January 7, 2020
Passing Enterprise Security Reviews
Lisa Hawke, VP of Security and Compliance for Everlaw, demystifies the enterprise security reviews and vendor risk assessment processes. She...
Thank you all for being here today. And thanks so much for missing the last Warriors game to hear about the minimum viable launch and everything you need to get going for your launch.
Before we dig into that, I'm going to just talk about myself for a little bit. Graduated from the University of Texas in Austin in 2002, it was right when the tech bubble had burst. There weren't a lot of jobs, so my first job was at a PR agency.
These were some of my first clients. My first client was actually Bluetooth wireless technology, back in the day when no one knew what Bluetooth was, and at the time they were actually competing to be a wireless standard against WiFi. It's kind of a weird thing, or at least that's what they wanted to do on the PR side.
From there I worked on HP on the server side. This was when Carly Fiorina was CEO and she got ousted while I was there, so there was a lot of crisis comms. Worked on some video game launches with PlayStation. And then there was this little festival called South by Southwest Interactive. In 2003 I started working with them and helped really grow them into what they are today.
And then I worked with some consortiums, the National Cyber Security Alliance and The Green Grid, which does data center energy efficiency. So from there, I decided, I worked there for seven years, at a PR agency called Porter Novelli, and at the time it was a really big PR agency.
But then I decided it was time to go in-house, so I went to work for a company called Rackspace. I helped launch their public cloud, worked on OpenStack a lot, you may or may not have heard of OpenStack. And that actually brought me out to San Francisco. And then once I was in San Francisco, I got the startup bug.
I went to Chartio, which is a YC cloud business intelligence company, and worked there for a year and a half. And then I got a call from someone I had met at Rackspace, Alex Polvi, who is the CEO of CoreOS. He had sold his first startup, Cloudkick, to Rackspace, and so we started talking and I got really excited about CoreOS's mission and how they wanted to secure the internet.
If you're not familiar with CoreOS, CoreOS is a lightly Linux operating system that gives automatic updates to servers. So when things like Heartbleed and Shellshock come along, CoreOS sends automatic updates. CoreOS was also the first lightweight operating system that supports containers, Docker containers, so when you wanted to use Docker containers you could go to CoreOS and try it out.
But along the way we realized that we wanted to help companies use containers and we built other components like etcd, rkt, fleet, flannel. Rkt is the Docker container competitor, I suppose. Anyways, I started working there.
Enough about me. We're going to talk about the art of the launch. Really fast, before we dig in, I like to define what a launch is.
In my mind, the launch is anything that fundamentally shifts the direction of your company. So, this could be a product announcement, this could be funding, this could be the launch of your company.
That's what I define as a launch. I also want to say that I don't think the launch is just about PR. PR is great, but you also need other components. And the more of a groundswell you can create, and more of conversation you can have, the better.
So I think it's a mix of PR, analysts relations, social media, content like blogs and newsletters, online ads, and then also getting your team really excited to talk about the launch as well. So, I call this synchronized storytelling because everyone's in sync.
So, to go through this, I'm actually going to take you through a launch that I recently did in April, the Tectonic launch. This was a big commercial launch for us. Was it successful? I think so. It's 40-plus unique articles, and that's just unique articles. We actually had a lot of reprints that also got picked up in Asia-Pacific, in Europe, and of course, across the United States and North America.
Thousand-plus unique tweets and thousands of private beta signups on day one. Our challenge was really, "We're launching a whole new site." CoreOS itself is an open source technology, and we wanted to keep Coreos.com as an open source site. We didn't want to have to sell to people through our open-source site. We wanted to do that through Tectonic and keep them separate.
We had a whole new website, we had a new social media presence, and we also had a new product that we wanted to drive people to sign up for. So how are we going to do all this? Our goal at launch was really to position ourselves, or Tectonic, as an enterprise product and drive signups for the private beta.
Step one: I think it's really important to set a goal for your launch and what you want to get. If you just are wanting to create awareness about your company, that's great. If you're wanting to actually drive signups, that's something different. You really have to think through that.
In the PR agency world, there's a couple of thoughts around that. A lot of times PR agencies will tell you that you should do your funding news separate than your product launch news. This is a little bit of a controversial subject.
But I actually believe if you're trying to drive people to sign up for your product, that it's sometimes a good idea to actually combine the two. Because reporters, and honestly the industry as a whole, really care about where that VC money is going. And so sometimes you can get a lot more bang for your buck by combining the two and creating a lot of noise through that funding to drive people to try your product.
Here I just want to show some of the articles we got through Tectonic. And here we got the message pull-through that we wanted to get the enterprise product across. We also, when you came to our website, we had a call to action for the signup for the beta, because that was what we wanted people to do. You can also see, in the last article, the TechCrunch one, that we tied it with our funding from Google Ventures.
Step two: timing your launch. I think timing your launch is very important.
A lot of times, again, this is a little bit of controversial subject as well, PR agencies will tell you that Tuesday, Wednesday, Thursday is the best time to launch your product. But I would argue that you really have to know your community.
I do think that is a good time, but you also have to realize all the big companies are also going Tuesday, Wednesday, Thursday, so really think about that and know your community. At CoreOS we've had great launches on Mondays and Fridays, so it just really depends.
But, on that point, of timing, you really need to get together with your team as a whole and decide when is the product ready or what is the product that's going to be ready. Is it a private beta? Is it a public beta? What do you want to get across from that?
What tradeshows are coming up? Is there a huge tradeshow coming up and you're going to launch your huge product on the first day? Are there big companies that are going to launch that? Is that in your favor? Maybe your product works with that big company.
Is Google announcing something or Apple announcing something? Reporters only have so much time, so it's important to really think through these things.
And also, industry news. Know your space, what are your competitors doing, really think through what they might potentially be launching as well.
Step three: develop the story. This is another controversial topic: press releases, and putting them on the wire or not. A lot of times nowadays, you don't have to put your press release on the wire. If you don't know what a news wire is, it is a distribution service for press releases. And it sends it out to a bunch of reporters. It puts it on search engines so it's easily searchable.
There's some people that say there's a lot of SEO value there. I think it just depends. But, no matter what, I actually think it's a really good framework for your team to come together and write a press release. If you don't believe me, you can believe Werner Vogels, who, back in 2006 said writing the press release when you're developing your product is sometimes the best thing to do, and his first thing here is nail the press release.
I think it is a really important thing to do together. What is a press release? What are the elements of a press release? The other important thing here is that, no matter what when you're writing this press release, when you reach out to reporters, it is great to send them the press release. Because it boils down the messages you want to get across.
Think about, what is the heading? What do you really want to get the message pull-through through all those articles? What do you really want to get across there?
The quote from your third party, and I'm going to go into third party validation in a little bit, but write the quote that you would like to see from a customer, a partner. Write a couple of them, and potentially see if you can get some third party validation.
Write it for them, before you go out to them. But I'll get to that in a second. This was the press release we used with Tectonic, and so, as you can see, we have our heading there. We actually used two quotes from third parties. We used RedMonk, and we work with Google on the Kubernetes open source project, so we had a quote from Google as well.
Another important point here is write a boiler plate, because it helps you succinctly get across your message of what your product is, and what your company is.
This is a press release example. Another part of developing your story is brand your launch. What do I mean by "brand your launch?" Create a image that goes along with your launch. We started doing this when we launched a CoreOS image on DigitalOcean, and it just went over really successfully.
Everyone was tweeting out this image, and then we saw such great return on people clicking through to our blog post. So really take the time to think through, "What is an image that could go along with this?" You could put the code from Twitter on your blog post so the picture continues to pop up. Hey, make t-shirts, we did with the DigitalOcean one. It was a lot of fun.
The other thing here is your blog post. It's another really important framework.
The blog post is completely different than the press release in terms of your press release really helps you get that messaging down, and your blog post should really communicate to your community.
So what's something that's really going to engage your community? Is there a demo you could do? Is there a tutorial? Is there a video that you could put on the blog post? What is going to make them read that and want to share it with people?
The next thing is also make sure you have some newsletters prepared for the day of your launch, so you communicate with your customers and community. Because at the end of the day, that's who you really care about.
I like to have some ads going on the day of your launch because if people are googling, or you know, looking on Twitter or something for information, it's sometimes good to have more noise in the space on your launch day. So users can just click through and learn more. That's the third party validation I was talking about.
Third party validation. A lot of times as startups we feel like, I think, we're just screaming at the top of our lungs about our product. And that's great, but, at the same time, when you hear it from someone else you believe them so much more. So, that's why it's really important to reach out to different third party resources.
I'll go over some resources in a second. But, like I said, we used RedMonk for this launch. They're an analyst firm, a developer-focused analyst firm, and then we also used a quote from the Kubernetes team, because we were working with them as well in this launch.
Some resources for that, some other analyst firms, Gartner, IDC, 451 Research. Important to note there that you can reach out to analysts under NDA, you know, a lot earlier than other parties. So, you can start talking to them, and they'll usually honor your embargo, so you can tell them more about your launch, and if the meeting goes well, then you can follow up with them and ask them for a quote.
A well known customer: this is like the best you can get because a customer talking about your product shows that people are adopting it. It's also the hardest thing to get, so we all want customers to talk about our product.
The thing about that is, if you're going to get a customer to talk about the product, make sure that they're willing to talk to reporters, and provide a quote, and make sure they're all bought in on it before you go out there spreading the news that they're using your product. Partners, any big companies you use.
I also think that's a good point to have in your press release. Or advisers, I'm sure a lot of you have advisers on your board that are excited about your product, and they're very well known, so you know, use your resources to the best. Also investors if they're willing to talk about as well.
The other thing on third party, you can also, on the day of your launch, coordinate with them to ask if they will write blog posts. Not analysts so much, but the other three, to ask if they'll post blog posts, tweet about it, and that's really important for that groundswell of activity on the launch day.
Step five: reaching out to the press. It's getting good now. You've written your press release, you have your blog post, you have all your materials. Before you reach out to press it's important to find your beat, so find the reporters that actually matter to you.
Google them. Google your industry, google a competitor, and maybe other open source projects that you work with. And find out who those reporters are, because that's important as well.
And then, before you reach out to reporters, and before you even do that, actually, I recommend reaching out to reporters, like, three days in advance. Because reporters are so busy, and there's so many things going on, that I think three days in advance gives you enough time.
If you're going to launch something on Thursday, you would start on Monday reaching out to reporters.
I recommend three touch points with a reporter. On Monday you'd reach out to the reporters with a pitch, and then, if you haven't heard back, you can follow up on Tuesday. And finally on Wednesday, the day before, you will send all your assets over to them. Final draft of everything.
But even before you do that, you have to set an embargo time. And I'm a big believer in embargo times for startups, because again, you want all of that coverage to hit at one time.
Let's say you're going to set your embargo time at 9 a.m. PT on Thursday. If that's the case, you have to communicate that to every reporter you talk to, to every customer that's going to potentially write a blog post, to any investor that's going to tweet something out.
You need to make sure that's completely coordinated, because if the embargo gets broken, it could ruin your news day, and you don't want that to happen. So it's important to follow up with reporters to reinforce the embargo time. That's really important.
Let's get to the pitch. When you're doing your research, though, you can also make a point if you find an article that a reporter has written about your space, you can write them and say, "I read this article. I think you'd be really interested in my launch." But the important thing about this pitch is that you need to make sure that you spell out the embargo time, and also that they agree to the embargo before they get back to you.
Make sure the embargo is top of the line. I've seen startups do this before, where they reach out to reporters, and then a day later they're like, "Oh my gosh, the products not going to be ready." And then they write the reporter and they're like, "Oh, can you please, like, can we hold this for another week or two?"
What happens is a reporter never takes you seriously again. So you want your first interaction with these reporters to be really good. Again, I know I keep talking about the embargo and timing, but it's really important, because once you break that trust of the reporter, it's hard to get it back.
You send out this pitch, and a reporter writes you back, and you're like, "Okay, now what?" As we're getting closer to launch day, a lot of us get really busy. It's hard to find time to prepare for these interviews, but I think it's really important to prepare.
Go through your blog posts, your press release, write down the top three messages that you want to get across. And usually when you're talking to a reporter, at the end of the conversation they'll say, "Did I miss anything? Is there anything else that you want to tell me?" That is your opportunity to spell out those top three messages in a conversational way, and have them leave the meeting with what they should know.
Also write down the top 10 questions that you think they may ask you, something that is really controversial, so you feel prepared for those hard questions that come across. Because they will ask them.
I think lastly, don't tell a reporter anything that you don't want them to print. So don't tell them that after this launch you're going to have this on this date and this on this date. Because launch dates move, and so just be cautious about what you tell them, because they can and will print it.
Step six: the day before. This is another follow-up point. I think it's important to coordinate with all of your third party advocates that are willing to step up and be there for you on the day of the launch. Make sure they know the embargo date. Write some tweets for them, make their lives easier.
And then follow up with every reporter you've spoken to, and give them the final press release, give them the final assets, reinforce that embargo time. It's important just to be ready for the day of the launch. Also, make sure that your team is ready to put all the materials up.
Going on to that, step seven and the importance of day-of. It's an all-hands-on-deck thing the morning or the day of your launch. Because you should have your whole team excited about it, and willing to promote it, and make sure if you said 9 a.m. PT on Thursday as your embargo day, make sure your site goes live at the time, your blog goes live at that time, because once it's live, reporters know that it's out there.
Sometimes if you don't get it live, and you come in at ten, and you're like, "Oh, yeah, I forgot we're doing that thing." Again, they just don't take you seriously as a company. So, also, follow up with all your third party people, make sure they're all set for putting their blog posts live, directing to your site.
Follow up with any reporters that may have not agreed to the embargo, so follow up with them again, and give them the press release and the assets, because now the embargo's been lifted so anyone can cover it. Make sure your team is ready to comment on things on Twitter. I think it's better if your community puts things on Hacker News, but if you wait an hour or so after launch and it's not on Hacker News, then, put it up there and see what conversations are had. But be sure you're on it to answer any questions that come up.
Step eight. So after that you should go and party, because you're going to have had an awesome launch. But the day after that, something that we usually forget because we get caught up in so much excitement about our launches, is don't forget to send thank you notes to all those reporters that you talked to, and all those third party advocates that made your day really special.
I think that we just get wrapped up in our excitement and forget about that, and I think that's great. I think with reporters, too, you should also offer to help them with their stories moving forward. So, if they're working on a story that you could help them with later.
With that, some quick takeaways, just to go through that is, be sure, before you even start this whole process: set goals for your launch, and then the embargo time, I'm sure you guys are tired of me talking about that, but stick with it or you lose respect quickly from reporters.
And then, remember it's not just about PR. We talked a lot about PR here, but, its about all of the components coming together and creating a groundswell of excitement around what you're doing and driving people to your site.
Prep for those interviews. Like I said, you get busy and it's hard to do that, but it's important because someone will ask those hard questions. And then, day of, make sure you clear your schedule. This is really important, fundamentally going to shift the direction of your company, and it's important that you are a part of that, and you really push your team to get excited about it all.
And then after that, go have a beer, or whatever. Go celebrate. And then, I think it's important to measure it, to figure out how many articles you got, how many tweets, what worked, talk about what worked, what didn't work, how you can do it better next time. What are some unique ideas that you could do next time? And then do it again.
So, on that note, I'm going to take a page out of my own book and thank you guys for taking the time to listen to me. I'm @melsmo on Twitter, and so now you guys have the tools to go tell awesome stories and create great launches, so, go do it!
I think you really could go out to analysts. You need to get them to agree to the embargo, but I think if you have your plan together, you can go out to them earlier than other parties like press.
Analysts schedules are super busy, so to get on their calendar, you usually have to reach out like a month before at least. So at least start reaching out a month before, and then if you can schedule some meetings, like at least two weeks prior to your launch, that's great.
A lot of times, I think us startups, we're like, "Oh my gosh, we can move fast. We're flexible, and we're going to launch this next week." And it's sometimes too late to even go to analysts. But you can try. That's why I think analyst firms like RedMonk, 451 Research, they're a little bit easier to get on their calendar if you don't have a relationship with them.
But some of the bigger ones like Gartner and IDC, you need to probably reach out at least a month in advance. And then try to get on their calendars two weeks before the launch, so they have time to understand the industry and space. Especially if you're in a new industry and space.
Honestly, Gartner is, you can go ahead and set up meetings with them, and if they are trying to write, and be as relevant as possible, and understand these fast-moving technologies space as much as possible.
It is important, though, when you go and meet with an analyst, that you do have an analyst deck.
Which is, basically, think about like your pitch deck that you're giving to investors, basically, but talking about how big your market is. So maybe you don't have any customers yet, and I think that's okay. But talk about how big your market is, how you're disrupting it, who else is in this space and why they should care.
At Chartio, actually, we created this great Gartner relationship and were included in the new vendors for BI tools, and it was a game changer for Chartio. I believe they're getting close to being part of the magic quadrant right now, or something. And with CoreOS, we were recently part of the cool vendor research report. So, I think it's just really just all about relationship-building and reaching out and trying to educate them more in the market.
I don't know, it's great to have customers, but I don't think everyone in a space can talk about their customers yet. The one good thing I'll say about analysts, because they will agree to those embargoes, you can find a customer that maybe isn't willing to be out there talking about you in the public, but they are willing to talk to you, talk to an analyst on your behalf.
And because Gartner will not really mention their name in the research, I think that's fine to do as well. So I think it's mostly, boil it down, it's about relationship building and figuring out what the research is, and how to get included in it. It takes a lot of time, but it's worth the effort if you do it.
We are notoriously fast at launches at CoreOS. I have to say that, but I would recommend more time than we usually pull things together. So, I think this launch, Kelly also works at CoreOS, so, what do you think, it was like three weeks? Maybe about a month, okay.
So we had about a month, I guess, for this Tectonic launch. We knew it was coming, so for us, we did do reaching-out to analysts and starting talking to them about it. But, yeah, I think about a month, but honestly we've done launches in, like, a week. So, you just have to know. I would not recommend that, but I think, like a month is a better time frame.
It also gives you that time, if you're not going to reach out to reporters until three days before, it gives you so much time to get really good content together and create a great launch. And make sure you feel really comfortable with that messaging before you go out. I'm talking from like creation, months out.
I'm in marketing, right? So our engineering team is working on things, and then they'll say, "Okay, I think we're ready. We're at a certain point that we can launch something," right? And so we'll talk about what that is. And then at that month point we'll start working on the materials, and for us, it's like writing that press release and that blog post to get the messaging down, and really know, knowing the messaging that we want to get across.
And then that comes across in our website and what we really want to tell our community about it. So, yeah, if you have a month, I think that's good. Part of being a startup, though, is working fast, too. So that's understandable as well. If you're like, "Okay, I have three weeks. All right, I should reach out to analysts right now."
Well, first you should follow step. But you should write your press release and get your messaging down, and then reach out to analysts. Honestly, it's a long term goal of being included in the research. But in creating those relationships just so.
Analysts will give you their insight into your product, as well as what you're doing. You can have really good conversations with them about that as well. So, I think if they're willing to give a quote or not, you should keep in touch with analysts.
And on the day of your launch, if they were like, "You know, I just don't know that much about this space yet," or "I don't feel comfortable giving a quote," you should definitely stay in touch with them. Send them your news, and continue sending them information that you think is relevant to your company, because they'll get more invested in what you're doing, and it's just good to have their insight into what your doing as they're writing their research reports, too.
So, at the end of the day, of course we all want to be included in those analyst reports because a lot of enterprise companies read those. If you then go into sales, you can think about how you can use those research reports for your sales team and lead gen. A lot of times, you can buy the reprints if you're featured in one of them and then use it as a landing page and collect leads, and all that stuff.
So there's a lot of stuff you can do with those analyst reports. And your sales team usually loves having those analyst reports on hand to use them as well.
I think that if you are interested in getting insight from the analysts on your product, then you should pay for those relationships. Because they want to be invested in what you're doing, and they'll give you the time, and they'll give you the time to talk with them.
I also think it's really time consuming, honestly, analysts. So when you're paying for a relationship with an analyst as a startup, it's hard to find that time. I honestly think when you're a startup, you don't need to start with a pay-for-play. I think you can just start reaching out to analysts and talking with them.
They want to hear about the cutting-edge technology that all you guys are working on. And I think down the line, when you're really starting to focus on... If enterprise customers are the customers that you want to have, and that's really important to you, then I do think at some point you should pay for analyst relations and like start to run by these, run by your products that you're about to launch, and have their feedback in it, because they're going to go work with enterprises.
Almost every huge company works with Gartner. That's what is known. And so I think that's the best way to go about that. But I think if you're just beginning as a startup, I don't think it's needed to pay for those relationships.
We don't usually do that too often, actually. I think it's mostly because it's so noisy, and I think for us, unless we are part of the main keynote opportunity, or working with a partner that's part of the keynote, and we know there's going to be a lot of news coming out of that, it's hard to really make a dent in a trade show.
But again, I think if you have that relationship and there's something, you can do with them and that's going to be onstage at a keynote, that's an awesome opportunity. But otherwise, I think you have to be careful. Or you have to potentially go before the trade show. That's my opinion.
They just saw your funding, and they were like, "Ooh, money." Definitely you can just write them back and say, "I'm not interested at this time," and then you work with the analyst. They're going to continue to try to sell you on that.
Again, I think when you get to a certain point, and you're like, "Okay, I really am wanting to sell to Coca-Cola, and Pepsi." I don't know, all these that work with Gartner a lot. Then there's that time where you can start paying for those relationships.
But until then, I think just working with the analyst on the side. They do try to keep it split, so it's like sales side and it is research side. So you would work with an analyst like you would a reporter in some respects, but you can tell an analyst a little bit more as long as they agree to your embargo or like your NDA.
You know, so that goes back to my whole coordinated/synchronized story, because I think there are certain ones that have more circulation that'll drive more hits to your site. But at the same time, I think if you can create more noise, and what I mean by noise is "X" number of articles, "X" number of tweets, blog posts from different websites that are all driving. It just becomes, you become, part of the conversation of the day.
When you become part of the conversation of the day, then everyone's coming to your site. I would have to get back to you on the top-top. I mean, TechCrunch sends a lot of traffic. At the same time, a lot of people will argue they're not the ones that are going to sign up for your product.
That's a hard question. I feel like it depends on your community. If you tell me about your product, I could probably tell you more. But it depends. That goes back to googling who is covering your space the most, and then you would know what your community is probably reading the most, because that's why they keep covering it. Because they're getting clicks on it.
I think it comes down to googling and figuring out what is the best place that's having that conversation. I like to think of marketing as a conversation. If a reporter's writing about something that's interesting to your company, then you can reach out and talk to them about that, right? And tell them about what you're doing.
But if you reach out to someone random, it's like inserting yourself into a cocktail conversation that people are talking about something, and you're like, "Hey, I'm blah-blah-blah." And everyone's like, "Great, we're having this conversation," you know? That's why I just think everything's about a conversation. It's kind of hard question to answer. Thank you.