To become a better cybersecurity startup founder, you need to master writing
In this piece, I discuss writing as a tool that can help founders and security practitioners build the future of cybersecurity
Welcome to Venture in Security! Before we begin, do me a favor and make sure you hit the “Subscribe” button. Subscriptions let me know that you care and keep me motivated to write more. Thanks folks!
Over 2,510 copies of my best selling book “Cyber for Builders: The Essential Guide to Building a Cybersecurity Startup” have been distributed to the readers so far. This book is unique as it talks about building cybersecurity startups. It is intended for current and aspiring cybersecurity startup founders, security practitioners, marketing and sales teams, product managers, investors, software developers, industry analysts, and others who are building the future of cybersecurity or interested in learning how to do it.
After building a large following around Venture in Security (over 500,000 in 2023), the industry’s leading blog about the business side of the cybersecurity industry, and publishing a bestselling book “Cyber for Builders”, I often get a few of the same questions. “Are you building a media company? Why don’t you do it full-time?”. The answers often surprise people.
First and foremost, writing for me is a weekend project. I am an operator, and I thrive in making things happen, solving hard problems, and bringing something new to the world. Writing helps me to refine, organize, and articulate my thoughts, which ultimately makes me a more competent builder. As Flannery O'Connor once put it, “I write because I don't know what I think until I read what I say”.
Over the years, I have learned that writing is a tool, and as such, it can be used to accomplish just anything - grow one’s career, expand one’s network, and most importantly, scale one’s impact. Additionally, writing is a great tool for building a company. While that is true in any field, it is especially the case in cybersecurity.
Writing as a way to refine one’s thinking
Startup founders are dealing with thousands of competing priorities, disjoined and contradicting signals from the market, confusing customer feedback, and a never-ending stream of ideas about what they “should be doing” from investors, advisors, co-founders, employees, family members, industry analysts, and almost anybody that has an ability to form an opinion. There is a lot of gold in all this feedback, so smart founders don’t simply ignore any opinion that differs from their own, but neither should they be acting on everything immediately. Achieving a perfect balance between maintaining a clear direction, and focusing on what matters the most at a given time, while also reflecting on the broader context is hard.
Writing is a great tool to help founders refine and organize their thinking. By allocating time for reflection and writing every week, they can avoid getting lost in the weeds of execution. Most small decisions founders make in their day-to-day happen on autopilot, as they should: trying to analyze every small decision would lead to analysis paralysis and slow down (or outright halt) their ability to move fast, iterate, and accumulate learnings. Since so much of the day-to-day happens without conscious efforts and analysis of all available trade-offs, founders must retain their ability to think well. Thinking is a muscle, and writing is by far one of the best ways to train that muscle.
Clear writing is a reflection of clear thinking. Paul Graham, one of the most impactful thinkers and doers of our time, in one of his tweets once put it really well.
Source: Paul Graham
Writing as a way to establish credibility
Whether you are an early-stage founder, someone toying with the idea of one day starting a company to tackle an important problem in the industry, or a security practitioner, to build credibility among your peers, you need to find a way to demonstrate your knowledge. As the saying goes, “It's not about what you know it's about who knows what you know”.
Establishing credibility in your field will position you as a go-to person when others have interesting ideas to discuss, questions they want answered, or even problems they are thinking of solving as founders. Being seen as an expert in your area increases the chances that you will get lucky and that you will find a great opportunity. Dr. James Austin, a neurologist and author of “Chase, Chance, & Creativity: The Lucky Art of Novelty” defines this as “type four Luck”. This kind of luck occurs when your unique set of attributes attracts specific luck to you. For example, if you are known as the world’s leading expert in digital forensics, someone interested in building a next-generation digital forensics solution could be looking to recruit you as an advisor, early employee, or even a co-founder.
There are many ways in which one can help others see what they know. Speaking at industry conferences, being an instructor at security training, recording educational videos, staying active on social media, recording a podcast, writing a blog, or publishing a book are some of the most common ones. It is best to find a medium that is most suitable for the person: some prefer podcasts, others thrive as facilitators of expert panels, while a few people have established impressive following around their newsletters. Regardless of individual preferences, writing is a skill foundational to any medium: conference talks require submission of calls for papers (CFPs), panel participants need the ability to condense their knowledge and present it in an easy-to-digest, concise manner, and blog authors need to learn how to write well.
Writing as a way to validate market problems
As a product leader, I know well that conducting customer interviews and problem discovery calls requires an ability to summarize thinking, ideas, and feedback from tens or even hundreds of people and turn them into actionable insights.
There are two ways in which writing can help early-stage founders validate problems, decide where to direct their efforts, and what to build. First, it is critical to take detailed notes during the discovery interviews. Our brains are biased, so we tend to quickly forget, discount, or greatly misrepresent feedback that does not align with our preexisting biases and assumptions. What often happens is that we subconsciously pick out the perspectives that resonate with what we already think, and ignore the rest. Instead of leading to new learnings, if not done well customer interviews can further reinforce biases and stale assumptions of founders, leading them to make decisions that take the company further away from what customers need. When learnings from every meeting are well documented, it becomes possible to see the bigger picture, spot patterns, find common threads, identify different customer segments, and draw powerful insights.
Another way to validate market problems is by writing about them. I find it helpful when in response to an article I share on social media or in my blog, someone brings a new perspective or looks at the problem from a completely different angle. I have definitely evolved my thinking about several problems thanks to feedback from the readers. It is important to keep in mind that our networks tend to amplify our perspectives and lead to echo chamber effects. That said, sharing one’s ideas and talking about what matters can still result in new learnings and a better understanding of the problems.
Writing as a way to attract people who share the founders’ worldview
At the earliest stages of the company, it is especially critical that the people founders surround themselves with, be they advisors, early employees, or investors, share the same view of the world. Writing and evangelizing about the problems founders think must be solved enables them to rally around supporters who share their passions.
Attracting the best talent for early-stage startups is not easy. Unless the company is one of the hottest Bay Area unicorns, it may be out of luck trying to poach superstars with impressive track records who are probably making ten times what the startup can pay somewhere at a large company. But, what it can do is excite people who are passionate about solving hard problems. Good writing can create a solid pipeline for hiring and enable the company to overcome talent acquisition challenges that early-stage ventures are commonly faced with.
Writing as a way to get the right help from the right investors
Whether we are talking about a former CISO turned VC, or someone completely unfamiliar with how security companies operate, investors need to be able to assess the view of the world the startup is putting forward, its market potential, and the ability of the team to deliver on their promises. Typically, to initiate a conversation with potential investors, founders first share a pitch deck - a stack of slides that attempt to help VCs decide if the company is worth an initial call. A pitch deck is like a resume: no reasonable investor will make their decision based on the deck, but if the founders fail to catch investor’s attention with the artifact, they may never get an opportunity to present their big vision.
Cybersecurity investors drown in industry abbreviations and big claims companies make as they are trying to convince VCs they are worth funding. Nearly every pitch deck talks about the rising losses from cybercrime, and that without the tool the startup is putting forward the world will not be able to defend against the adversary. What these decks usually fail to communicate is how this tool in the XYZ category is different from all other XYZ products on the market. The nuances surrounding the company approach are hard to communicate using bullet points. I have seen that sending a one- or two-page-long point of view (POV) or thesis writeup in addition to the deck can help founders explain in plain human language what they think makes them different and which conditions on the market create an opportunity for their entry.
Not only can writing help startups secure capital from VCs, but it can also make it easier to build relationships and get tangible support from their investors. After closing the deal, most founders are expected to send monthly and quarterly investor updates, often formatted as slide decks. No charts on the slide deck can capture the broader context of what is happening in the company. Best founders turn investor updates into an opportunity to also provide a brief, easy-to-read written update that highlights what matters, and makes it clear where the company needs investor support, and how VCs can best provide that support.
Ed Sim, Founder and Managing Partner at boldstart ventures, explained how writing culture makes it possible to also have better and more productive board meetings.
Source: Ed Sim
Writing as a way to build a brand, create awareness, and generate demand
There are two types of cybersecurity companies: those that are built as a better or a more modern alternative to address an existing need, and those designed to solve new problems and subsequently, create new markets. In both cases, startups have no choice but to invest in educating their prospective customers.
Founders who are building in an existing category, are dealing with customers aware of their problems, but often satisfied or somewhat satisfied with their current solutions. On the other hand, entrepreneurs with an ambition of becoming category creators, need to educate the market about both the problem and the reasons why the solution their company is proposing is the one the prospect should consider buying.
Writing is a great way to build a brand, create awareness of the problems the startup is solving, and generate demand for its solutions. Writing enables founders and executives to have a more productive dialog with prospects, industry analysts, resellers, and other market participants.
In today’s world, few security leaders are willing to spend an hour going through a scheduled demo just to learn what new approaches a startup is proposing. They are, however, often happy to consume thought leadership content that may be useful in their daily work. Creating non-gated reports, such as the Voice of the SOC Report by Tines, can drive people to the company website and expose them to new ideas and solutions.
Even more importantly, people want to hear from other people, not brands. This means that a founder's personal blog is more likely to capture the attention of security leaders and practitioners than a company’s marketing website (just ask yourself how often you go to corporate blogs to learn something new). For example, more people are willing to read Omer on Security, a Substack by Omer Singer where he talks about data lakes and detection engineering, than they would go to the Blog sections of Snowflake’s or Anvilogic’s corporate sites.
Writing as a way to build a community of supporters
Writing is a great tool for founders to build a community of supporters. While some people who share the startup’s vision end up joining as co-founders, early employees, or even becoming angel investors, many will stay aside as quiet champions and supporters. Many founders forget or don’t pay attention to this crowd to their own detriment: people who are excited about what the startup is trying to accomplish are its extended network. If treated well, they can become a great source of insights, investor and customer introductions, and even future employees.
The best way to keep this extended network of supporters engaged at scale is to send them a regular “friends & family” newsletter. It can be a brief, slightly edited version of the investor update about what the company is doing, its accomplishments, milestones, and areas where it could use some help. Some of the best hires, customer and investor introductions, and partnership opportunities come from leveraging the friends of the company, and it would not be wise for founders to miss out on this opportunity. It can be a good idea to add investors who ended up passing on the company to this list (with their permission, of course). Founders would be surprised to know how many investors can change their minds over time when they see that the company is delivering on its mission, gaining traction, and continuing to push the numbers up and to the right.
Writing as a way to rally the company around the same mission
There is probably nothing more distracting for a startup than having different people work hard while pulling in different directions. The reason misalignments are particularly harmful for early-stage startups is the speed with which they are moving, and the fact that having one person who is not on the same page with the rest of the team could be equal to having 10-20% of the company that is misaligned.
Producing written artifacts designed to bring people on the same page about the strategic direction of the company, clarify what personas the startup is selling to, and make it apparent who does not fit its ideal customer profile can help founders orchestrate collective efforts and gain momentum.
Writing as a way to coordinate, prioritize, and manage work and make decisions
Writing can be a great way to coordinate, prioritize, and manage work and make decisions. Amazon is probably best known as a company that embraced writing culture. Jezz Bezos famously expected from Amazon employees clarity of thought and was cognizant of the fact that ideas are never linear but interconnected. Bezos is quoted as saying “If you want to clarify your thinking, remember something important, or communicate something clearly, write it down” and "The great memos are written and rewritten, shared with colleagues who are asked to improve the work, set aside for a couple of days, and then edited again with a fresh mind. They simply can’t be done in a day or two. The key point here is that you can improve results through the simple act of teaching scope – that a great memo probably should take a week or more."
As Amazon has shown, the writing culture, when taken to an extreme, can also hamper innovation and become a way for people to stifle growth and sabotage new ideas. I do not believe that early-stage startups should embrace an Amazon-style obsession with grammatically correct and neatly organized documentation. Instead, they can use writing when the cost of missing something is the highest - for most impactful initiatives and strategic pivots that alter the direction of the company.
The remote and hybrid work environment places even more emphasis on documentation as a form of communication. And, the more expensive someone’s time is, the more likely it is that sending them a written summary before the conversation can help to get the context sharing out of the way and focus the discussion on what matters the most.
Here is how Shreyas Doshi, startup advisor and former product leader at Stripe, Twitter, Google, and Yahoo, explains the importance of good writing.
Source: Shreyas Doshi
These aren’t just theoretical ideas
Naturally when someone who has published a book and writes a blog with hundreds of thousands of regular readers says “Writing is a good skill”, people have the right to be skeptical. The reality is that writing can indeed help cybersecurity startup founders turn their big vision into reality. In this section, I would like to share several examples of companies that did just that.
Here is how Frank Slootman, CEO of Snowflake, describes the importance of writing for category creation in his book “Rise of the Data Cloud”, written with Steve Hamm. “When Snowflake released its cloud data warehouse in mid-2015, there literally was no cloud data warehouse product category. (Amazon had taken a data warehouse made for on-premises computing and was running it on its public cloud.) The tech industry and enterprise IT departments understood what a data warehouse was but Snowflake’s product was a brand new beast. So, …Snowflake turned itself into something of a book publisher - releasing one short book after another that explained complex topics in simple terms. Example: Cloud Data Warehousing for Dummies. In this way, they not only defined a new product category on their terms; they created an understanding of the key elements that differentiated Snowflake from traditional warehouses and from early cloud competitors.” - Source: Rise of the Data Cloud. Most recently, Wiz has collaborated with Wiley and published a book titled “CNAPP for Dummies”.
In the early days of CrowdStrike, the fact that George Kurtz, CEO and Co-Founder of the company was one of the co-authors of the best-selling book “Hacking Exposed: Network Security Secrets & Solutions”, along with Joel Scambray and Stuart McClure, definitely opened some doors and reinforced his stance as a thought leader.
Lastly, if you have ever been to an event hosted by JupiterOne, you probably have a copy of Sounil’s “Cyber Defense Matrix: The Essential Guide to Navigating the Cybersecurity Landscape” on your bookshelf. I don’t know to what degree the book has helped the company close sales deals, but it has obviously exposed the JupiterOne brand to people who would not otherwise learn about the company.
Writing is a flexible tool that, in my opinion, should be in every founder’s toolbox. Some might find it a good way to refine their own learnings, others might use it to claim a new product category, and many can rely on it to build relationships with investors and champions in the industry. Writing about security problems won’t make you an internet-level “influencer” because most people are not too excited when they hear about security. What it can do is put you in front of the people who share your passions, and that in itself is already more than anyone can ask for.
All agreement from me, but there's something hidden behind the circularity of "Good writers are rare because they're really good thinkers, and good thinkers are rare."
Where does good writing/thinking come from? Can it be cultivated? I think we're doing a lot to destroy it in tech, where writing has long been undervalued until it can be swallowed and regurgitated, seemingly cost-free, with LLMs.
Does anyone think of growing their own writers in all their departments? In universities this is called a "writing across the disciplines" program, and it's the only scientifically grounded way to ensure graduates are reasonably literate with measurable impact many years later. (The results speak for themselves, but very few universities have these programs.)
Do founders ask if — perhaps — they lack writers because they have a culture that punishes thought, clarity, and the focused time investments good writing/thinking takes? My sense of the norm is mediocre companies unwilling to pay writers (or cultivate them) the way they do with, say, software developers. Typically, "Writer" is assumed to fit in "Marketing" or else it has a "Technical" put in front of it and gets associated with some very important but possibly spectral technical documentation.
Is there any company where designers and developers, marketing and engineering have a deep and productive right-left brain synergy — especially in an extremely complex and incredibly fraught field like security? What if common divisions and silos between these fields exist not because of hard-wired personalities and brains but because leaders have failed to form, nurture, and guide healthy, balanced teams and cultures? They've probably got plenty of good communicators and clear thinkers in the closet who have learned not to bother, who left, or who never were let in.
Inserting a good writer when the need's been realized is too little, too late. A better thought for founders would be, "How do I nurture clear thinkers and communicators across the company?"