or IT manager or admin who is looking to learn about new technologies. The real audience is actually the search engines and corporate blogs provide a great way to improve where one shows up in the search results.

One of my close friends, a great marketing person, gave these tips to get maximum mileage out of corporate blogging efforts -

• Create a shortlist - start by creating a list of keywords that you'd like to improve your search rankings on. At Solidcore, these keywords would normally include Change Control, File Integrity, Whitelisting, etc.
  
• Post Regularly and consistently - every blog post must target 2-3 of these keywords in a consistent manner. For best results, try to incorporate these keywords in your titles or tags. And be regular - it takes at least 3 posts a week for 6 months before your search rankings improve
• Link back - linking to other articles about the topic you are posting about also improves the search rankings. In fact, you should aim to link to at least 1 (preferably 2-3) other posts in every blog post

As you can see, this is fairly simple. If you don't find any good topics to blog about, just repeat the words in random order, a la "change control is solidcore and my file integrity oops what a neat way to cheat the search engines". I haven't seen too many instances of such obvious posts, but don't for a moment get beguiled into thinking that the corporate blog is aimed at you, the reader. It is not.

Tools for the Starving Entrepreneur

I found a couple of very interesting (and free) tools that I wish I had known about earlier -

1. SSL Explorer, an SSL based VPN solution. The company behind this product, 3SP, got acquired by Barracuda, but this product is still available from Sourceforge
2. VirtualBox virtualization products. This is a wonderful product and is available for most platforms, including Macs. Quite likely this will be discontinued after the Oracle acquisition of Sun is complete, so download it ASAP. As an aside, Oracle already has 2 virtualization products - their own xen-based one and one from their Virtual Iron acquisition.
   

Textbook Rentals

WSJ is reporting that Case Western will start experimenting with Amazon's Kindle for some of their classes this Fall. I hope this is a success and that we'll eventually see more electronic books going forward. If this happens, traditional book publishers will have to find better ways to remain profitable than resort to printing a new edition every year.

Profit margins of book publishers is a very well kept secret. Publishers invest between $1-2M for the first edition of a new book. If it is a success, they keep printing a new edition every year or two. Interestingly, most of the changes between editions are cosmetic - a few color changes, end of chapter problems rearranged, etc. Ever wondered why? Unless they do this, students will stop buying new books and prefer to buy used books from their seniors in school. Also, the cost of reprinting a successful book is less than $1/copy. Yes, that is right - the books that we typically buy for an average of $80-$120, actually cost about $1 to print. Clearly, it is in the publisher's best interests to suppress the used book market. The real cost, sadly, is borne by the environment.

But, despite the publisher's best efforts, the used book market continues to thrive. I recently heard about Chegg.com, a startup which offers textbook rentals and has a Netflix-style business model. They even allow you to highlight the rented books, so long as you don't make the books completely unusable for the next renter. I'm sure Amazon's Kindle will feature an electronic expiry of the books, using which publishers will be able to offer subscription and perpetual pricing. But, the real question is will the publishing industry survive? What if the authors published to Amazon's Kindle directly instead of using the service of a publisher? How would you stay relevant if you were the CEO of a publisher? I don't know, but would love to hear the thoughts of anyone in this industry

PCI Whitepaper

I wrote a paper on PCI compliance titled "The 5 claims of PCI DSS snake oil salesmen", which is now being run by ThreatPost. Enjoy!

NYTimes calls Tripwire a fall hazard

The venerable NY Times is reporting that the Tripwire used at home can be a fall hazard. However, Tripwire at home offers many advantages (health and emotional benefits) unlike the product used in the Enterprise which has often delivered severe emotional shocks to many customers.

Solidcore has ample evidence that Tripwire Enterprise customers have suffered from different types of shocks including, but not limited to, sticker-shock, pci-coverage-shock and bloatware-shock. Sticker shock hits the customers when they are presented the first quote after the initial demo. Tripwire has recently managed to alleviate the pain caused by this shock through deep discounting of prices.

PCI coverage shock is a recent phenomenon and affects customers who are looking for PCI compliance solutions. At the outset, this shock makes everyone think they were stupid to deploy anti-virus and run vulnerability scans and penetration testing as mandated in PCI DSS sections 5, 11.2 and 11.3. After all, they could have achieved the same using Tripwire had they thought about it at first. However, this shock dampens once the QSAs and other vendors point out that Tripwire's PCI coverage whitepaper is not worth the paper it is printed on.

Bloatware shock is experienced only by customers who have used Tripwire in the past. After-effects of this shock include incredulity and deep anger that Tripwire has not introduced any significant changes to their UI or feature set in the last 10+ years in business. The few features that were added, including Configuration Assessment capability, have made the product more complicated and difficult to use than ever before. Tripwire's marketing department claims that only a minority of customers will suffer from this shock as there are more people who have not used Tripwire than those who have.

These reports have been confirmed by analysts from top-tier firms like Gorretner and the 911 group. Tim Ikestotalk from Gorretner says "It is unrealistic for customers to expect that a product named Tripwire will not deliver shocks. The name itself was chosen to signify how administrators will be shocked whenever they perform tasks that are anything but the most standard and mundane ones". The 911 group adds "Tripwire has been extremely successful in pulling the wool over customers eyes when it comes to PCI coverage. We have been receiving many calls from customers who feel cheated by Tripwire, but we can understand Tripwire's behavior. In these hard economic times, it is indeed very difficult to sell a product that offers so little to so few for such a high cost". Clearly, as the NYTimes puts it "no one had looked at this. It was all anecdotal." Until now, that is.

Names of all characters in this article have been changed to protect them from receiving shocks

Cloud Computing

Having worked for a Grid computing startup has made me a big skeptic about whatever new marketing umbrella the idea gets resurrected under. As you probably guessed, its latest incarnation is called cloud computing.

Here's a witty video that tries to make the concept of cloud computing less cloudy. Hope you enjoy it.

Product Development Process

I chanced upon this document by Laurie in which she describes a typical product development process. We follow a very similar process, except that the MRD is seldom a formal document. Based on the analysis of market requirements from various sources as described here, we write the PRD. The UI mockups are done by our UI designer who works closely with the Product Managers to understand the workflows.

When there is a need to change the layout or the UI elements, our designer provides a static mockup. For workflows, we use Axure Pro, a wonderful wire-framing/prototyping product. Axure allows us to place UI elements, create links to other pages and design a prototype that is easy for our developers to play with and understand. There are two main advantages in using such a prototyping tool -

1. It forces us, the Product Managers, to think through the design a lot more. When only static mockups are provided, the development team has to many assumptions about various corner cases. Given the distance and timezone differences, it is not always possible to validate these assumptions. However, PMs have to address many of the corner cases when designing dynamic mockups and this reduces the gap between what PMs want and what development thinks PMs want. See here for details.
2. These mockups can be used to demo upcoming features to prospects and customers. Axure prototypes look very similar to the real software and helps us get advance feedback about workflows and features that we are planning for future releases.

I'm told dynamic prototypes can also be created using a Visio plugin. This could save you some $ for sure, but I found it a lot harder to use. Unless I am really cash-strapped, I'd consider the $539 for 5 Axure user licenses a big bargain.

100% protection against viruses and malware?

My wife's laptop recently got infected with malware, despite running an up to date version of a leading anti-virus and a spyware detector. Coincidentally, both these vendors have offices in the same street in which my wife works. Wish she could take the laptop over and tell them how badly their products suck. However, reality meant that I had to troubleshoot and fix the problem. After trying out a few other free anti-viruses and malware, none of which seemed to detect/fix the issue, I found Spyware doctor. A fantastic tool that found and fixed the problem - I ended up purchasing a 5-pack license for all our computers at home.

While on that topic, Solidcore's product was tested against nearly 16,000 viruses and malware by NSS labs. The results are available from our website here. We prevented 100% of these viruses, worms and malware. Needless to say, we were thrilled when we heard this and had celebrated in a big way. We are seeing a tremendous uptick in the demand for this product and there has never been as much excitement at Solidcore before.

Just in case you were wondering why I did not put our product on my wife's computer - I'd have done so had it not been her company issued laptop :)

Update on 10/14 - Shortly after I posted this entry, Secunia, an independent testing firm had released the results of their security tests. Symantec won, but Secunia claims in their blog entry that "Even the "high" score from Symantec was disappointing. Symantec detected a mere 64 out of 300 exploits, or less than one-fourth, leaving 236 exploits undetected!" and the report concludes alarmingly thus - "These results clearly show that the major security vendors do not focus on vulnerabilities. Instead, they have a much more traditional approach, which leaves their customers exposed to new malware exploiting vulnerabilities."

Product Lifecycle

I found this hilarious description of Product life-cycle recently - enjoy!

My First Webinar

Last week, Solidcore held a joint webinar with Trustwave (in which I presented). We had a very good attendance and the recording is available from -

http://w.on24.com/r.htm?e=112634&s=1&k=7F324EFE23D977C21A8DA677D816463D&partnerref=SCWEB

Email Volume?

So, how many emails do you receive daily? My email search engine reports that I have received approx. 24,000 emails and sent 4,200 mails in the last 6 months. This would work out to approx. 133 inbound emails and 23 outbound emails per day. If I just look at week days, the number is approx. 155 inbound and 27 outbound emails per working day. The first number is inflated because I am on multiple distribution lists.

We use SonicWall's Email Security product for spam filtering and it has a wonderful ROI calculator. You plug in a value for the cost of every spam email and it calculates the RoI of successful spam filtering. Not a spam killer, but a great way to justify your product to the Budget Owner. Here's the RoI we have achieved so far using this product -

Books on Product Management

I get asked a lot about good books on Product Management. Here's what I have read in the past 2 years or so since I moved into Product Management.

1. Crossing the Chasm
2. Inside the tornado
3. Built to last
4. Good to great
5. Innovator's dilemma
6. Innovator's solution
7. Selling the wheel, and
8. Blue Ocean strategy

I read it approximately in the order listed here and have been greatly impressed by items 5 and 7. #8 is a great read for anyone who is evaluating new ideas. Here's a good article describing how to apply the strategy canvas to evaluate new ideas ( http://blog.hubspot.com/blog/tabid/6307/bid/54/Blue-Ocean-Strategy-A-Small-Business-Case-Study.aspx). Rosen tells me that he has ah-ha moments everytime he reads these books.

Startup Capitalization

One of the greatest advantages of sitting right next to a CFO is that I get to interact with him frequently. Over the last year or so, I have learned quite a bit about Startup Financing, Cap Structure, Stock options, etc during these interactions. There are 3 very important things that an entrepreneur has to watch -

1. Total number of Authorized shares - this is the maximum number of shares that can be issued to investors as registered with the state of incorporation. Of course, companies have the option of increasing, splitting or reverse splitting the number of authorized shares relatively easily and often do so when they raise new rounds of funding.
2. Total number of Outstanding shares - this is the number of shares that are held by stockholders. The more common use, in high tech vernacular, is Fully-diluted outstanding shares which is the outstanding shares plus the shares reserved for issuance under stock option plans (grants + cancellations + remaining to be granted) plus the amount of shares to be converted under warrants and convertible debt. Essentially, the number of shares if every right to a share of stock as converted
3. Liquidity option on Preferred stock - shares held by employees and founders are typically Common stock. VCs get preferred stock which normally as a “liquidation” preference which means in the event of a liquidity event, they have to be repaid before Common stock is. The liquidity option determines the amount to be repaid for each preferred stock if a liquidity event occurs (acquisition, bankruptcy, etc). Common stock holders get paid only after all the preferred stocks have been repaid in full.

Let's take an example and walk through these numbers.

Lets say a friend and you decide to float a company, Acme Industries. You typically incorporate in Delaware (it has the friendliest corporate law) with a total of 100 Million Common (Authorized) Shares at a par value of $0.001.

Between the two of you, you decide to hold on to at least 60% of the Common shares to ensure that you have a controlling interest. This would amount to 30 Million shares each for a total cost of $30,000. Typically, this would create the basis for you to go add sweat equity for future work on the company You'll allocate a further 20% (20 Million shares) for future stock and option grants(key employees and future issuance). The remaining 20% can be used to attract outside investors with preferred shares convertible into common should you be fortunate enough to do an IPO (more on this later).

Once you have the prototype, you start pitching to VCs to raise enough capital. Lets say KPCB decides to advance a term sheet to buy 10 Million of Series A preferred stock at a “pre-money value of $30,000,000 or $0.50 per share. You would float 10 Million Preferred shares at par value of $1 for KPCB to bring the “post money valuation” to $40,000,000. At this point, the VC firm has a 9.1% stake in your company (10M shares/110 M).

Term sheets are normally loaded in favor of the investors, esp. when presented to a first time entrepreneur. Make sure you pay close attention to the liquidity option - this is a hidden cost of the capital that you will have to pay later on. Liquidity options vary between $1 and $2 depending on market conditions. I'm told $1 liquidity options are available these days, but during the difficult 2004-05 period, $1.25 was the most common option with some going as high as $1.75.

If all goes well, you would become cash flow positive with just a Series A funding and work towards your exit plan. Acquisitions are more common than IPOs, so if your company gets acquired for $20 million, you'd repay the investors $10 million (if you've a liquidity option of $1) and share remaining $10 M amongst the shareholders.

More often than not, companies require a Series B, C, D or more funding before they are able to exit. In such cases, companies are forced to increase the number of authorized shares (because total Common outstanding + total Preferred outstanding must never be greater than total authorized). This causes a dilution in the stake of common shareholders. Top executives often negotiate “dilution protection” so that they will receive the same % of options for one round following hire so their relative position stays the same. Thus a new CEO would be incentivized to raise money right away and not wait and try to protect their stake as a % of the total dilutable options, which means that they are given enough options to maintain their stake at a certain percentage. They also ask for the Cap table or cap structure so that they know how much their stake in the company is relative to other shareholders. This is rarely done for regular employees, but something to keep in mind as you grow in your career and look for opportunities.

Finally, the best advice for entrepreneurs is that they get themselves a very good attorney with lots of experience before they start raising funds to negotiate a good term sheet. Top attorneys can get things done effectively and quickly, however, they must also balance their VC connections since they are a great source of referrals and would hate to bite the hand that feeds them :)

AppXchange Application

Hello Everyone,
We have published our Product Management App in Salesforce.com's AppXchange platform. You can get it from here -
Product Management by Solidcore 1.0