Technically Speaking, Episode 3: Balancing Innovation With Technology Risks

This interview has been edited for clarity.

Asa: 

So Mike, you’ve spent the last five years building Salesloft’s security program and scaling it for a billion-dollar business. What’s the secret sauce? 

Mike: 

I’m so glad you asked that. I can’t wait to tell you all about it…. there isn’t one! And I think any security leader will tell you that. 

There are any number of ways to build a security program. I will say, if there was a secret sauce — if there was one thing that I would tell another security leader who was starting a security program, it’s don’t shy away from involving others. 

Assuming it’s a SaaS business, in order for security teams to really get meaningful work done, they’ve got to have involvement from their product team, engineers, infrastructure team, and legal team. Risks are generally not owned exclusively by the security team. They’re typically owned by whoever owns the technology or process. You’ve got to have good relationships across the business and make sure that the context for why you’re even having these discussions is well understood by the risk owners across the business.

Asa: 

From a CISO’s perspective, what are some of the potential risks to be aware of in general when thinking about sales engagement for their business?  

Mike: 

This is often a conversation that I’ll have with other CISOs where, right away, they want to know about our security program, but they need the context for what the heck is it that we’re trying to buy.

If you’re a CISO watching this, sales engagement is effectively a tool to improve the effectiveness of your sales reps. And it’s a tool that allows your sellers to engage directly with the buyer. So for a sales engagement platform, you think about the risks. Sales engagement platforms are going to have access to your email system in some capacity. They’re generally going to have access to your CRM. Your reps are going to be typically recording phone calls and those calls get transcribed. There’s going to be AI involvement in the platform. 

That’s why we have a security program.

We want to make sure that our customers trust us with the immense amounts of data that we process. Because this is such a critical platform for these companies, they need to also be able to trust that the providers that they’re working with have a security program that aligns with their policies and their risk appetite.

Asa: 

How does Salesloft help organizations comply with their own security policies? 

Mike: 

I think the answer there is twofold. One, it’s our own security program. Our controls. We hold ourselves to a very high standard of risk assessment and  risk identification.

We want to set the example for security and sales engagement. We want to make sure that our controls align with best practices, and that we’re effectively able to defend against cyber threats and ultimately protect our customers.

Two, if you think about our platform, we are constantly thinking about, not just the sellers and what they need, but also the other buyers that we have. The legal teams. The security teams at our customers. We want to make sure that the features, the capabilities that we’re building in the product also serve them. So that means better governance in the platform. It means granular configurability of configurations within the platform. Roles and permissions in the platform. Making sure that, again, we’ve given the customer the ability to set up the platform in a way that aligns with their policies. The way I interpret GDPR, the way I interpret SOC and these other standards, does not always look like how a customer is going to interpret those same standards.

Asa: 

And I would imagine based off of the industry, those standards and guardrails could look dramatically different. 

Mike: 

Absolutely, absolutely. Financial services business and a SaaS business could potentially look very, very different. 

Asa: 

When my AEs are in a deal cycle and a security review comes up, the number one certification that we hear about every single time is SOC 2. Why is it so important, and why does it come up so often?

Mike: 

The easiest way to explain it is the SOC 2 report that it’s an independent assessor’s opinion, but ultimately there are two things that they’re looking at. For the controls that you have in place, do those controls align with the trust services criteria? And then, when the auditors themselves are doing independent testing, were they actually able to verify that over the past 6 months or 12 months, that you did in fact do what you said you did?

It’s  a useful tool in security reviews because it tells you that not only does this company say that they have all these great security controls and they’re protecting your data, and that they’re highly available, but also they’ve had somebody independently verify it. So it’s useful from that perspective.

The one caution that I would give anybody who’s looking to learn about SOC 2 is that it doesn’t make a company secure. One of the requirements in 27001 is that you’ve got this model of continuous risk assessment and improvement. So if you are doing that and doing it well, and not just checking a box for compliance, then you’re going to be on the way to having a really solid program. Because that means that you’re effectively identifying risk. You’re championing risk within the business.