Every startup wants to be a category creator. But, how do you actually accomplish that? And is it always the right path?
Today, many people (myself included) view Wiz and the Cloud Native Application Protection Platforms (CNAPP) category as completely synonymous.
I recently got to chat with Raaz Herzberg, VP of Product Strategy at Wiz. Joining in 2020, Raaz was among the company’s first ten employees. Since then, Wiz has been crowned the fastest-growing software company in history, hitting $100 million in ARR in only 18 months.
Raaz shared her perspective on the concept of category creation, the vital role that listening to customers plays in this process, and why she thinks Wiz was able to define the CNAPP category.
What’s so exciting about category creation, anyway?
“Category creation is when companies manage to build their own game versus playing somebody else’s game,” explained Raaz. Instead of building a new service to an existing market, you’re defining a new category of services for a specific market that you’re hypothesizing exists.
Category creation can be high risk, but also high reward.
The advantage: category creators get to define what the most important features are and become the product that all others are compared to. Take the iPhone. Even today, Apple’s success is closely linked to their ability to build a new category that revolutionized the smartphone market, and the two terms are often used interchangeably.
The danger: When creating a category, you’re operating with more risk and uncertainty. You may need to educate prospects about a need or pain that customers are still early in articulating for themselves. If your new category doesn’t fit into a line item in a prospect’s budget, it can make it harder to sell your product, Raaz admitted.
As an investor, I speak to a lot of founders who see category creation as a strategy that’ll catapult their business to success. They look up to companies who, like Wiz, have become completely synonymous with their product category in a relatively short period of time.
But, reflecting on her three-and-a-half year-journey at Wiz, the advice Raaz shared may come as a surprise:
“I wouldn’t really think of category creation as something to pursue.” In fact, Raaz told me that Wiz was never focused on categorization in any strategic way.
“Our goal was to build a product. Our goal was not to create a category.”
So, intentionally or not, how did Wiz come to define and dominate the CNAPP category? And what can founders learn about category creation from their journey?
Here’s the story:
It was March of 2020 when the team set out on building a network security solution, originally named Beyond Networks.
“Everything shut down because of COVID. Seemed like a very bad time to leave Microsoft and start a company,” Raaz remembered.
But with everyone stuck at home, people had time on their hands. Raaz and her team would call ten to fifteen CISOs a day and ask them about their biggest pain points. Raaz described how companies could feel their cloud security programs cracking—not actually being effective at improving risk and causing friction between developers and security.
There were already tools on the market that were supposed to solve this problem.
The Cloud Security Posture Management (CSPM) category predated Wiz, and was born from the fundamental shift to cloud security and the risk introduced when developers began managing their own infrastructure.
The category contained what Raaz calls the “first gen” of cloud security solutions. They were complex and siloed, generated too many alerts for organizations to take action upon, and weren’t cloud-native.
“They were not doing a good service to customers. And customers knew that too—that was our advantage here.”
Focus on the problem, not improving existing solutions
At this point, Wiz could have easily gotten caught up in the shortcomings of existing solutions, and built an “incrementally better” CSPM. However, they realized that the scope of the problem was much bigger than the confines of what the CSPM category was supposed to cover.
What Wiz recognized through these conversations was a need for a cloud security service that facilitated collaboration between security and development teams and truly enabled companies to run faster on the cloud.
“When we talked to customers when Wiz started, in their heads, cloud security meant CSPM,” she explained. “But, we had to know that we’re going to offer something dramatically different in order to help organizations transition from what they did today to this new thing we want them to do tomorrow.”
Lucky for Wiz, many organizations were already bought into the idea and it was the major priority for their organization. “Their security teams already know that what they were doing did not enable them to scale in the way that dev and cloud scales,” she recalled.
While categorization may have been an afterthought for Wiz, it turned out that Gartner shared their vision of where the market was going based on their own research. They coined the term CNAPP, or Cloud Native Application Protection Platform, which addressed many of the problems that Wiz had heard from customers in their research. While there was an element of serendipity at play, by focusing on defining problems rather than solutions, customers need led both Wiz and Gartner to the same place at the same time. And thus, a category was born.
Only the #1 problem matters
Not every Gartner category paves the way for a game-changing player like Wiz. So, what was so special about CNAPP and how did Wiz help it become such a ubiquitous term in the tech community?
Wiz knew that if they were really able to address the pain points that they heard from customers —if they could enable organizations to effectively reduce risk at the pace of modern development—they knew their solution would be priority number one because it solved problem number one.
“Our strategy was truly listening to customers and solving to address their biggest pain point,” she explained.
This point, while it may seem obvious, especially resonated with me. When I think about the countless startups that I’ve pitched to potential buyers in due diligence processes over the years, there’s a clear difference between when you’re touching on a number one problem vs. a number two or number five problem. Their eyes light up!
When you offer a solution to a problem that’s low on the priority list, they smile and nod, but rarely have a visceral response – even if the product you’re pitching solves the problem perfectly.
Category creation is hard, and it’s likely only going to work when there is a large community who is deeply passionate about the problem. Founders who wish to build category-defining companies should dig deep with customers to understand what keeps them up at night above all else, and be relentless in solving their number one pain.
Make the value clear to end users, not just buyers
As they set out to fix cloud security, Wiz took the time to deeply understand the way their end users, not just their budget holders in security, thought. They knew that developers wanted to see the most critical risks in a way that was clear and actionable.
“If you ask me about my proudest achievement at Wiz, it’s the fact that developers log into Wiz and fix issues. That’s my real stickiness. That’s my real metric,” Raaz said.
It’s a sign that Wiz succeeded in using end user insights to prioritize features that mattered most, and were able to communicate the value of their service effectively to everyone who used it—not just the security leader who paid for it.
This type of deep evangelism can be a major accelerant for category creation. The more people who can articulate what your product does and why that’s important, the easier it is for your message to take hold in the community.
Don’t get married to terminology
To Raaz, categorization only matters insofar as it helps people understand a service. But while categories are a useful tool to help some customers ‘get it,’ for other customers, the terminology is intimidating and confusing.
“A lot of people have never heard of either CNAPP or CSPM, yet they have cloud. It’s really important to talk in the way your prospect thinks—they don’t necessarily think in categories,” she said.
“I do believe in meeting people where they are. Meaning, if there’s an existing product space and there’s existing terms people know, then it’s very important for me to explain to them how I map to those things.”
Knowing when to create a new category
How should a founder know if and when it’s worthwhile to create a category for their product?
Raaz recommends starting by asking yourself where the need comes from.
“Is it a need that comes from the customers or is it a strategy you want to execute? Because for me, if it’s a strategy you want to execute, then it’s a high risk one. It’s a lot of investment.”
As Raaz sees it, if category creation is the right thing to do, your customers will lead you to it. “Creating a category can be a tool in a toolset or a means to an end, if I think that that’s what’s going to make my company successful,” says Raaz.
The TL;DR: Category creation is an outcome, not a goal. Focus on value and, if it’s meant to be, the category will follow.
The post How Wiz Built A Must-Have Category – And Hit $100M ARR in Only 18 Months appeared first on OpenView.