How Cyvatar Went From 0 to 1000+ Cybersecurity Freemium Users

how many of you have a full cyber security stack in place or anything I see one has it but most of you kind at some things here and there well we're going to talk about cyber security and growth and what that looks like over the next next 20 minutes um real quick just a few notes about me I've been in the cyber security industry for uh 29 years now so I've done it a very long time done some of the largest cyber security incidents pin testing you

name it I've done it so I decided to build a company and grow in Scala to solve the problem for small to mediumsized businesses that don't have proper cyber security in place so the first thing we did um in this premium model that we built for startups small medium siiz businesses is we built a a a model for premium to get customers in and start providing value for them then secondly once we built that we're like how can we scale this what we need to do to SC scale this and

get SBS to do something around cyber security because if you're a small business and a startup last thing you want to do is spend more money on cyber security which you may or may not need well we're going to talk about how we how you need it and how we can help you grow your business and then lastly turning those premium customers into paying uh customers so we launched premium about halfway through 20123 and we started seeing quite a bit of growth and you see

the increase in 2024 and based upon that we estimated where we think we will land in 2025 based upon premium so the first thing we did is we had to analyze the SNB Market figure out um startups snbs what makes them buy cyber security and I'm I'm curious for you guys in the room what why would you buy cyber security what would make you spend money on Cyber anybody want to jump in

win deals to win bigger deals exactly um speaking of social media I did a post about 3 months ago on LinkedIn and all our social channels and I said the number one reason that small mediumsized businesses buy cyber security is not because they're concerned about getting hacked it is because they want to grow their business and so when I first started this business I was like it'd be amazing if we built this this solution for small mediumsized businesses to get Enterprise grade tools you don't have to worry about ransomware attacks and we

make it all in a simple subscription well that didn't act that did really well in the hot economy and then after 2021 changed and then 2022 kicked in halfway through the year snbs and startups stopped buying but they still needed to grow so we pivoted and added a lot more fire to premium that was one of the drivers around it the other piece when you talk about you know a premium model if any of you guys are thinking about building this you have to build what we call Value based features

meaning once we analyze the market we figured out okay what's going to actually provide value to to them for free they'll make them stay on the platform see value and not not have to spend any money so we figured out that most of these small mediumsized companies they they have they spend money on external scans external risk exposure and I'm going to show you what that is in a second most of you don't even know that those things those scams are being done against you literally every single day by companies that want partner with you it made it simple no

credit card 30 second sign up um so last piece is providing real value how do we save money and help them make money by having cyber security so we're going to talk about what that looks like before we get too deep into uh the premium I want to just give you guys some stats and some perspective uh just starting at the top 27% of small businesses have no security protections and at all okay and they accept your credit card so when you're handing your credit card just assume your credit card

is compromised and your personal information is is also compromised uh my information is on the dark web and I'm sure everybody in this rooms information there from all these breaches so that's number one number two when you think about in in 2020 alone there were 700,000 breaches and about 2.8 billion in in losses and most of those against small mediumsized businesses primarily because they have nothing in place they don't have a security program so they're an easy easy Target and when you think about ransomware as see everybody in the

room knows what ransomware is okay does anybody know what the business email compromise is okay so let's talk about ransomware really quickly so if 51% are paying the ransom but if you're a small business and this is a challenging economy here's the deal hackers because i' I've done hundreds of ransomware incidents what they do is they you pay it once they note that you have paid it and within 9 to 12 months they're coming

back but with the original breach ransomware is not them you click on the link and your system got encrypted it was like that 10 or 15 years ago what happens today they're actually hacking into your your computers hacking into your company and once they get into your company they're putting in back doors then on top of that I'll give you this is real world example I did a breach in in uh Los Angeles about three four years ago and the ransom for a five person company was

$50,000 that's really high for a very small company so as soon as we went in and started the investigation I told them they already know that you have $50,000 that's why they set the ransom that much so we've seen cases where they set the ransom to the amount that you have in your bank account they've set the ransom to how much your insurance is so they will go through and find out what their insurance is if your insurance is $500,000 The Ransom may come into that around that range so that's what hackers

are doing they want to make sure they got paid so we paid the ransom for them got their systems back up did forensics on their systems then we realize that hey they hacked in two weeks ago you didn't have multiactor on this one particular syst system and got compromised so they knew what you had so that's how ransomware works and then moving on to the 37% of companies they hit by ransomware have fewer than 100 employees why you think that is small mediumsized businesses don't have good cyber Security Programs so if I'm a

hacker and I I can hike in and see that they have $50,000 and they have no employees that even know what cyber security is then easy target why would I hack into a big company or a big security team when I can hack into a small business that has nothing and so when you think about employees with um small mediumsized businesses experience 350% social media um social engineering attacks sorry um what's happening there what is happening there

with these these small to mediumsized business business email compromises so let's break down really quickly what is happening in the business email compromise and how easy it is to stop these attacks so number one you get the fishing email coming in okay but if if you have a fishing um control in place to stop those fishing coming in then you can stop it right there now nothing is 100% the hackers have ai and grammarly and everything so they look really good nowadays it's no longer African prince emails the next step is once they hits

your inbox so one clicks on it now a few things can happen one it could download Mau onto that system if you have the right antivirus Next Generation antivirus it will stop that ransomware from executing or mware from executing or a back door from executing or you click on the link and it takes you to a malicious page that looks like your email login page okay and anybody can copy any page that's on the internet make it look just like your page when it goes to that page then you put in your credentials and they steal your

credentials and pass your authentication off to Microsoft or Google or whatever you're using and you don't know the difference but they just thr your credentials now that your account's taken over well what if when you click on that link you're not allowed to go to that fake blacklisted page um there's tools that we use for our customers make sure you click on that link and it's like uhuh this website just just got started a week ago that's a blacklisted site we know what these bad sites are so you never get to put your credentials in the last piece is multiactor

authentication if you're not using multiactor authentication in your company if you're not using it for your personal please please do that today because your passwords are compromised so you look at all these breaches you know the AT&T breach and all these all your passwords are compromise if they're not compromised they can be cracked really really quickly so passwords are dead you have to have multiactor so um that's how business email compromise happen but in a small

mediumsized business it's really easy to fix if you have the right tools and the right configuration but this is not common knowledge to a CEO of a small business and you end up getting breached by those those compromises um lastly just to round it off 75% of smbs could not continue operating if they were hit with the ransomware I have seen this there's a stat out there uh that that that really says almost half to 60% of these companies within a year they're out of business because the hackers

again hacking in looking at how much money you have making the ransom there and it's not just ransoming your company there's a thing called double extortion ransomware so the government is starting to stop companies from paying the ransom so what the hackers are doing is they go in and they steal your customer data and then they say hey either you pay us this amount or we're going to expose this to your customers because we looking at your email we know who your customers are so that leads these small to mediumsized businesses and startups

would go out of business then lastly about 17% have uh uh cyber Insurance the trick with cyber insurance is if you don't have the proper Protections in place and then you get hacked you you you look back at the underwriting form it says did you have multiactor were you patching do you have Ino protection anti virus if you didn't have those they're not going to pay the ransom they're not going to pay your your claim so you have to have those things in place so what do we do in premium value

based features driving adoption so the first thing is cyber security policies um external scans risk exposure scans and free assessments let me break some of these things down these are things that companies small medium siiz businesses are paying for but they shouldn't imagine you take your car to the dealer and and you say hey I know need to braak job in a tuneup and they charge you 5,000 bucks but they don't actually fix anything they just tell you the problems that you have okay so what

we've done with our premium we don't charge you to tell you you have an issue that's free okay that's what we built in a premium tell you what your problems are and then when you're ready to fix them then we will okay and if you look at the top the risk exposure um scans is anybody familiar with um risk exposure scans know what that is like security scorecard RIS Recon those tools so here's what's happening on the back end the fortune 2000 companies you want to

partner with they are out there running these scans against you it's free they don't have to tell you they're running these scans they run these scans against you and if you have an F we had had a company at our premium they signed up and they had a 1.2 grade and the person called me up it was like the director of operations what does this mean I was like well that means that anybody that runs a scan against your organization they're going to see that and if your competitor has an a guess who's most likely getting that deal okay this

happens every single day it's called third-party risk management so if you're getting security questionnaires that you have to fill out they're doing a questionnaire and they're running these type of scans but it's like your credit report you don't get access to it unless you actually pay well with our premium you get access and at the bottom there that's an example of a risk assessment so risk assessments um you can fill this out yourself we made it super simple figure out what your gaps are and then you don't have to pay somebody to do a

risk assessment because frankly most of you have very little in place why would you pay somebody to tell you hey you have all these gaps you know you have all these gaps don't pay anybody to tell you that so we just walked through providing real value for free all these individual components and what I didn't say was the external scans so we do external scans so you can see what your external footprint looks like we had a customer that uh you know sign up about a month ago they had 206 external vulnerabilities they had no idea they

had those vulnerabilities but 206 of them and these hackers are scanning you every single day if you look at your logs is is someone that's scanning you every single second so there's always someone looking at what your security looks like so as we were building the premium model we kept talking to our customers understanding why did you buy oh I needed somewhere to grow I needed I need to fill our security questionnaire I need to be compliant I needed cyber insurance and you can't get those things unless you put proper security controls

in place so we kept adding features and functionality and and now in our category of 968 companies on G2 we're ranked number one because we actually solve a problem before you even become a customer so again how did we scale a few things that we had to do strategic alliances we talked about partner with MasterCard integrating risk Recon partner with other technology companies and getting their technology the free scans built in instead of of us spending money on marketing and and trying to

sell you from a marketing perspective let us provide Value First in our Frum that that's what's Driven us up to you we get depending on the week and it's around five to 10 signups per week in our premium and that's how we keep on growing and scaling and so the other piece in the middle we talk about effective digital marketing techniques social media campaigns the challenge with small to mediumsized businesses is you have to educate this Market most of them don't know that you can easily and affordably

stop a business email compromise or R somewhere or get insurance all these things are really really affordable if it's done properly very similar to the Elon mus video right you think about how do you solve this problem what Elon mus did was first principal thinking to build Rockets we did first principal thinking to build our fremium the last one over here is building trust through educational content um I do a ton of videos there's a new blog post every single week a new

video to educate this Market because once people realize how easy it is to to actually stop some of these cyber attacks get insurance and be compliant answering security questionnaires and ultimately grow your business they're like I'm in they start making moves so again this is Mastercard risk Recon uh again you don't get access to this unless you're paying money you don't know what your risk score is it's like your credit score but the risk exposure

for your company our other partner is um s insurance and so s Insurance in the bottom right there you become a catar customer you're immediately covered for up to 500,000 of a warranty program okay because some people may not be asking you for a cyber security insurance policy but if you get breached you're covered immediately up to $100,000 for ransomware for compliance requirements just by being a customer of ours because

again we're putting the right controls in place it's like going back to a car and techology like you go and buy a new car and it doesn't have airbags it doesn't have seat belts it doesn't have antiock brakes and you take it to get insurance you're like wait a second this didn't have any the preventative security controls well same thing in in cyber security if you don't have multiactor if you're not applying patches don't have antivirus security rareness training all these basic things why would they give you insurance and if they do give you insurance is going to

be about 30 to 50% more than what we're offering to our partner because we get you locked down and secure no questionnaires just cuz you're a sar customer you get that value so that is built into the value prop of what we bring to the market and again I mean I could talk about you know the digital marketing tactics and and what we've did but again we have to educate this Market you have to understand how you get value out of these Solutions and that it actually exists most people one of my biggest complaints from existing

customers is like Cory I spent money on cyber security one of my my buddies I live in Los Angeles he said I spent $10,000 on security policies and it's free with you why didn't you tell me like I did I sent you emails and all that and he finally got it but he was pissed that he spent that money same thing with risk assessments and GAP analysis please don't spend money on those things especially if you're small you know use the premium that we have for our customers again educating our Market we have blogs coming out every

single week you got to do that and keep driving people to to understand the the solutions that we offer to them the other piece to it is and I I love the previous speaker because he talked about hitting the right Market if we would go and do this to Chief information security officers they already know this and they work for large companies so we target small to mediumsized businesses the CEOs the CFOs many of our customers are CFOs we just did a call with one of our customers this morning and and

they're an investment company and the CFO was running their crowd strike it's like I have no idea what I'm doing but I'm running the crowd strike they were spending about $30,000 and they got eight solutions from us for 26 so they got full solutions from us as opposed to a crow strike but again that market education was critical and so how do we turn these premium customers into paying customers first we monitor your vulnerabilities and we've automated this in our platform

so if you get a scan you get an email that says hey your scan results have been completed and if we see that you have like 200 vulnerabilities I'm going to send you a note hey you have 200 external vulnerabilities you may want to look at this just educating not asking to buy just say hey you want you want to check these things out um and then with the risk exposure scans those are again another way we educate our Market we're like hey your DNS is set up improperly someone can spoof your domain and send

um emails to you uh your your customers and that's a easy way that if you anybody's ever had a business email compromise you look at the Domain it's like the right domain you call up that company and like what's going on it's because they didn't have the DNS setup and those are easy scans you get with us again AB testing to figure out what you want to hear what works and what doesn't work interesting point we thought when you had good grades in our scans you want to know about it nobody cared they're like hey why you tell them this but when you have bad grades in our

scans they want to know that so we we learned that the second piece is how do we create value through upselling premium features solve a business problem cyber security is not about how techy I am and and going into really deep Tech stuff if you're not solving a business problem for your customers you're wasting time and so our company is focused on how do we get smbs and startups to grow and cyber security is a growth

enabler um and over to the right we talked about the role of continuous engagements regular regular check-ins even on our premium customers understanding hey is we literally did a deal um a couple months ago and the guy been monitoring our social media he he signed up two years ago and he said I just logged back in you guys have added all these features and I see how bad our score is we need to do something right now and and that that deal you know just closed this morning but he was lurking

in the shadows for two years but we kept checking in and educating him on know where he was and what actually turned him to to buy was really interesting he was like part- time their it person so he was leaving the small company and he was going somewhere else and he he got on the call with their operations person it's not technical at all it's like we're going to be screwed after I leave you guys need to come in and help so he he was always there but it just took time for him to be ready so in conclusion what you think about

maximizing user conversion and long-term engagement we don't think of this as hey you sign up for freemum you buy tomorrow because what the example I just gave is that when companies are ready we have customers that are one employee and our largest has 2,000 employees okay but most in that range don't have a chief information security officer most in that range don't have any proper it people but they're still being attacked

by the same level of attacks that that the large companies are getting so they need that same level of security so you guys think about it like this hackers aren't saying oh you're a 20 person startup we're going to take it easy on you they don't do that they're going full board the same thing to hit MGM in Vegas same tactics they're going to hit you so if you're using no Talent around cyber security and the cheaper tools that your MSP or it person is using you

will be compromised because the hackers are using Advanced tools they're using Ai and you have nothing in place so we bridge that gap for our customers and focus on becoming that all in one sober but we start with the premium provide value help them first so over the last 20 minutes we talked about the market need and hopefully you guys saw all those crazy stats of how bad it is if you think as ANB you're not a Target I mean you you effectively

horrible analogy but you're the old lady walking around down the street with a purse just dangling like easy easy Target and that's why hackers have really changed to Target small medum siiz businesses um if you're implementing a freemium solution provide value provide as much value as you possibly can without breaking your bank but all these things that we do for our customers these are commoditized like 20 years ago I used to say hey we're going to do your pen test but I started thinking wait a second we do the pinest and about every single day about a 100

new vulnerabilities come out and if we pentest you yesterday 100 new vulnerabilities come out today and a good portion of them apply to you that pentest is obsolete you just wasted your money so we made made pin testing for you within our platform um and then the other piece is make sure you partner with large companies that want to solve solve an ecosystem problem like we partnered with MasterCard they have 4 million SMB card holders that need cyber security and so those ecosystems will help accelerate growth and accelerate

your premium and they added the free risk Recons to our platform so so then um building trust through education keep educating the market keep explaining what business email compromise looks like what these hacks look like and then lastly turn your freemum customers into paying customers by solving the whole problem one of the biggest challenges Within cyber security is small to mediumsized business they're like oh I bought a scanner but you don't have a patching system and you don't have the technology cyber security is people

process and Technology you need all that in one that's why we built that into a reoccurring subscription and lastly enable business growth be a growth enable enabler this is a challenging economy if you're just charging money and making companies pay you but not getting value and not growing them then they're going to turn even eventually so that's me thank you so much um if you do want to sign up and be

the 101 and fremium there's your QR code I'll be around today and tomorrow happy to talk more about cyber security and secur in your company thank you