RSA Debrief 1.1

In a nutshell: here is the problem with enterprise security products - they charge enterprise prices, but they do not deliver enterprise quality.

They charge enterprise prices because that's who their customers are and the enterprise is willing to spend $ on silver bullets. They don't deliver quality mostly due to poor engineering and poor understanding of security, it is rare to see a security product that has better than average security engineering in their own product. These vendor people have the same tools as the rest of us and as such have to be willing to go the extra mile(s) to deliver more secure end products. They have to be willing to innovate, and with a few exceptions they haven't. When real enterprise architects try to design, implement, and scale these solutions IN THE REAL WORLD - they find that also don't deliver quality, because the vendors don't understand what they are protecting. We are seeing very impressive traction solving identity problems precisely because the subject is tractable area. it is pretty easy to get your head around the idea of a directory or rdbms with some accounts, groups, roles, attributes, and so on. However, there is no corollary track record of vendors/solutions understanding objects and transactions. So forget about being able to buy security, you can't even buy something that understands basic subject-object access control in the enterprise.

"Art is long and life is short, and success is very far off." - Jospeh Conrad

So when I read a post like this, it is instructive:

I know a number of the companies on the exhibit show floor were spending VC dollars to afford their 20x20 and I just have a hard time relying on a show floor presence being the most efficient way to generate leads. I think the war is won the 360 days you're NOT exhibiting.

That said, we had an amusing little thing happen to us. Someone wandered by our booth and when they saw the Ping logo, they stopped and paused, looking perplexed. When one of our sales team inquired, the gentleman said, "I thought you guys were bigger than that."

At first, I wasn't sure how to take that comment. But I've since decided it's really a compliment in disguise. I'm now decided we should keep our booth to 10x10, no matter how big we get. We'll spend the money we save on great software.

Not saying marketing is not important - it is. But when your products are already overpriced (because of what the customer is willing to pay, not because you are building BMWs) is marketing your biggest problem? You have the price, your customer needs the quality. Ping has a line out the door of enterprise customers

1. buying their products (important)

2. implementing their products in real world apps (more important)

3. scaling their products across the enterprise for cost effective security (most important)