Vivian Dufour - co-founder of Meterian - enterprise sales for startups

Well, it's gonna be in the classrooms and teachers and students. That's that's a pretty, you know, it can be a pretty tense situation that there's like a cyber attack or somebody takes over the session in the app. So I said, could we do a, you know, check on this security of the application? And the immediate response from management was, oh, no, no, no. Don't worry about that.

Just go viral first thing. We'll figure out security later. And I said, well, the reputational risk is really too high because of it. You figure out later, it's kinda too late. So I did ask my CTO on the team, which is Bruno at the time, to do, they say, a quick and dirty check.

And I said, yeah, you know, take half a day or a day what you need so you get that summary. And then in less than an hour, he came back to me and said, oh, go check your your account. And he had actually found a backdoor to open source vulnerability. And they say compromise my account and, you know, had the messages like, you've been hacked, moved around some image content that I had, I had that, you know, curated in my in my account. And it just showed me how how easy it is to do.

And I knew there were these cross site scripting vulnerabilities, SQL injection, but I I didn't realize that, okay, if you know what effect is, then it is really that easy. It's just minutes. So that opened my eyes. And when the opportunity came up to, you know, help him out with the business, then I jumped on it. So now we're like, you know, several years later and we has we have a successful business at Traction, and we're almost self sustainable.

So it it led me to a lot of doubts in, the trust of all these large corporations that are holding our data. And then in the news, many companies, you know, McAfee, LinkedIn, Yahoo. So I said, this is this is my kids. Like, we we've built a great service in terms of putting all information online, making it convenient to transact. And we, you know, we really changed the industry to to have people try new ways of doing things to be more productive.

But at a at a cost of risk that I think now it's becoming too high. So when this opportunity left, I felt I felt quite mission oriented, and it was something that I can really get behind. I use my skills to contribute to, to the solution rather than just sit as a innocent bystander.

But we differentiate because we provide a comprehensive risk visibility specifically on open source to NMCs. We also have very good, automation. It's very smart and intelligently sense that we, remove duplicates. We, minimize the amount of noise so that developers are not overwhelmed with false positives. So these are definitely verified open source vulnerabilities that have been embedded in the fields.

Of course, developers themselves have to check, if if it is applicable to their own application depending on how the logic of their application is is used. Because many of these dependencies, I hate you as familiar with is that they have, they're all nested. So they, they include other dependent open source components. So therefore, you have to also analyze the the transitive dependencies. We make it very easy to use so developers don't have to have, extensive security knowledge.

They just need to, be synodly with, you know, updating packages and applying patches to your code. And I think the trickier part for developers is they often have to do a lot of heavy lifting and integrating tools, within their work environment. Right? It's, how does it work with the code management system? How does it work with the the CICD pipeline?

And how does it sit in with our other test scripts? How we basically do DevOps internally? So those are the few areas that I would say in terms of usability and our richness of information and precision that we differ from our competitors. But above all, our customers love our amazing customer support, because we have engineers working on it who are very familiar with the product, very familiar with the problem space. And also understand the the pains and, you know, the joys of actually solving those pains for for the developers.

And then the fine usually, many of these accelerated programs also have a, a final showcase or demo day, and they try to fill up the audience with a lot of prospective investors as well as, customers. So it was through these kind of intros that I would just ask, you know, they would be interested in exploring our product to improve their security or knowing that, of course, they have a product in place looking at at this particular area. What I just suggest is why don't why don't you try a side by side test so that you can get some extra assurance and independent evaluator. And then if it if it works, then you can consider that if you want to replace your existing solution. Alternatively, it's, you know, the way for them is more assurance that they know that product that they have in place is good.

And then for us as the the vendor, we get customer feedback. Right? If it's not good enough, then what do we need to improve so that we can be, we can take that product market fit?

So half an hour, we demo. And then the rest of the hour, they can play with the tool and you you do much feedback.

For Azure DevOps, it's a bit more complicated. It will it will sometimes it's very easy. We have managed to to do that in in, yeah, 30 minute demo call with their, you know, their lead tech or or DevOps person. But sometimes it's more complicated simply because the way it's set up by the the customer, how they use it is is more complicated. Like, it's not straightforward.

So we need to sit with them, or, like, I need to have we need to sit with them and work through that. But, overall, the feedback isn't it's extremely easy to use. So we've even it's very rare that I see a developer smile. I don't know about you, but, I've seen developer or, any DevOps folks smiles. Oh, it's so easy. I wish our internal tools were.

Like, we don't want them just to install it, run it, and then be as what they call shopware. We really wanna make sure that they understand the reports. So, for example, like, their code users, especially developers, they're not familiar with the output that comes out. It's very hard to understand. It's very hard to act upon.

Yeah. You you have 40 pays and ports. And then if you're lucky and you you you resolve the one that makes 20 pages disappear, that kind of experience. But, we walk them through the report. This is the format.

And, you know, here it just shows this is how you can remediate this particular vulnerability. So it's just a one step auto remediation, or they can automate that. And, yeah, just giving them the tools and the confidence to be able to use it, and share the information within the tune. So it could be project manager or quality assurance team, could be legal counsel, getting a software billing materials or a list of all the licenses that are being used to make sure that, the open source licenses are are being followed, per the license terms. So there's a lot to to cover, but, you know, we have it down as a checklist.

And then making sure that they are happy and comfortable with moving to the next step. So we try to make sure that customers would, yes. So we we lay out upfront. This is what we're gonna do in the in the trial, and you wanna make sure that you're happy with these steps that works with your code management system. It works with the continuous integration system.

You understand the reports, and you see value in it. And you you discuss with your colleagues, that everyone understands how to how to use it. So we get upfront agreements that they are happy with that, exceptions criteria. And then at the end, we review back and say, okay, this is what we've done. We achieved this.

This is this. If and what they run into the problem, of course, we note it as a, you know, a bug or an issue to look into on how we can resolve. Sometimes, it is a bug on our side. Sometimes, it's a configuration or network issue that we run into that's actually on the customer side. So we just follow-up with that and then continue the next day.

We try to we try to close that as quickly as possible within the week so that you can move forward to the next step. And the next step would be, okay, you've seen you've seen the the product replay on your own projects. You've downloaded it on, open source projects that you can see, for the different languages. So, usually, after they accrue the net or one language, they don't really need to see it for another language unless there's a a unique, case that they they find that, you know, other competitors don't cover that. Yeah.

Pearl for a particular package type of C plus plus for a particular package type. And then usually, at that point, they would ask for the quotes. And then we review it and we encourage them to decide. So if they decide quickly, you know, there's a more advantageous price sometimes. Otherwise, if they commit for a longer period, we'll also give discounting on longer term contracts.

He he had built sales team from the ground up. He, you know, he was a salesperson from the ground up himself, so self taught and also, you know, picked up a lot of tools of the trade and learn from the states. So he could help us select. And so he helped. So I drafted a job description.

He, you know, he also embellished it, and then he got to a final version. We posted it on LinkedIn and the different job boards, that all these startups use. And then I started collecting CVs that I shortlist. I said, okay. I picked the CV, you said. That I think you should the candidates that we should we should interview based on the CV. And and then he said, yeah. I well, we'll see when we have the the person who said, book the first interview. I made my little scorecard of,

These professions, if you call the candidate, they call you back or they email. And then what you see on the the CV is, you know, it's most of the time, it's mostly there. You know, maybe there are always some candidates that that don't that are that's, fucked about the CV. But in the case of this interviewing these, sales development reps, many of the CVs were like, oh, wow. It's so great.

And then when we get on the call, it's like, oh, it's such a different impression. And I think it's because of the proliferation of digital CDs online with the search engines. So it's very easy to to copy paste and create these excellent CDs. So to to weed them out, you yes. You have to meet them at least online and then in person.

Yeah. So that's that's why, like, in email campaign, and so you have to write, engaging copy to grab the attention in the subject line. Right? They they say how many characters, the 2 verbals, and then you have to use the light words to get people's attention. So it applies also in in cold calling.

So just back to the traits of this salesperson, I would say, yeah, how they present themselves. So even audio wise, the voice has to be clear. You know, if somebody mumbles, they're not gonna understand what they say. The volume has to be good. Probably has to be interesting interesting voice to listen to.

And, you know, there's a that's a subjective call. So for some people, you know, for some people, maybe they prefer my voice over your voice and vice versa. So that's that's another reason why it's good to have a diverse team. Right? You

And then I I think you I think good salespeople have a genuine desire to help the customer. To help the person on the other line, to understand the challenges they have and how they can help them remove the pain from their day to day job. Right? So just give you an example. I spoke to, CISO and head of engineer. So head of software engineering. Yeah. Software EA. And they they said, oh, wow. I'm I mean, so many meetings all the time.

And I said, well, what what kind of need? So like security review meetings, you know, looking at pen test results and then deciding what we do next and how we derisk. I said, okay. Well, I mean, we're not in pen testing, but we identify risks that your developers could catch early on as they're developing the code. So it will reduce the amount of maintenance that you would need because we have fewer issues popping up further downstream.

So that's part of the whole shift left movement that all the developers who are aware of security know about. So we we leveraged that value that we could bring. And then we also you're already saying that, you know, you're really excellent in what we do. We have excellent coverage. We had excellent, you know, deliver excellence in terms of ease of use so that the developers feel the least friction possible.

And then we yeah. That was proven when when they had to do the integration test. And we just we said, here are the instructions. We we did do a demo on a, you know, in a call half hour and we and it's okay here. Now you go try it on your own, and then we'll have a meeting. And you say, okay, we we're not we're busy this week. We'll have a meeting in 2 weeks. And then in that call, it was like 10 minutes. They said, yeah. We verified.

Actually, we use all three methods, and all three works smoothly. And then we had nothing else to discuss on the call. So he said, okay. Can you please let your you know, the manager could, sorry. There's a bird on the roof.

Sorry. There's a little skylight, so it made some noise. But the, yeah. So they they, their project manager another project, the sponsor was not able to attend the meeting. So I was saying, well, please let your sponsor know that everything is, you know, passive flying colors, free light all the way so that we can progress to, to complete the purchase. And and that would yeah. Very smoothly.

So definitely in the early days is with Bruno since he always been also doubling up on presales. And then, they can ask all the questions, like, always, you know, sometimes in cybersecurity, there's so many different products. Right? So they might say, oh, well, this tool does vulnerability management. How how are we different? You know, like a Tenable or, Coverity or some of these other tools that also do vulnerability scanning, but they cover a different area.

You just have to understand the problem and the pain and understand, you know, what the customer wants resolved. Like, do they have do they have this problem of pain? When when would they like it resolved by? Like, do they have budget to actually spend money on a tool to use all that? Do they care?

So we're loved by both, startups and enterprises. So if you'd like to raise that level of excellence for your own projects, in the organizations that you work in, then definitely check us out. For open source projects, we offer a free, free plan because we're helping the open source community Or of course, closed source projects. We are commercial tool and we do have paid plans. You have one free project allowed for a free scan and analysis, and you can have a quick chat on what other value we can bring to to you and and your organization.

So we'd love to help and just, yeah, reach out.