Cut the Noise, Ditch the Nonsense, Earn the Trust
Tyler Shields: Don't be afraid, right? If I think about my career and career progression, I've taken massive jumps and leaps that I should have never taken and never, never had the knowledge to take, like my first job in marketing, being a CMO. Like, I should have never had that opportunity; yet, I did it and was successful. So don't be afraid to take personal leaps. With the brand itself, don't be afraid to be authentic to who you are and take shots. Don't be afraid to execute tactics that may not -- others may not be doing today for fear that they fall flat. I think fear is what cripples a lot of people and a lot of companies with their ability to reach their audience.
David Moulton: Welcome to Threat Vector, the Palo Alto Network's podcast where we discuss pressing cybersecurity threats and resilience and uncover insights into the latest industry trends. I'm your host, David Moulton, Director of Thought Leadership for Unit 42. Today I'm joined by Tyler Shields, a cybersecurity strategy analyst at ESG, entrepreneur, and advisor with deep expertise in security, cloud computing, and business strategy. Tyler has held leadership roles at companies like Traceable, JupiterOne, Signal Sciences and Veracode. And he's well-known for his insights into security innovation, marketing, and investment strategies. Today we're going to be talking about an important but sometimes controversial topic, thought leadership versus echo chambers in cybersecurity marketing. The term thought leadership gets thrown around a lot in our industry, but is it always used correctly? Tyler argues that true thought leadership isn't just about repeating industry buzz words or reinforcing the status quo. It's about presenting original ideas, fostering meaningful debate and challenging conventional wisdom, even when that's uncomfortable. We'll also explore the dynamics of brand awareness and marketing tactics using an analogy of a bathtub -- Yep; I said it. A bathtub -- to break down how strong brand awareness sets the stage for marketing success. And we'll look at some of the most successful marketing strategies in and outside of cybersecurity, including brands like Dollar Shave Club and the Savannah Bananas to see what lessons we can apply to cybersecurity marketing. Finally, we'll discuss where cybersecurity marketing is headed in the future; how companies can stand out in an increasingly noisy marketplace; and, most importantly, how they can build trust with their audience. Here's our conversation. Tyler Shields, welcome to Threat Vector. Excited to have you here.
Tyler Shields: Always great to see you, too, David. How are you, bud?
David Moulton: I've been good. It's a little different than what I normally talk about. But, ever since we were together at the conference, I've been excited to make this podcast. Tyler, you've had this incredible career spanning cybersecurity research, strategy, product marketing, even some advisory roles for startups. And before we get into our deeper conversation today, I want to hear your thoughts on what made you jump back into, as you put it, your cybermarketing analyst roots.
Tyler Shields: Yeah. You know, per our conversation off -- off pod, I've had a very weird career. And I've just kind of followed my passion throughout that career, right? And it started as an R&D guy writing code, you know, doing offensive security work for cyberconsulting companies. Moved through an analyst role at Forrester for four years. And what -- what I found was that role was a combination of technology and business and research that I had never experienced before. It gave me kind of one leg in each side of the stool or in each pool, however you want to phrase it. Then I had the opportunity to build a couple of startups as CMO, and we got a couple of those successfully off the ground. And, when I look back at my career, I realized the research work, the understanding of the markets is what I really loved. And so I decided at this stage of my career to make the move back into being an analyst again.
David Moulton: That's awesome. As I say, do what you love, and you never work a day. And hopefully this podcast doesn't feel like work for you today.
Tyler Shields: This podcast does not feel like work. But I will say that, even if you do what you love, you're still working so.
David Moulton: That's true. Yeah, I don't mind working, actually. My wife often will tell me to stop choring on weekends and take it easy. And I'm like, but this is kind of my Zen, my mentor or my, you know, ability to do something ends up giving me satisfaction.
Tyler Shields: There you go.
David Moulton: So thought leadership, you know, it's a word that gets thrown around quite a bit, a buzzword, if you will. We hear it all over the place. But I think it is a meaningful term done right. I've actually written a memo on it when I got here to Palo Alto on what I think is and isn't thought leadership because a lot of things that weren't thought leadership were getting tagged as thought leadership. But I'm wondering what does that word mean for you?
Tyler Shields: Yeah. It's an interesting question, right, because you posed that question to me prior; and I had to put a little bit of thought into how I wanted to describe it because it's not just like, Well, duh. It's this, right? It's -- it's kind of a gray term, which is why you're asking the question. To me, the key thing about thought leadership is providing value to the listener. And I know that's kind of a weird way to look at it, but it's actually how I anchor all of my marketing efforts. If you provide value to the other side, the listener, the person that you're trying to reach, that's the ultimate marketing. And so, when you're doing thought leadership from a marketing vantage point, it's about providing value to someone else. So thought leadership could be, you know, simple definitions of something if the audience doesn't understand that. Or it could be very deep research that pushes the boundaries and drives the market and discusses innovation and, you know, new topics. And that, that's where I tend to live. Given my background as an R&D person, that's where I tend to live. But my -- my view of thought leadership is about providing value to the audience that you can't really get anywhere else.
David Moulton: You know, I've talked a lot about this idea of marketing, having this mandate and unique position of going out and answering the hard questions, doing the work to find the research, find the data, put it together, package it up, and deliver it. And I think that that's thought leadership. I think there's also things like earned insights that are thought leadership. But, if everyone is saying it already and you're joining the chorus, that's not thought leadership. That's echo chamber.
Tyler Shields: You're not providing value in that example, right, because the value has already been provided. The audience already knows what you're saying. And you're just, you know, spewing out the same stuff that everybody else is saying. And that's exactly why I say they have to receive it as valuable. And, you know, if 100 companies are all saying the exact same words, they're not going to receive it as value. They've heard it a million times. It's the same thing that they've already learned.
David Moulton: So, as security professionals, you know, we have this opportunity to say new things. But it can be scary. You're not sure how it's going to be received, if it's going to upset comms or PR teams. How do we lean into actual thought leadership rather than that echo chamber of recycled ideas?
Tyler Shields: So I think you can answer that question in a couple different ways. There's the individual version of that. As an individual person, it's about pushing boundaries and learning new things and expressing those new things as value to the audience. But then there's also the corporate version of that question, right? And I think oftentimes that forward-thinking pushing-the-boundaries view can be neutered a bit by corporate risk and corporate not wanting to say a thing that's going to turn off the audience or, you know, get any kind of negative brand impact. And, within reason, I don't necessarily think that's the right way to do things as a brand, right? I think, you know, the brand marketing is about being true to yourself. And if your -- if your company is just the extremely risk-averse stodgy old company that doesn't want to have a brand of innovation, fine. Then you're never going to get that out. But I think most cyber companies want that forward-thinking brand. And so push the boundaries, right? It's okay to be wrong. It's okay to state something that -- that may not be completely accurate. As long as you've done the research and you've explained how you got there, people make mistakes. Companies make mistakes, right? And you can recover from that. Now, obviously you can't go out there and say something that's, like, so horribly awful that it, you know, is irreparable to the brand. But I don't think anybody would do that anyway. So, for me, I love to push the boundaries. I love companies that recognize their brand can help and back those pushes and become innovative and forward-thinking. You know, there's a couple of big companies in the market, you know, one of which you guys work for, I think that does a really good job of pushing that brand.
David Moulton: So one of the things I have noticed, you know, I entered cybersecurity later in my career but that there's this tendency that we have to reinforce some of the same narratives over and over. And maybe it's not just cyber. But, in our space in cybersecurity, why do you think this happens so often?
Tyler Shields: I think it happens for two reasons. One, I would say our market, the cybersecurity market as a general market is a intelligence space, meaning it's very hard to do versus something that's been done for hundreds of years, like making a consumer package good or something like that, where the market is very different. We have to express very novel ideas, very difficult ideas, very difficult research in easy to consume ways. And that, that makes it very difficult to use some simplistic terms and simplistic words. And what ends up happening is people always try to be the smartest in the room. What I found has worked for me as CMO of multiple startups is to just use the most simple, straightforward words about what you do and state it cleanly to the audience. And all of a sudden they're like, Oh. You're this. Well, that makes sense. I need that, right? And so it ends up working very well.
David Moulton: So, when we were talking before the show, you talked to me about this idea of brand awareness versus marketing tactics. And you had this analogy that I really, really loved. You used this idea of a bathtub where brand awareness is the water, and marketing tactics are rubber duckies. Can you explain this concept to our audience and why so many customer -- or companies get it wrong.
Tyler Shields: Yeah. I think, you know, often -- I'll start with the second half of the question and come back. I think companies get it wrong because most cybersecurity companies, certainly the younger innovative ones are usually two guys that have created a really killer technology or technological idea on how to stop an attack or, you know, detect an attack; and they don't quite understand this concept of what brand is and how marketing works and how it's a compounding engine over time. So I came up with this analogy about bath water and rubber duckies where the rubber duckies are your SEO and your email sends and your phone calls and all of your individual tactics that you do as a marketing organization. If you just did those without any water in the bathtub, they would never float. They would never work. But, if you have brand impact, what -- what the water does is it raises the efficacy of every tactic that you do because if people recognize, oh, that's that brand that I saw at such and such an event or that gave me this swag piece that I found super interesting and very valuable to me or put out this research that I really learned something from, when they get that email or that phone call or that other piece of tactic, they start to go, Oh. That was something I learned from them. I enjoyed the time with them. And the brand makes the tactic much more palatable and successful. And that's why you see all these cyber companies that have no brand recognition whatsoever fire enough emails into the abyss, and everybody hates them because they don't know who they are. They don't know what they do. There's no relationship there. There's no value that that person has gained. And all of a sudden they're like, Hey. I've never given you anything in your life. Can you please come buy my stuff? Like, that doesn't work. You have to build that relationship over time. And that's the brand awareness rubber ducky analogy.
David Moulton: So, when you're thinking about getting the right balance of brand building efforts versus tactical marketing, I think that that's tied to the maturity of your business and where you are in your -- in your market. But could you dive into that a little bit and maybe give listeners some of your thoughts on when do you want to go after brand, when do you want to go after tactics, and how do you get that balance right?
Tyler Shields: Yeah. I would argue -- you know, it's funny. When I -- when I've done early stage startups, and I've been an advisor to a dozen or more, maybe even a couple dozen by this point, high-growth cybersecurity startups and super early pre-seed and seed stages so very familiar with that, that arena. And oftentimes they'll bring in a head of marketing and the -- or even just the demand gen person saying go create leads. Go make demand happen. And the problem is nobody knows who you are. You've never provided value. The relationship's not there. And these -- these folks are spending money spewing tactics with no water underneath the rubber duckies, right? So I would argue, actually, that the first probably year, let's call it a half a million in ARR to even 2 or 3 million is all about building brand. It's all about adding people to the database, building brand, and providing them value, not -- not trying to generate sales in any way, shape, or form. Your first couple of million comes on the back of -- the sales side comes on the back of the founders, investors, advisors. You get that thing off the ground 100% just by guerilla sales direct tactics, through your network while you're building your brand recognition, while you're doing events, while you're providing thought leadership and value to the audience. And then 2 million, 2 and a half million, whatever that magic number is, you start to, hey. You know, we have a new product launch. Would you like to see it? You start to add a little bit of true marketing tactics to the mix. So I would argue that, right out of the gate, it's almost all brand building.
David Moulton: So let's shift gears a little bit and talk about some non-cybermarketing campaigns that I think are exemplary. There's the Dollar Shave Club from 10 or more years ago that still sticks in my head. Went viral. It was part of the launch of that company, which eventually got acquired for something with a billion in it, I seem to remember. And then, more recently, you've written about the Savannah Bananas. If you've not seen the Savannah Bananas, you need to hit pause now on the podcast, go check it out, and come back. I think these are some really great examples of a different approach to marketing. And, Tyler, what can cybersecurity companies learn from those two, Savannah Bananas, Dollar Shave Club?
Tyler Shields: Yeah. I think what's interesting about both of those, if I'm going to do like a Harvard Business Review case study on that, right, is the uniqueness and the attention to authenticity of brand. And so what I mean by that is creating -- they wanted to create an environment that had a different value proposition, both of them, than the traditional market, right? And so let's just talk about the Bananas the Savannah Bananas. They created a value proposition that is entertainment, not just minor league baseball, not just, hey, we're going to go eat peanuts in the -- in the audience and drink a couple beers and watch a game in the sunshine. We're going to be entertained like a show attached to it, right? So they -- that was their value proposition. And what they did is they remained very true to that brand all the way through to social media clips, to all of the tactics that they layered on that brand. They were very authentic to who they wanted to represent outward. And I think part of cybersecurity is there's no authenticity of brand. That's where a lot of the problem lies. When you can actually say, Hey. Our brand is going to represent fun. Our brand is going to represent colors and brightness, not darkness. Like, there's lots of different ways you can do that, but you have to be true to what you want people to perceive as your brand. And I think the Bananas do a really good job of that because they -- they are unabashed that we don't care if baseball is not the core of what we're doing. We want to entertain. Entertainment is the core of what we're doing, and they remain truthful to that brand. And I think a lot of cyber companies, whether it's, you know, the dark vibe, the modern tech vibe, the -- you know, whatever they want that brand to be, let that shine through everything they do with a consistency. And make it stand out against the background that everybody else is doing, and I think you'll -- you'll find that you can market a lot better.
David Moulton: So I'm not fishing for compliments for Palo here. We'll assume that we're getting some of it right and some of it wrong.
Tyler Shields: Sure.
David Moulton: But are there any vendors that you see that are really doing a great job of this right now?
Tyler Shields: Yeah. The easy way to answer that question is to just quickly, very quickly ask yourself, Who do I remember? And if you can say, Who do I remember? Well, you know who I remember? I remember Keanu Reeves at Palo Alto, right? I remember that. I remember that, those ads. And I remember the vibe, and I remember the brand. And I remember, Hey. We're forward-thinking, innovative. There's the key words beneath that brand that Palo is looking to put forward, and they did a great job of doing that. There's probably -- you know, there's another company, and, you know, I'm talking book a little bit here. So just to be open about that. But Permiso has got another amazing brand. If you go to permiso.io, it's cartoony. And -- you know, it's very animated brand. But that's what they wanted their brand to be, and they've done a great job. And it stands out. It looks different. It appears -- you know, it's very different than Palo. Neither one is necessarily more effective than the other. But these are the things you remember, right? And so go to RSA. Walk the floor. Just walk the floor one time. What do you remember? Wiz did their shopping cart, their shopping mart booth. Everybody remembered that. They did a phenomenal job of turning the brand into something whimsical, fun, unique that stands out against the crowd. And they represented who they truly want to be.
David Moulton: Yeah. As you were talking about it, I was thinking about Black Hat. And one of the brands that stood out there was Tork, what they did with their lasers and their skeletons. And I was walking through the floor, and I thought, Is there a skateboard company here today? And there wasn't, but there was a crowd. You know, it drew people in because it didn't have the effect of put your thumb over the logo. Can't tell what the company is. It was its own thing. And same with Wiz. But, you know, we'd seen it before. And this, for me, Tork was the fresh one, you know, on the floor.
Tyler Shields: You know, what's interesting about it, though, is you don't have to be gimmicky, right? Like, it can be gimmicky, and it can come off gimmicky. But, like, sometimes just even like a refreshing -- a refreshing take on, Hey. We're the true company that provides true value in an easy-to-consume way and then leaning in on that value prop very cleanly can stand out against noisy backgrounds, right? It doesn't have to be cartoony. It doesn't have to be a race car. It doesn't have to be whatever, right? But there's lots of different ways you can achieve it, but the key is being true to what you're trying to get through.
David Moulton: So I want to go back to the Savannah Bananas for a second. I think that they are funny. I think they are really unique. And cybersecurity is often seen as this very serious field doing serious work. Do you think there's any room in cybersecurity for humor, to lean into that a little bit more? I mean, as the podcast host who thrives on and loves dad jokes, is there -- is there a space for that here? Not only is there a space for there, I think there's a big opportunity for people to tackle that vantage point. So I did a -- I created a podcast a couple years ago. We only did six episodes before I decided to go back to corporate work full time and couldn't continue the podcast. But, if you go watch that podcast, it's very much fun. I have, like -- I had big heads made of each of the -- each of the hosts of the show, and we would joke and have a blast. And the banter was 50% of the podcast. You know, it was just the back and forth between hosts who have known each other for 10 years working together to discuss a topic. So I think there's a lot of opportunity in cyber to stand out again by being true to who you are, whether that's funny or open or trans -- transparent. You know, I think there's a lot of opportunity for that, and I wish I would see more of it. Tyler, let's look to the future a little bit. And we'll -- we'll go five years, right? This feels like an impossible question. But, you know, we'll come back in five years and, if you've got it right, gold stars for you. And, if not, nobody will know. But, like, if you look ahead, what do you think the biggest challenges are for security marketers in this, you know, medium period of the next five years?
Tyler Shields: Yeah. That's a good question. You know, it's interesting. When I became a CMO the first time, I've -- actually, I've -- I've maybe had three jobs in marketing, a VP role and two CMO roles. I was never a line marketer, right? So the first role I had was a CMO role at a startup that sold for about 800 million. We ended up running that one up and doing a really good job of it. So I took everything down to first principles, right? Literally, because I didn't know what I was doing, it was like, Hey. How do I do this? Well, let's start with this, right? So everything came down to first principles. And what I ended up doing was pushing the boundaries. I was one of the first people who did a cabana at Black Hat. I was one of the first people -- I think I was the first person or first company to give away Yetis when they were just coming out, right? Because they were like 30 bucks a pop. And people were like, God, that's so expensive. I'm like, Yeah. But imagine the value provided and the brand impact. So, you know, I think the key thing is somehow staying in front of and remaining unique in what you're putting out and providing value in that unique way. And here's the interesting thing. Like, I'm afraid to go be a CMO one more time because I don't have that newbie mindset where I can just do stuff that seems off the wall because I've never done it before, right? I'll talk myself out of it sometimes because that shouldn't work as -- you know, I've done it for 10 years. That shouldn't work. But, in reality, it does. So I think that the trick is being very aggressive and trying things and letting -- letting things fly. So, if you want to succeed in the next five years, I would argue that the CMOs and the cyber companies that let stuff fly and say, Hey. We're going to be who we are. And we're going to be the Bananas, whether it's because they're funny or whether it's because they're super technical or whatever it is. But we're going to let it fly, and we're going to let it rip. Those are the ones that are going to stand out. Will they be successful companies? Maybe; maybe not. It highly depends on the tech, the product, the market, and other things. But their marketing should be highly successful.
David Moulton: I agree. I think that the moment that you move away from that authentic heartbeat of who you are as a -- as a company, what inspired you to do what you're doing, it -- that shines through. And people see it, and they kind of have that ick factor. And it's hard to recover from that.
Tyler Shields: Absolutely.
David Moulton: Trust is -- I think it's everything in cybersecurity, right? The second you lose your ability to have trust, it's game over. What are some of the biggest mistakes you see companies doing when trying to establish that -- that trust or that credibility?
Tyler Shields: Lying. Lying and hiding the truth, right. And -- and I'll be -- I'll be fully honest with you, I've seen so many companies that will shoot way beyond their mark with their tech, and they'll market something that doesn't actually exist. Or something will happen, and they'll try to bury it with PR. Or something else will -- you know, will happen; and they'll look for ways to change the narrative or spin things. And all of it comes back down to exactly what I'm talking about, which is your brand, your brand reputation, which is -- that's all you have as a business is your brand, who you are, right? And if you bury it and try to hide it, you're going to fail. And I think too often I see companies try to do marketing tactics just to get leads, regardless of whether it's who they are or not. They know, Hey. If I send 100,000 emails, I get this much back. That's what I got to do. And the reality is, yeah. We don't want to be perceived that way. We don't want our brand perceived that way. So let's not do that, right? And I think those that aren't true themselves or lie or spin things are the ones that will -- will ultimately fail.
David Moulton: I think that's good advice for any industry.
Tyler Shields: For sure.
David Moulton: Cyber in particular I think is so sensitive to it. And -- and the folks that we're working with, the folks that we're marketing to are unbelievably aware. They're sensitive. They're -- they're able to cut through any BS so quickly. They're paid to be risk averse. And I think the second that you come at them with something that doesn't line up, they're able to just suss it out so quickly.
Tyler Shields: Yeah. You know, it's interesting. I always say -- and this has been said by many people before. But it takes a lifetime to build trust. It takes a moment to tear it down. But here's the interesting thing: What does that result in as a company? It results in risk averse plays because they're afraid of that moment of tearing it down. They're afraid of doing that one little thing wrong that's going to rip their brand to shreds, right? So what I recommend is don't be afraid of that. Don't be afraid of it being ripped down. As long as you're truthful and honest and show your values, it won't be ripped down. You can make mistakes and not have your brand destroyed, right? And sure. There's certain mistakes you can never make and that you can never recover from. And you don't -- you do have to be risk averse to those. But the bulk of things that -- that I think CEOs and boards and company leaders are afraid of aren't going to hurt the brand. Let it rip, right? Have a shot at it. Take more risks.
David Moulton: So one of the things that I've noticed as a consumer of different products is that, when a company stumbles, it's the moment that they choose to recover from that stumble that impresses me, right? Like, the initial delivery didn't happen as expected; but they came through and corrected it and did it in a way that, you know, was genuine. And I'm -- I'm a believer in that company because I'm going, like, I don't need you to be perfect. But I don't need you to assume that a stumble and then blame me is okay. And -- and I think what you're saying here is like, don't hedge for the sake of not making any mistakes because that, in fact, is the risk. You won't stand out. You won't be authentic. It won't work if you try to operate that way.
Tyler Shields: That's 100% a great way to put it, right. Don't hedge. Take your shot. And, if it misses, that's most of the time going to be okay, right? Obviously, you're not going to shoot 90 degrees off target, right? But, if it misses 5% either way, 10% either way, just say, hey. We missed it. You know that -- that that storyline sucked. Sorry, guys. We're going to go back to the drawing board. Like, people appreciate the authenticity.
David Moulton: So you've worked across product strategy, marketing, as an analyst. And that unique set of experiences and the time that you've put into them, the difference that you've had in each role, I'm wondering, if you knit those together and you were able to give a big piece of advice to somebody who wants to be a security marketer -- I often talk to marketers who want to get into security, and they struggle with it. Or they don't know where the start. What -- what would you say to that person who's got that idea in their head that they want to join this awesome industry? Here's where you start. Here's what you do.
Tyler Shields: Yeah. I love that question. It's a very, very difficult answer because I can come up with a lot of recommendations for that person. I think -- I think the number one recommendation is to surround yourself with people that augment what you're capable of. So, for example, when I built Signal Sciences, you know, my -- I knew at that point I was very product-centric and was raw on the marketing tactics side. So what did I do? I hired people that knew marketing tactics very well. Later on, I was much more focused on the product marketing side of it as a PMM and needed, you know, press, needed social media. And so focus on what you are capable of. Surround yourself with the right people. And if you're trying to break into cyber and you don't know anything about cyber, your first hire should probably be a very technical PMM who knows cyber intimately and can help you with that gap in your -- in your learning. And you'll get there, right? Spend the time learning, and you'll get there. But that -- that's where I would focus.
David Moulton: Tyler, thanks for this awesome conversation. I really appreciate it. I love the analogy of the rubber duckies in the bathtub and those straight shots that you had on being authentic, telling a real story, and just being true to yourself as a brand in this space. I think that's so important.
Tyler Shields: Thank you so much for having me on, David. I love this conversation. And, if anybody wants to reach out, I'm happy to get connected on LinkedIn and help folks out.
David Moulton: Is that the best place to reach out to you is on LinkedIn?
Tyler Shields: Yep. Absolutely. Connect with me there. Say you saw it on this show, and I'll definitely connect with you. Well, that's it for today. If you like what you heard, please subscribe wherever you listen. And leave us a review on Apple podcast or Spotify. Those reviews and your feedback really do help me understand what you want to hear about. And, if you want to reach out to me directly about the show, email me at Threat Vector of paloaltonetworks.com. I want to thank our executive producer, Michael Heller; our content and production teams, which include Kenne Miller, Joe Bettencourt, and Virginia Tran. Elliott Peltzman edits the show and mixes the audio. We'll be back next week. Until then, stay secure. Stay vigilant. Goodbye for now.
