Designing Cybersecurity Products: Empathy Comes First and Technology Second

Cyber Builders must step out of the lab and into the field to innovate with real-world insights. Plus, practical advices to run customer interviews.

Hello Cyber Builders 🖖

I am continuing my series on “How to build a cybersecurity product or services for product leaders,” whether as a company founder or a product manager within a corporation.

Building products - whether cybersecurity or not - requires empathy with future users and customers. That’s why this week we zoom on planning and conducting interviews. Product leaders must leave the office’s building and get first-hand experience with their future customers… or at least have video calls with them!

As a founder or product leader, it’s natural to be excited about building a great product. However, it’s essential to take a step back and realize that you need to conduct non-sales interviews before you start building. These interviews will help you create a compelling value proposition by validating your hypothesis with real people, not just the version you have in your head. This will help you turn your assumptions into facts and ensure you build something that meets your customers’ needs.

Before we dive in, if you missed them, check out my first posts:

Cybersecurity Product Building - Initial Ideas and Vision are Hypothesis

From Local Champions to Global Innovators: Shaping Europe's Cybersecurity Destiny Takes a Mindset Shift

From Cyber Dreams to Business Realities: Decoding the Success Formula for Security Startups

Empathy First - Technology Second

At the beginning of the series, we emphasized the importance of documenting your expected business outcomes, whether you’re an individual startup founder or an established company focusing on specific business metrics. It is crucial that everyone involved, including yourself, your boss (if applicable), and colleagues or co-founders, agree with the expected outcomes. It is essential to clearly understand what is expected to be achieved before beginning a project. Projects must deliver specific outcomes, and the team must comprehend what they strive to achieve, regardless of the project’s efforts or outputs.

Founders of cybersecurity products or services are often engineers and technologists who view the problem as an answer to cyber attacks or weaknesses. However, they tend to overthink “by the book” and focus solely on the technical aspects of the solution, overlooking the importance of understanding their customers’ needs and pain points. To create a successful product, founders must develop empathy with their target market and conduct non-sales interviews to validate their hypotheses with real people. This will help them build something that meets their customers’ needs and solves their problems.

Alistair Croll & Benjamin Yoskovitz, in their seminal “Lean Analytics” book, explain it very clearly.

First, you need empathy. You need to get inside your target market’s head and be sure you’re solving a problem people care about in a way someone will pay for. That means getting out of the building, interviewing people, and running surveys.

Identifying a real problem and a real solution is the cheapest (since it costs only a cup of coffee). It also addresses the riskiest questions: will anyone care? It comes first.

Objectives and Problems Identified Hypothesis

So, the question is, “How do we get started with interviews?” If you read my previous post, you know that I recommend doing some prep work and following some steps.

I recap them in this diagram:

Build a Cyber Security Product focusing on Market and Customers

I recommend reading the previous posts if you missed them. Now let’s focus on the last part - Interviews.

Photo by Christina @ wocintechchat.com on Unsplash

Planning Interviews - Avoid Questionnaires

When I created Sentryo in 2014, I remember we planned for these interviews very carefully.. even too carefully! In fact, as an engineer-scientist-minded person, I designed a very long and comprehensive questionnaire.

We were new in the OT space then, and even though we had a small background in control automation, it was essential to understand what the cybersecurity team on one side and their OT / control systems on the other had in mind.

However, the questionnaire I had designed failed very quickly. It was too rigid and too detailed. No one fits into the boxes I had de facto designed. It was breaking the flow of the conversation with the people we were chatting with.

When planning interviews with potential customers, it’s important to remember that the goal is to have a natural and engaging conversation rather than a rigidly structured questionnaire. While it’s essential to outline the conversation clearly, it’s equally important to integrate the central hypothesis you want to test and keep your 4U problem statement in mind (unavoidable, urgent, underserved, and unworkable). This approach allows for a more open-ended conversation that encourages interviewees to share their honest thoughts and feelings about the problem they are trying to solve.

While it may be tempting to design a lengthy and comprehensive questionnaire to gather as much information as possible, it can lead to a rigid and artificial conversation that may not yield valuable insights. Instead, cyber builders should focus on developing a conversation guide that includes open-ended questions and prompts that encourage interviewees to share their experiences and perspectives. This approach can help you better understand the customer’s pain points, needs, and goals, which can inform the development of a more effective cybersecurity product or service.

Planning Interviews - Surpass Your Fear and Get Meetings

Many first-time entrepreneurs’ initial reaction is to be very stressed by the exercise. That is indeed very intimidating. As we’ve seen, it is cheap (” Can we have a coffee together?”) and quick (” I need only 30 minutes max of your time”), and you will learn a lot. So why hesitate so much?

The main reason is that it is not what you’ve been told an entrepreneur should be. In the media—TV or movies first—we are presented with entrepreneurs who have a “vision” and “a big idea” and work hard to make it happen. They build and execute upon that “vision.” That is what makes up a good story.

Considering everything as an assumption, embracing doubts, and going out to have open-ended conversations feels like a daunting process… that every successful entrepreneur is doing behind the curtains. You are never shown that process, and no one is making a TV show around it.

Let’s start.

First, you have to book a meeting.

To write a meeting request, follow the following steps:

1. Be clear on who you are and the project you are in - 1 sentence.

2. Give a few details on the project - 1 sentence.

3. Value the expertise/experience of your contact; it must be personalized - 1 sentence.

4. Ask for a non-sales meeting to have a conversation.

It could be something like:

I am working on an entrepreneurial project to launch a company specializing in [cybersecurity domain].

Our goal is to develop an innovative approach to security in the [more details]. The market already offers various tools … [offer a few details that make you more relevant, point to some web publication you’ve made, etc.].

I want to organize a non-commercial exchange with you to discuss these subjects and benefit from your expertise.

Running Interviews - A tool - The Mom Test Book

I already stressed the importance of that book, but let me restate again: Go read the Mom Test if you haven’t yet.

Do / Don’t Table extracted from the Mom Test book.

It’s all about getting the person to talk about the job he/she is doing now and how it connects with the problem space you are addressing. You want the person to share stories and examples. You want her to discuss what happened lately. What project did her company start last month and had difficulties completing (and why)?

You don’t want a “coffee machine” conversation about what “should be.” You need experience, facts, and stories.

You want to learn about their job—the one your product will optimize, scale, or offload.

Let’s see which questions you can use:

The person you are talking with

• Get background about the participant and the job. Build rapport and get the participants to talk freely.

• Tell me a little about yourself and what you do.

The main job the person is doing

• Understand the main job and the various tasks to perform it. Highlights the outcomes

• When was the last time you did the main job?

• What are you trying to accomplish?

• What helps you achieve your goals?

• What is the previous step? What’s the next step?

The difficulties

• Find out the real difficulties faced

• How did you feel overall while getting that job done?

• What do you avoid? Why?

• What could be easier? Why?

The organization

• Understand how the company is structured and plans to solve issues

• Who is in charge of X?

• Who owns the budget for Y?

The question list can be long, and you must be creative to adapt it to your context and project.

Conclusion

By being flexible and open-minded during the interview process, you can gather critical feedback that can help you validate assumptions about your product’s value proposition, identify areas for improvement, and gain a deeper understanding of your target market.

Your goal is also to validate (or change) the 4U problem statement and its list of hypotheses you built.

Please share your personal experience with me in the comments section.👇 I would love to learn about your stories from the trenches and know how hard (or easy) it was to run these interviews. What did you learn?

Let’s build!

Laurent 💚